From 9d45909bedc8f3a427ff1a152f298b704c653704 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Fri, 21 Mar 2025 14:23:40 -0700
Subject: [PATCH 001/377] Do not remove internet capability for test interfaces

NetworkCapabilities already does this, so there is no point in doing it
here as well.

Test: TH
Change-Id: I0f45c5098318dbb3b15a70d6c60d5bcc6814d008
---
 service-t/src/com/android/server/ethernet/EthernetTracker.java | 2 --
 1 file changed, 2 deletions(-)

diff --git a/service-t/src/com/android/server/ethernet/EthernetTracker.java b/service-t/src/com/android/server/ethernet/EthernetTracker.java
index 7a192cefff..24d827844f 100644
--- a/service-t/src/com/android/server/ethernet/EthernetTracker.java
+++ b/service-t/src/com/android/server/ethernet/EthernetTracker.java
@@ -792,8 +792,6 @@ public class EthernetTracker {
                 new NetworkCapabilities.Builder(DEFAULT_CAPABILITIES);
         if (isTestIface) {
             builder.addTransportType(NetworkCapabilities.TRANSPORT_TEST);
-            // TODO: do not remove INTERNET capability for test networks.
-            builder.removeCapability(NetworkCapabilities.NET_CAPABILITY_INTERNET);
         }
 
         return builder.build();

From 69b176143f05dd07864b25c9bc6d867a5e1144c2 Mon Sep 17 00:00:00 2001
From: Paul Hu <paulhu@google.com>
Date: Sun, 23 Mar 2025 15:06:44 +0000
Subject: [PATCH 002/377] Add connectivity pre-check for
 ConnectivityManagerApi23Test

Bug: 401110123
Test: atest ConnectivityManagerApi23Test
Change-Id: I466ae73ddb48cf13e5cf396fd5002322e3fd755a
---
 tests/cts/net/api23Test/Android.bp      | 1 +
 tests/cts/net/api23Test/AndroidTest.xml | 4 ++++
 2 files changed, 5 insertions(+)

diff --git a/tests/cts/net/api23Test/Android.bp b/tests/cts/net/api23Test/Android.bp
index 7d93c3ac7d..c8e630f863 100644
--- a/tests/cts/net/api23Test/Android.bp
+++ b/tests/cts/net/api23Test/Android.bp
@@ -57,4 +57,5 @@ android_test {
     ],
     per_testcase_directory: true,
     sdk_version: "test_current",
+    host_required: ["net-tests-utils-host-common"],
 }
diff --git a/tests/cts/net/api23Test/AndroidTest.xml b/tests/cts/net/api23Test/AndroidTest.xml
index fcc73f38da..cc5568b3f7 100644
--- a/tests/cts/net/api23Test/AndroidTest.xml
+++ b/tests/cts/net/api23Test/AndroidTest.xml
@@ -25,6 +25,10 @@
         <option name="test-file-name" value="CtsNetApi23TestCases.apk" />
         <option name="test-file-name" value="CtsNetTestAppForApi23.apk" />
     </target_preparer>
+    <target_preparer class="com.android.testutils.ConnectivityTestTargetPreparer">
+        <!-- The tests require a working Wi-Fi network only -->
+        <option name="ignore-mobile-data-check" value="true" />
+    </target_preparer>
     <test class="com.android.tradefed.testtype.AndroidJUnitTest" >
         <option name="package" value="android.net.cts.api23test" />
         <option name="hidden-api-checks" value="false" />

From f250c51a2105d6ae845dfeb2673502e142ad6ab4 Mon Sep 17 00:00:00 2001
From: Paul Hu <paulhu@google.com>
Date: Sun, 23 Mar 2025 15:49:49 +0000
Subject: [PATCH 003/377] Add Checks for mDNS Unregistration and Discovery Stop
 Operations

mDNS service unregistration and discovery stop should only occur
if the mDNS service has registered or started discovery.
Therefore, a check is added to ignore unregistration or stop
requests if registration or discovery has not been executed.

Test: atest CtsConnectivityMultiDevicesTestCases
Change-Id: If7becd5a89a45da977141e8f9767a8ed85d9ba1b
---
 .../cts/multidevices/snippet/MdnsMultiDevicesSnippet.kt  | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/tests/cts/multidevices/snippet/MdnsMultiDevicesSnippet.kt b/tests/cts/multidevices/snippet/MdnsMultiDevicesSnippet.kt
index 1b288df95a..1ed54a8ab3 100644
--- a/tests/cts/multidevices/snippet/MdnsMultiDevicesSnippet.kt
+++ b/tests/cts/multidevices/snippet/MdnsMultiDevicesSnippet.kt
@@ -20,6 +20,7 @@ import android.net.nsd.NsdManager
 import android.net.nsd.NsdServiceInfo
 import androidx.test.platform.app.InstrumentationRegistry
 import com.android.testutils.NsdDiscoveryRecord
+import com.android.testutils.NsdDiscoveryRecord.DiscoveryEvent.DiscoveryStarted
 import com.android.testutils.NsdDiscoveryRecord.DiscoveryEvent.DiscoveryStopped
 import com.android.testutils.NsdRegistrationRecord
 import com.android.testutils.NsdRegistrationRecord.RegistrationEvent.ServiceRegistered
@@ -58,6 +59,10 @@ class MdnsMultiDevicesSnippet : Snippet {
 
     @Rpc(description = "Unregister a mDns service")
     fun unregisterMDnsService() {
+        if (!(registrationRecord.poll(timeoutMs = 0, pos = 0) is ServiceRegistered)) {
+            // Ignore unregistration if the service has not registered
+            return
+        }
         nsdManager.unregisterService(registrationRecord)
         registrationRecord.expectCallback<ServiceUnregistered>()
     }
@@ -86,6 +91,10 @@ class MdnsMultiDevicesSnippet : Snippet {
 
     @Rpc(description = "Stop discovery")
     fun stopMDnsServiceDiscovery() {
+        if (!(discoveryRecord.poll(timeoutMs = 0, pos = 0) is DiscoveryStarted)) {
+            // Ignore discovery stop if discovery has not started
+            return
+        }
         nsdManager.stopServiceDiscovery(discoveryRecord)
         discoveryRecord.expectCallbackEventually<DiscoveryStopped>()
     }

From a16f8b8126ae5e1d23a95aebf5f174f32606fa18 Mon Sep 17 00:00:00 2001
From: Paul Hu <paulhu@google.com>
Date: Mon, 24 Mar 2025 10:03:18 +0000
Subject: [PATCH 004/377] Format MdnsUtilsTest

Use the ktlint.py script to correct Kotlin code formatting errors.

Test: m
Change-Id: Ic3b4ff16fcaa465836c5b6653f1ab8dcc1b718b9
---
 .../connectivity/mdns/util/MdnsUtilsTest.kt   | 41 +++++++++++++------
 1 file changed, 28 insertions(+), 13 deletions(-)

diff --git a/tests/unit/java/com/android/server/connectivity/mdns/util/MdnsUtilsTest.kt b/tests/unit/java/com/android/server/connectivity/mdns/util/MdnsUtilsTest.kt
index efae244e48..2253913ed9 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/util/MdnsUtilsTest.kt
+++ b/tests/unit/java/com/android/server/connectivity/mdns/util/MdnsUtilsTest.kt
@@ -35,14 +35,14 @@ import com.android.server.connectivity.mdns.util.MdnsUtils.createQueryDatagramPa
 import com.android.server.connectivity.mdns.util.MdnsUtils.truncateServiceName
 import com.android.testutils.DevSdkIgnoreRule
 import com.android.testutils.DevSdkIgnoreRunner
+import java.net.DatagramPacket
+import kotlin.test.assertContentEquals
 import org.junit.Assert.assertArrayEquals
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertFalse
 import org.junit.Assert.assertTrue
 import org.junit.Test
 import org.junit.runner.RunWith
-import java.net.DatagramPacket
-import kotlin.test.assertContentEquals
 
 @RunWith(DevSdkIgnoreRunner::class)
 @DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.S_V2)
@@ -178,8 +178,13 @@ class MdnsUtilsTest {
         val interfaceIndex = 99
         val response = MdnsResponse(0 /* now */, serviceName, interfaceIndex, null /* network */)
         // Set PTR record
-        response.addPointerRecord(MdnsPointerRecord(serviceType.split(".").toTypedArray(),
-                testElapsedRealtime, false /* cacheFlush */, ttlTime, serviceName))
+        response.addPointerRecord(MdnsPointerRecord(
+                serviceType.split(".").toTypedArray(),
+                testElapsedRealtime,
+                false /* cacheFlush */,
+                ttlTime,
+                serviceName
+        ))
         // Set SRV record.
         response.serviceRecord = MdnsServiceRecord(serviceName, testElapsedRealtime,
                 false /* cacheFlush */, ttlTime, 0 /* servicePriority */, 0 /* serviceWeight */,
@@ -189,16 +194,27 @@ class MdnsUtilsTest {
                 testElapsedRealtime, true /* cacheFlush */, 0L /* ttlMillis */,
                 listOf(MdnsServiceInfo.TextEntry.fromString("somedifferent=entry")))
         // Set InetAddress record.
-        response.addInet4AddressRecord(MdnsInetAddressRecord(hostName.split(".").toTypedArray(),
-                testElapsedRealtime, true /* cacheFlush */,
-                0L /* ttlMillis */, InetAddresses.parseNumericAddress(v4Address)))
-        response.addInet6AddressRecord(MdnsInetAddressRecord(hostName.split(".").toTypedArray(),
-                testElapsedRealtime, true /* cacheFlush */,
-                0L /* ttlMillis */, InetAddresses.parseNumericAddress(v6Address)))
+        response.addInet4AddressRecord(MdnsInetAddressRecord(
+                hostName.split(".").toTypedArray(),
+                testElapsedRealtime,
+                true /* cacheFlush */,
+                0L /* ttlMillis */,
+                InetAddresses.parseNumericAddress(v4Address)
+        ))
+        response.addInet6AddressRecord(MdnsInetAddressRecord(
+                hostName.split(".").toTypedArray(),
+                testElapsedRealtime,
+                true /* cacheFlush */,
+                0L /* ttlMillis */,
+                InetAddresses.parseNumericAddress(v6Address)
+        ))
 
         // Convert a MdnsResponse to a MdnsServiceInfo
         val serviceInfo = MdnsUtils.buildMdnsServiceInfoFromResponse(
-                response, serviceType.split(".").toTypedArray(), testElapsedRealtime)
+                response,
+                serviceType.split(".").toTypedArray(),
+                testElapsedRealtime
+        )
 
         assertEquals(serviceInstanceName, serviceInfo.serviceInstanceName)
         assertArrayEquals(serviceType.split(".").toTypedArray(), serviceInfo.serviceType)
@@ -210,7 +226,6 @@ class MdnsUtilsTest {
         assertEquals(v6Address, serviceInfo.ipv6Addresses[0])
         assertEquals(interfaceIndex, serviceInfo.interfaceIndex)
         assertEquals(null, serviceInfo.network)
-        assertEquals(mapOf("somedifferent" to "entry"),
-                serviceInfo.attributes)
+        assertEquals(mapOf("somedifferent" to "entry"), serviceInfo.attributes)
     }
 }

From bf4402fe677f7a5e3f3deadfaa1754b62ab35f69 Mon Sep 17 00:00:00 2001
From: Bessie Jiang <bessiej@google.com>
Date: Tue, 11 Mar 2025 17:11:58 +0000
Subject: [PATCH 005/377] Add logging of when the public key has invalid
 encoding or is not on the allowlist

Flag: com.android.net.ct.flags.certificate_transparency_service
Fixes: 400704086
Test: atest NetworkSecurityUnitTests
Change-Id: I76669d184731d873a944bf77534bb73381cb7ef0
---
 .../ct/CertificateTransparencyDownloader.java | 11 ++++--
 .../net/ct/CertificateTransparencyLogger.java |  2 +
 .../ct/CertificateTransparencyLoggerImpl.java |  6 +++
 .../server/net/ct/LogListUpdateStatus.java    |  7 ++++
 .../server/net/ct/SignatureVerifier.java      | 25 +++++++++----
 ...CertificateTransparencyDownloaderTest.java | 37 ++++++++++++++++++-
 6 files changed, 76 insertions(+), 12 deletions(-)

diff --git a/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyDownloader.java b/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyDownloader.java
index 41b58fac59..a477cc8559 100644
--- a/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyDownloader.java
+++ b/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyDownloader.java
@@ -32,7 +32,6 @@ import com.android.server.net.ct.DownloadHelper.DownloadStatus;
 
 import java.io.IOException;
 import java.io.InputStream;
-import java.security.GeneralSecurityException;
 import java.util.Collection;
 import java.util.Optional;
 
@@ -151,13 +150,19 @@ class CertificateTransparencyDownloader extends BroadcastReceiver {
             return;
         }
 
+        LogListUpdateStatus updateStatus;
         try {
-            mSignatureVerifier.setPublicKeyFrom(publicKeyUri);
-        } catch (GeneralSecurityException | IOException | IllegalArgumentException e) {
+            updateStatus = mSignatureVerifier.setPublicKeyFrom(publicKeyUri);
+        } catch (IOException e) {
             Log.e(TAG, "Error setting the public Key", e);
             return;
         }
 
+        if (!updateStatus.isPublicKeySet()) {
+            mLogger.logCTLogListUpdateStateChangedEvent(updateStatus);
+            return;
+        }
+
         startMetadataDownload();
     }
 
diff --git a/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyLogger.java b/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyLogger.java
index 2a37d8f778..8d13e452b5 100644
--- a/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyLogger.java
+++ b/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyLogger.java
@@ -36,6 +36,8 @@ public interface CertificateTransparencyLogger {
         UNKNOWN_STATE,
         HTTP_ERROR,
         LOG_LIST_INVALID,
+        PUBLIC_KEY_INVALID,
+        PUBLIC_KEY_NOT_ALLOWED,
         PUBLIC_KEY_NOT_FOUND,
         SIGNATURE_INVALID,
         SIGNATURE_NOT_FOUND,
diff --git a/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyLoggerImpl.java b/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyLoggerImpl.java
index f617523f71..12cdef32a2 100644
--- a/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyLoggerImpl.java
+++ b/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyLoggerImpl.java
@@ -22,6 +22,8 @@ import static com.android.server.net.ct.CertificateTransparencyStatsLog.CERTIFIC
 import static com.android.server.net.ct.CertificateTransparencyStatsLog.CERTIFICATE_TRANSPARENCY_LOG_LIST_UPDATE_STATE_CHANGED__UPDATE_STATUS__FAILURE_HTTP_ERROR;
 import static com.android.server.net.ct.CertificateTransparencyStatsLog.CERTIFICATE_TRANSPARENCY_LOG_LIST_UPDATE_STATE_CHANGED__UPDATE_STATUS__FAILURE_LOG_LIST_INVALID;
 import static com.android.server.net.ct.CertificateTransparencyStatsLog.CERTIFICATE_TRANSPARENCY_LOG_LIST_UPDATE_STATE_CHANGED__UPDATE_STATUS__FAILURE_NO_DISK_SPACE;
+import static com.android.server.net.ct.CertificateTransparencyStatsLog.CERTIFICATE_TRANSPARENCY_LOG_LIST_UPDATE_STATE_CHANGED__UPDATE_STATUS__FAILURE_PUBLIC_KEY_INVALID;
+import static com.android.server.net.ct.CertificateTransparencyStatsLog.CERTIFICATE_TRANSPARENCY_LOG_LIST_UPDATE_STATE_CHANGED__UPDATE_STATUS__FAILURE_PUBLIC_KEY_NOT_ALLOWED;
 import static com.android.server.net.ct.CertificateTransparencyStatsLog.CERTIFICATE_TRANSPARENCY_LOG_LIST_UPDATE_STATE_CHANGED__UPDATE_STATUS__FAILURE_PUBLIC_KEY_NOT_FOUND;
 import static com.android.server.net.ct.CertificateTransparencyStatsLog.CERTIFICATE_TRANSPARENCY_LOG_LIST_UPDATE_STATE_CHANGED__UPDATE_STATUS__FAILURE_SIGNATURE_INVALID;
 import static com.android.server.net.ct.CertificateTransparencyStatsLog.CERTIFICATE_TRANSPARENCY_LOG_LIST_UPDATE_STATE_CHANGED__UPDATE_STATUS__FAILURE_SIGNATURE_NOT_FOUND;
@@ -133,6 +135,10 @@ class CertificateTransparencyLoggerImpl implements CertificateTransparencyLogger
                 return CERTIFICATE_TRANSPARENCY_LOG_LIST_UPDATE_STATE_CHANGED__UPDATE_STATUS__FAILURE_HTTP_ERROR;
             case LOG_LIST_INVALID:
                 return CERTIFICATE_TRANSPARENCY_LOG_LIST_UPDATE_STATE_CHANGED__UPDATE_STATUS__FAILURE_LOG_LIST_INVALID;
+            case PUBLIC_KEY_INVALID:
+                return CERTIFICATE_TRANSPARENCY_LOG_LIST_UPDATE_STATE_CHANGED__UPDATE_STATUS__FAILURE_PUBLIC_KEY_INVALID;
+            case PUBLIC_KEY_NOT_ALLOWED:
+                return CERTIFICATE_TRANSPARENCY_LOG_LIST_UPDATE_STATE_CHANGED__UPDATE_STATUS__FAILURE_PUBLIC_KEY_NOT_ALLOWED;
             case PUBLIC_KEY_NOT_FOUND:
                 return CERTIFICATE_TRANSPARENCY_LOG_LIST_UPDATE_STATE_CHANGED__UPDATE_STATUS__FAILURE_PUBLIC_KEY_NOT_FOUND;
             case SIGNATURE_INVALID:
diff --git a/networksecurity/service/src/com/android/server/net/ct/LogListUpdateStatus.java b/networksecurity/service/src/com/android/server/net/ct/LogListUpdateStatus.java
index 3f9b762b4d..df32e42b69 100644
--- a/networksecurity/service/src/com/android/server/net/ct/LogListUpdateStatus.java
+++ b/networksecurity/service/src/com/android/server/net/ct/LogListUpdateStatus.java
@@ -15,6 +15,8 @@
  */
 package com.android.server.net.ct;
 
+import static com.android.server.net.ct.CertificateTransparencyLogger.CTLogListUpdateState.PUBLIC_KEY_INVALID;
+import static com.android.server.net.ct.CertificateTransparencyLogger.CTLogListUpdateState.PUBLIC_KEY_NOT_ALLOWED;
 import static com.android.server.net.ct.CertificateTransparencyLogger.CTLogListUpdateState.PUBLIC_KEY_NOT_FOUND;
 import static com.android.server.net.ct.CertificateTransparencyLogger.CTLogListUpdateState.SIGNATURE_INVALID;
 import static com.android.server.net.ct.CertificateTransparencyLogger.CTLogListUpdateState.SIGNATURE_NOT_FOUND;
@@ -41,6 +43,11 @@ public abstract class LogListUpdateStatus {
 
     abstract Optional<Integer> downloadStatus();
 
+    boolean isPublicKeySet() {
+        // Check that none of the public key setting failures have been set as the state
+        return state() != PUBLIC_KEY_INVALID && state() != PUBLIC_KEY_NOT_ALLOWED;
+    }
+
     boolean isSignatureVerified() {
         // Check that none of the signature verification failures have been set as the state
         return state() != PUBLIC_KEY_NOT_FOUND
diff --git a/networksecurity/service/src/com/android/server/net/ct/SignatureVerifier.java b/networksecurity/service/src/com/android/server/net/ct/SignatureVerifier.java
index 87a497383f..22953f42b4 100644
--- a/networksecurity/service/src/com/android/server/net/ct/SignatureVerifier.java
+++ b/networksecurity/service/src/com/android/server/net/ct/SignatureVerifier.java
@@ -15,6 +15,8 @@
  */
 package com.android.server.net.ct;
 
+import static com.android.server.net.ct.CertificateTransparencyLogger.CTLogListUpdateState.PUBLIC_KEY_INVALID;
+import static com.android.server.net.ct.CertificateTransparencyLogger.CTLogListUpdateState.PUBLIC_KEY_NOT_ALLOWED;
 import static com.android.server.net.ct.CertificateTransparencyLogger.CTLogListUpdateState.PUBLIC_KEY_NOT_FOUND;
 import static com.android.server.net.ct.CertificateTransparencyLogger.CTLogListUpdateState.SIGNATURE_INVALID;
 import static com.android.server.net.ct.CertificateTransparencyLogger.CTLogListUpdateState.SIGNATURE_NOT_FOUND;
@@ -84,28 +86,35 @@ public class SignatureVerifier {
         mPublicKey = Optional.empty();
     }
 
-    void setPublicKeyFrom(Uri file) throws GeneralSecurityException, IOException {
+    LogListUpdateStatus setPublicKeyFrom(Uri file) throws IOException {
         try (InputStream fileStream = mContext.getContentResolver().openInputStream(file)) {
-            setPublicKey(new String(fileStream.readAllBytes()));
+            return setPublicKey(new String(fileStream.readAllBytes()));
         }
     }
 
-    void setPublicKey(String publicKey) throws GeneralSecurityException {
+    private LogListUpdateStatus setPublicKey(String publicKey) {
         byte[] decodedPublicKey = null;
+        LogListUpdateStatus.Builder statusBuilder = LogListUpdateStatus.builder();
+
         try {
             decodedPublicKey = Base64.getDecoder().decode(publicKey);
-        } catch (IllegalArgumentException e) {
-            throw new GeneralSecurityException("Invalid public key base64 encoding", e);
-        }
-        setPublicKey(
+            setPublicKey(
                 KeyFactory.getInstance("RSA")
                         .generatePublic(new X509EncodedKeySpec(decodedPublicKey)));
+        } catch (IllegalArgumentException e) {
+            statusBuilder.setState(PUBLIC_KEY_INVALID);
+            Log.w(TAG, "Invalid public key base64 encoding", e);
+        } catch (GeneralSecurityException e) {
+            statusBuilder.setState(PUBLIC_KEY_NOT_ALLOWED);
+            Log.e(TAG, "Public key not in allowlist", e);
+        }
+
+        return statusBuilder.build();
     }
 
     @VisibleForTesting
     void setPublicKey(PublicKey publicKey) throws GeneralSecurityException {
         if (!mAllowedKeys.contains(publicKey)) {
-            // TODO(b/400704086): add logging for this failure.
             throw new GeneralSecurityException("Public key not in allowlist");
         }
         mPublicKey = Optional.of(publicKey);
diff --git a/networksecurity/tests/unit/src/com/android/server/net/ct/CertificateTransparencyDownloaderTest.java b/networksecurity/tests/unit/src/com/android/server/net/ct/CertificateTransparencyDownloaderTest.java
index 956bad57cd..f5e3b7d685 100644
--- a/networksecurity/tests/unit/src/com/android/server/net/ct/CertificateTransparencyDownloaderTest.java
+++ b/networksecurity/tests/unit/src/com/android/server/net/ct/CertificateTransparencyDownloaderTest.java
@@ -182,6 +182,41 @@ public class CertificateTransparencyDownloaderTest {
         assertThat(mCertificateTransparencyDownloader.hasMetadataDownloadId()).isFalse();
     }
 
+    @Test
+    public void
+            testDownloader_publicKeyDownloadSuccess_publicKeyNotAllowed_logsFailure()
+                    throws Exception {
+        mCertificateTransparencyDownloader.startPublicKeyDownload();
+        PublicKey notAllowed = KeyPairGenerator.getInstance("RSA").generateKeyPair().getPublic();
+
+        mCertificateTransparencyDownloader.onReceive(
+                mContext, makePublicKeyDownloadCompleteIntent(writePublicKeyToFile(notAllowed)));
+
+        verify(mLogger, times(1))
+                .logCTLogListUpdateStateChangedEvent(
+                        LogListUpdateStatus.builder()
+                                .setState(CTLogListUpdateState.PUBLIC_KEY_NOT_ALLOWED)
+                                .build());
+    }
+
+    @Test
+    public void
+            testDownloader_publicKeyDownloadSuccess_publicKeyInvalidEncoding_logsFailure()
+                    throws Exception {
+        mCertificateTransparencyDownloader.startPublicKeyDownload();
+
+        mCertificateTransparencyDownloader.onReceive(
+                mContext,
+                makePublicKeyDownloadCompleteIntent(
+                        writeToFile("i_am_not_a_base64_encoded_public_key".getBytes())));
+
+        verify(mLogger, times(1))
+                .logCTLogListUpdateStateChangedEvent(
+                        LogListUpdateStatus.builder()
+                                .setState(CTLogListUpdateState.PUBLIC_KEY_INVALID)
+                                .build());
+    }
+
     @Test
     public void
             testDownloader_publicKeyDownloadSuccess_updatePublicKeyFail_doNotStartMetadataDownload()
@@ -216,7 +251,7 @@ public class CertificateTransparencyDownloaderTest {
     }
 
     @Test
-    public void testDownloader_publicKeyDownloadFail_logsFailure() throws Exception {
+    public void testDownloader_publicKeyDownloadFail_logsDownloadFailure() throws Exception {
         mCertificateTransparencyDownloader.startPublicKeyDownload();
 
         mCertificateTransparencyDownloader.onReceive(

From 4364227e70429a882ac0e46d5a40ac85282179b5 Mon Sep 17 00:00:00 2001
From: Motomu Utsumi <motomuman@google.com>
Date: Tue, 25 Mar 2025 09:25:11 +0900
Subject: [PATCH 006/377] Set BPF_F_NO_PREALLOC for BPF_MAP_TYPE_SK_STORAGE by
 default

BPF_F_NO_PREALLOC flag is mandatory for BPF_MAP_TYPE_SK_STORAGE

Test: boot
Bug: 406080305
Change-Id: I22f12525512ea8047ef5ad9fbf93490558c13c3d
---
 bpf/headers/include/bpf_helpers.h | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/bpf/headers/include/bpf_helpers.h b/bpf/headers/include/bpf_helpers.h
index 9d6b6f6920..199661de65 100644
--- a/bpf/headers/include/bpf_helpers.h
+++ b/bpf/headers/include/bpf_helpers.h
@@ -256,10 +256,11 @@ static void (*bpf_ringbuf_submit_unsafe)(const void* data, __u64 flags) = (void*
 
 #define ABSOLUTE(x) ((x) < 0 ? -(x) : (x))
 
-#define DEFAULT_BPF_MAP_FLAGS(type, num_entries, mapflags)    \
-    ( (mapflags) |                                            \
-      ((num_entries) < 0 ? BPF_F_NO_PREALLOC : 0) |           \
-      (type == BPF_MAP_TYPE_LPM_TRIE ? BPF_F_NO_PREALLOC : 0) \
+#define DEFAULT_BPF_MAP_FLAGS(type, num_entries, mapflags)         \
+    ( (mapflags) |                                                 \
+      ((num_entries) < 0 ? BPF_F_NO_PREALLOC : 0) |                \
+      ( (type == BPF_MAP_TYPE_LPM_TRIE ||                          \
+         type == BPF_MAP_TYPE_SK_STORAGE) ? BPF_F_NO_PREALLOC : 0) \
     )
 
 #define DEFINE_BPF_MAP_BASE(the_map, TYPE, keysize, valuesize, num_entries, \

From 28c0533bf0d30c1c9c281b81be90fa8ee013a396 Mon Sep 17 00:00:00 2001
From: Sarup Dalwani <sarup@google.com>
Date: Fri, 14 Mar 2025 17:01:29 +0000
Subject: [PATCH 007/377] Removing interfaces from the InterfaceTracker when
 network is destroyed.

Bug: 400681214
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.connectivity.InterfaceTrackerTest
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.connectivityservice.CSInterfaceTrackerTest
Change-Id: Ifb3388800dec6ed208ca28dba080c5b736f09d35
---
 .../android/server/ConnectivityService.java   |  4 +
 .../server/connectivity/InterfaceTracker.java |  2 +
 .../CSInterfaceTrackerTest.kt                 | 96 +++++++++++++++++++
 .../server/connectivityservice/base/CSTest.kt |  2 +
 4 files changed, 104 insertions(+)
 create mode 100644 tests/unit/java/com/android/server/connectivityservice/CSInterfaceTrackerTest.kt

diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index 2c44b629a9..45b431f1e7 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -5787,6 +5787,10 @@ public class ConnectivityService extends IConnectivityManager.Stub {
             mDeps.disableIngressRateLimit(nai.linkProperties.getInterfaceName());
         }
 
+        // Removes the interfaces associated with the network being destroyed from the tracker.
+        for (String interfaceName : nai.linkProperties.getAllInterfaceNames()) {
+            mInterfaceTracker.removeInterface(interfaceName);
+        }
         nai.setDestroyed();
         nai.onNetworkDestroyed();
     }
diff --git a/service/src/com/android/server/connectivity/InterfaceTracker.java b/service/src/com/android/server/connectivity/InterfaceTracker.java
index 0b4abeb9cc..c6686afcc2 100644
--- a/service/src/com/android/server/connectivity/InterfaceTracker.java
+++ b/service/src/com/android/server/connectivity/InterfaceTracker.java
@@ -22,6 +22,7 @@ import android.system.Os;
 import android.util.ArrayMap;
 import android.util.Log;
 
+import com.android.internal.annotations.GuardedBy;
 import com.android.internal.annotations.VisibleForTesting;
 import com.android.server.BpfNetMaps;
 
@@ -39,6 +40,7 @@ public class InterfaceTracker {
     }
     private static final String TAG = "InterfaceTracker";
     private final Dependencies mDeps;
+    @GuardedBy("mInterfaceMap")
     private final Map<String, Integer> mInterfaceMap;
 
     public InterfaceTracker(final Context context) {
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSInterfaceTrackerTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSInterfaceTrackerTest.kt
new file mode 100644
index 0000000000..b06e11357f
--- /dev/null
+++ b/tests/unit/java/com/android/server/connectivityservice/CSInterfaceTrackerTest.kt
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License")
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.server.connectivityservice
+
+import android.net.IpPrefix
+import android.net.LinkAddress
+import android.net.LinkProperties
+import android.net.NetworkCapabilities
+import android.net.NetworkCapabilities.NET_CAPABILITY_INTERNET
+import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_VCN_MANAGED
+import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_VPN
+import android.net.NetworkCapabilities.TRANSPORT_VPN
+import android.net.NetworkCapabilities.TRANSPORT_WIFI
+import android.net.NetworkRequest
+import android.os.Build
+import androidx.test.filters.SmallTest
+import com.android.server.CSTest
+import com.android.testutils.DevSdkIgnoreRule
+import com.android.testutils.DevSdkIgnoreRunner
+import com.android.testutils.RecorderCallback.CallbackEntry.Lost
+import com.android.testutils.TestableNetworkCallback
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.mockito.Mockito.inOrder
+import org.mockito.Mockito.verify
+
+private const val WIFI_IFNAME = "wlan0"
+
+private val wifiNc = NetworkCapabilities.Builder()
+    .addTransportType(TRANSPORT_WIFI)
+    .addCapability(NET_CAPABILITY_INTERNET)
+    .addCapability(NET_CAPABILITY_NOT_VCN_MANAGED)
+    .build()
+
+private fun lp(iface: String, vararg linkAddresses: LinkAddress) = LinkProperties().apply {
+    interfaceName = iface
+    for (linkAddress in linkAddresses) {
+        addLinkAddress(linkAddress)
+    }
+}
+
+private fun nr(transport: Int) = NetworkRequest.Builder()
+    .clearCapabilities()
+    .addTransportType(transport).apply {
+        if (transport != TRANSPORT_VPN) {
+            addCapability(NET_CAPABILITY_NOT_VPN)
+        }
+    }.build()
+
+@DevSdkIgnoreRunner.MonitorThreadLeak
+@RunWith(DevSdkIgnoreRunner::class)
+@SmallTest
+@DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.VANILLA_ICE_CREAM)
+class CSInterfaceTrackerTest : CSTest() {
+    private val LOCAL_IPV6_IP_ADDRESS_PREFIX = IpPrefix("fe80::1cf1:35ff:fe8c:db87/64")
+    private val LOCAL_IPV6_LINK_ADDRESS = LinkAddress(
+        LOCAL_IPV6_IP_ADDRESS_PREFIX.getAddress(),
+        LOCAL_IPV6_IP_ADDRESS_PREFIX.getPrefixLength()
+    )
+
+    @Test
+    fun testDisconnectingNetwork_InterfaceRemoved() {
+        val nr = nr(NetworkCapabilities.TRANSPORT_WIFI)
+        val cb = TestableNetworkCallback()
+        val interfaceTrackerInorder = inOrder(interfaceTracker)
+        cm.requestNetwork(nr, cb)
+
+        // Connecting to network with IPv6 local address in LinkProperties
+        val wifiLp = lp(WIFI_IFNAME, LOCAL_IPV6_LINK_ADDRESS)
+        val wifiAgent = Agent(nc = wifiNc, lp = wifiLp)
+        wifiAgent.connect()
+        cb.expectAvailableCallbacks(wifiAgent.network, validated = false)
+        interfaceTrackerInorder.verify(interfaceTracker).addInterface(WIFI_IFNAME)
+
+        wifiAgent.disconnect()
+        cb.expect<Lost>(timeoutMs = 500) { it.network == wifiAgent.network }
+        // onLost is fired before the network is destroyed.
+        waitForIdle()
+
+        interfaceTrackerInorder.verify(interfaceTracker).removeInterface(WIFI_IFNAME)
+    }
+}
diff --git a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
index 0fe61eca44..5c55483ee9 100644
--- a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
@@ -288,6 +288,8 @@ open class CSTest {
             netd: INetd,
             interfaceTracker: InterfaceTracker
         ) = this@CSTest.bpfNetMaps
+
+        override fun getInterfaceTracker(context: Context?) = this@CSTest.interfaceTracker
         override fun getClatCoordinator(netd: INetd?) = this@CSTest.clatCoordinator
         override fun getNetworkStack() = this@CSTest.networkStack
 

From 3f81aec099f888aaee8df6339c13bdfe92babd3e Mon Sep 17 00:00:00 2001
From: Paul Hu <paulhu@google.com>
Date: Fri, 21 Mar 2025 14:52:27 +0000
Subject: [PATCH 008/377] Address aosp/3541181 leftover comments

Test: atest TetheringTests CtsTetheringTest
Change-Id: Iee9c1eec33403c95e29656b3dfb1bfefea81108e
---
 .../tethering/TetheringConfigurationTest.java    | 16 +++++-----------
 .../com/android/net/module/util/SdkUtil.java     |  2 +-
 2 files changed, 6 insertions(+), 12 deletions(-)

diff --git a/Tethering/tests/unit/src/com/android/networkstack/tethering/TetheringConfigurationTest.java b/Tethering/tests/unit/src/com/android/networkstack/tethering/TetheringConfigurationTest.java
index c4c7c9cca7..f0b7db60c8 100644
--- a/Tethering/tests/unit/src/com/android/networkstack/tethering/TetheringConfigurationTest.java
+++ b/Tethering/tests/unit/src/com/android/networkstack/tethering/TetheringConfigurationTest.java
@@ -767,23 +767,17 @@ public class TetheringConfigurationTest {
                 mMockContext, mLog, INVALID_SUBSCRIPTION_ID, mDeps).readEnableSyncSM(mMockContext);
     }
 
-    private void assertEnableSyncSM(boolean value) {
-        assertEquals(value, TetheringConfiguration.USE_SYNC_SM);
-    }
-
     @Test
     public void testEnableSyncSMFlag() throws Exception {
         // Test default enabled
         setTetherEnableSyncSMFlagEnabled(null);
-        assertEnableSyncSM(true);
+        assertEquals(true, TetheringConfiguration.USE_SYNC_SM);
 
         setTetherEnableSyncSMFlagEnabled(true);
-        assertEnableSyncSM(true);
+        assertEquals(true, TetheringConfiguration.USE_SYNC_SM);
 
-        // Feature is enabled by default after 25Q2 release.
-        if (!SdkUtil.isAtLeast25Q2()) {
-            setTetherEnableSyncSMFlagEnabled(false);
-            assertEnableSyncSM(false);
-        }
+        // Feature is enabled forcefully after 25Q2 release.
+        setTetherEnableSyncSMFlagEnabled(false);
+        assertEquals(SdkUtil.isAtLeast25Q2(), TetheringConfiguration.USE_SYNC_SM);
     }
 }
diff --git a/staticlibs/framework/com/android/net/module/util/SdkUtil.java b/staticlibs/framework/com/android/net/module/util/SdkUtil.java
index 63558dd18c..1acb156c54 100644
--- a/staticlibs/framework/com/android/net/module/util/SdkUtil.java
+++ b/staticlibs/framework/com/android/net/module/util/SdkUtil.java
@@ -52,6 +52,6 @@ public class SdkUtil {
 
     /** Checks if the device is running on a release version of Android Baklava or newer */
     public static boolean isAtLeast25Q2() {
-        return SDK_INT >= 36  || (SDK_INT == 35 && "Baklava".equals(Build.VERSION.CODENAME));
+        return SDK_INT >= 36 || (SDK_INT == 35 && "Baklava".equals(Build.VERSION.CODENAME));
     }
 }

From 503059428720e04c743e7abf5346cf9033ead969 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Tue, 25 Mar 2025 10:35:12 -0700
Subject: [PATCH 009/377] Move static IpConfiguration parsing into
 EthernetConfigParser

For consistency.

Test: TH
Change-Id: Idefd43d5b22b8f5e02561601f3bc4142ce8a783e
---
 .../server/ethernet/EthernetTracker.java      | 111 ++++++++--------
 .../server/ethernet/EthernetTrackerTest.java  | 118 ++++++++----------
 2 files changed, 103 insertions(+), 126 deletions(-)

diff --git a/service-t/src/com/android/server/ethernet/EthernetTracker.java b/service-t/src/com/android/server/ethernet/EthernetTracker.java
index 7a192cefff..bd4bfbd058 100644
--- a/service-t/src/com/android/server/ethernet/EthernetTracker.java
+++ b/service-t/src/com/android/server/ethernet/EthernetTracker.java
@@ -782,8 +782,7 @@ public class EthernetTracker {
         mNetworkCapabilities.put(config.mIface, config.mCaps);
 
         if (null != config.mIpConfig) {
-            IpConfiguration ipConfig = parseStaticIpConfiguration(config.mIpConfig);
-            mIpConfigurations.put(config.mIface, ipConfig);
+            mIpConfigurations.put(config.mIface, config.mIpConfig);
         }
     }
 
@@ -799,62 +798,6 @@ public class EthernetTracker {
         return builder.build();
     }
 
-    /**
-     * Parses static IP configuration.
-     *
-     * @param staticIpConfig represents static IP configuration in the following format: {@code
-     * ip=<ip-address/mask> gateway=<ip-address> dns=<comma-sep-ip-addresses>
-     *     domains=<comma-sep-domains>}
-     */
-    @VisibleForTesting
-    static IpConfiguration parseStaticIpConfiguration(String staticIpConfig) {
-        final StaticIpConfiguration.Builder staticIpConfigBuilder =
-                new StaticIpConfiguration.Builder();
-
-        for (String keyValueAsString : staticIpConfig.trim().split(" ")) {
-            if (TextUtils.isEmpty(keyValueAsString)) continue;
-
-            String[] pair = keyValueAsString.split("=");
-            if (pair.length != 2) {
-                throw new IllegalArgumentException("Unexpected token: " + keyValueAsString
-                        + " in " + staticIpConfig);
-            }
-
-            String key = pair[0];
-            String value = pair[1];
-
-            switch (key) {
-                case "ip":
-                    staticIpConfigBuilder.setIpAddress(new LinkAddress(value));
-                    break;
-                case "domains":
-                    staticIpConfigBuilder.setDomains(value);
-                    break;
-                case "gateway":
-                    staticIpConfigBuilder.setGateway(InetAddress.parseNumericAddress(value));
-                    break;
-                case "dns": {
-                    ArrayList<InetAddress> dnsAddresses = new ArrayList<>();
-                    for (String address: value.split(",")) {
-                        dnsAddresses.add(InetAddress.parseNumericAddress(address));
-                    }
-                    staticIpConfigBuilder.setDnsServers(dnsAddresses);
-                    break;
-                }
-                default : {
-                    throw new IllegalArgumentException("Unexpected key: " + key
-                            + " in " + staticIpConfig);
-                }
-            }
-        }
-        return createIpConfiguration(staticIpConfigBuilder.build());
-    }
-
-    private static IpConfiguration createIpConfiguration(
-            @NonNull final StaticIpConfiguration staticIpConfig) {
-        return new IpConfiguration.Builder().setStaticIpConfiguration(staticIpConfig).build();
-    }
-
     private IpConfiguration getOrCreateIpConfiguration(String iface) {
         IpConfiguration ret = mIpConfigurations.get(iface);
         if (ret != null) return ret;
@@ -971,7 +914,7 @@ public class EthernetTracker {
     static class EthernetConfigParser {
         final String mIface;
         final NetworkCapabilities mCaps;
-        final String mIpConfig;
+        @Nullable final IpConfiguration mIpConfig;
 
         private static NetworkCapabilities parseCapabilities(@Nullable String capabilitiesString,
                 boolean isAtLeastB) {
@@ -1038,6 +981,54 @@ public class EthernetTracker {
             }
         }
 
+        @Nullable
+        private static IpConfiguration parseStaticIpConfiguration(String staticIpConfig) {
+            if (TextUtils.isEmpty(staticIpConfig)) return null;
+
+            final StaticIpConfiguration.Builder staticIpConfigBuilder =
+                    new StaticIpConfiguration.Builder();
+
+            for (String keyValueAsString : staticIpConfig.trim().split(" ")) {
+                if (TextUtils.isEmpty(keyValueAsString)) continue;
+
+                String[] pair = keyValueAsString.split("=");
+                if (pair.length != 2) {
+                    throw new IllegalArgumentException("Unexpected token: " + keyValueAsString
+                            + " in " + staticIpConfig);
+                }
+
+                String key = pair[0];
+                String value = pair[1];
+
+                switch (key) {
+                    case "ip":
+                        staticIpConfigBuilder.setIpAddress(new LinkAddress(value));
+                        break;
+                    case "domains":
+                        staticIpConfigBuilder.setDomains(value);
+                        break;
+                    case "gateway":
+                        staticIpConfigBuilder.setGateway(InetAddress.parseNumericAddress(value));
+                        break;
+                    case "dns": {
+                        ArrayList<InetAddress> dnsAddresses = new ArrayList<>();
+                        for (String address: value.split(",")) {
+                            dnsAddresses.add(InetAddress.parseNumericAddress(address));
+                        }
+                        staticIpConfigBuilder.setDnsServers(dnsAddresses);
+                        break;
+                    }
+                    default : {
+                        throw new IllegalArgumentException("Unexpected key: " + key
+                                + " in " + staticIpConfig);
+                    }
+                }
+            }
+            return new IpConfiguration.Builder()
+                    .setStaticIpConfiguration(staticIpConfigBuilder.build())
+                    .build();
+        }
+
         EthernetConfigParser(String configString, boolean isAtLeastB) {
             Objects.requireNonNull(configString, "EthernetConfigParser requires non-null config");
             final String[] tokens = configString.split(";", /* limit of tokens */ 4);
@@ -1049,7 +1040,7 @@ public class EthernetTracker {
             nc.addTransportType(transportType);
             mCaps = nc;
 
-            mIpConfig = tokens.length > 2 && !TextUtils.isEmpty(tokens[2]) ? tokens[2] : null;
+            mIpConfig = parseStaticIpConfiguration(tokens.length > 2 ? tokens[2] : null);
         }
     }
 }
diff --git a/tests/unit/java/com/android/server/ethernet/EthernetTrackerTest.java b/tests/unit/java/com/android/server/ethernet/EthernetTrackerTest.java
index 1a313feeeb..eac4c255f5 100644
--- a/tests/unit/java/com/android/server/ethernet/EthernetTrackerTest.java
+++ b/tests/unit/java/com/android/server/ethernet/EthernetTrackerTest.java
@@ -20,11 +20,9 @@ import static android.net.TestNetworkManager.TEST_TAP_PREFIX;
 
 import static com.google.common.truth.Truth.assertThat;
 
-import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertThrows;
 import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
 import static org.mockito.ArgumentMatchers.anyBoolean;
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.ArgumentMatchers.eq;
@@ -35,8 +33,6 @@ import android.content.Context;
 import android.net.INetd;
 import android.net.InetAddresses;
 import android.net.IpConfiguration;
-import android.net.IpConfiguration.IpAssignment;
-import android.net.IpConfiguration.ProxySettings;
 import android.net.LinkAddress;
 import android.net.NetworkCapabilities;
 import android.net.StaticIpConfiguration;
@@ -104,70 +100,70 @@ public class EthernetTrackerTest {
         HandlerUtils.waitForIdle(mHandlerThread, TIMEOUT_MS);
     }
 
-    /**
-     * Test: Creation of various valid static IP configurations
-     */
     @Test
-    public void createStaticIpConfiguration() {
-        // Empty gives default StaticIPConfiguration object
-        assertStaticConfiguration(new StaticIpConfiguration(), "");
+    public void testIpConfigurationParsing() {
+        EthernetConfigParser p = new EthernetConfigParser("eth0;*;;", true /*isAtLeastB*/);
+        assertThat(p.mIpConfig).isNull();
 
-        // Setting only the IP address properly cascades and assumes defaults
-        assertStaticConfiguration(new StaticIpConfiguration.Builder()
-                .setIpAddress(new LinkAddress("192.0.2.10/24")).build(), "ip=192.0.2.10/24");
-
-        final ArrayList<InetAddress> dnsAddresses = new ArrayList<>();
-        dnsAddresses.add(InetAddresses.parseNumericAddress("4.4.4.4"));
-        dnsAddresses.add(InetAddresses.parseNumericAddress("8.8.8.8"));
-        // Setting other fields properly cascades them
-        assertStaticConfiguration(new StaticIpConfiguration.Builder()
+        p = new EthernetConfigParser("eth0;*;ip=192.0.2.10/24", true /*isAtLeastB*/);
+        StaticIpConfiguration s = new StaticIpConfiguration.Builder()
                 .setIpAddress(new LinkAddress("192.0.2.10/24"))
-                .setDnsServers(dnsAddresses)
+                .build();
+        assertThat(p.mIpConfig)
+                .isEqualTo(new IpConfiguration.Builder().setStaticIpConfiguration(s).build());
+
+        p = new EthernetConfigParser(
+                "eth0;*;ip=192.0.2.10/24 dns=4.4.4.4,8.8.8.8   gateway=192.0.2.1  domains=android ",
+                true /*isAtLeastB*/);
+        ArrayList<InetAddress> dns = new ArrayList<>();
+        dns.add(InetAddresses.parseNumericAddress("4.4.4.4"));
+        dns.add(InetAddresses.parseNumericAddress("8.8.8.8"));
+        s = new StaticIpConfiguration.Builder()
+                .setIpAddress(new LinkAddress("192.0.2.10/24"))
+                .setDnsServers(dns)
                 .setGateway(InetAddresses.parseNumericAddress("192.0.2.1"))
-                .setDomains("android").build(),
-                "ip=192.0.2.10/24 dns=4.4.4.4,8.8.8.8 gateway=192.0.2.1 domains=android");
+                .setDomains("android")
+                .build();
+        assertThat(p.mIpConfig)
+                .isEqualTo(new IpConfiguration.Builder().setStaticIpConfiguration(s).build());
 
         // Verify order doesn't matter
-        assertStaticConfiguration(new StaticIpConfiguration.Builder()
-                .setIpAddress(new LinkAddress("192.0.2.10/24"))
-                .setDnsServers(dnsAddresses)
-                .setGateway(InetAddresses.parseNumericAddress("192.0.2.1"))
-                .setDomains("android").build(),
-                "domains=android ip=192.0.2.10/24 gateway=192.0.2.1 dns=4.4.4.4,8.8.8.8 ");
+        p = new EthernetConfigParser(
+                "eth0;; domains=android ip=192.0.2.10/24 gateway=192.0.2.1 dns=4.4.4.4,8.8.8.8   ;",
+                false /*isAtLeastB*/);
+        assertThat(p.mIpConfig)
+                .isEqualTo(new IpConfiguration.Builder().setStaticIpConfiguration(s).build());
     }
 
-    /**
-     * Test: Attempt creation of various bad static IP configurations
-     */
     @Test
-    public void createStaticIpConfiguration_Bad() {
-        assertStaticConfigurationFails("ip=192.0.2.1/24 gateway= blah=20.20.20.20");  // Unknown key
-        assertStaticConfigurationFails("ip=192.0.2.1");  // mask is missing
-        assertStaticConfigurationFails("ip=a.b.c");  // not a valid ip address
-        assertStaticConfigurationFails("dns=4.4.4.4,1.2.3.A");  // not valid ip address in dns
-        assertStaticConfigurationFails("=");  // Key and value is empty
-        assertStaticConfigurationFails("ip=");  // Value is empty
-        assertStaticConfigurationFails("ip=192.0.2.1/24 gateway=");  // Gateway is empty
-    }
+    public void testIpConfigurationParsing_withInvalidInputs() {
+        assertThrows(IllegalArgumentException.class, () -> { // unknown key
+            new EthernetConfigParser("eth0;;ip=192.0.2.1/24 blah=20.20.20.20", true /*isAtLeastB*/);
+        });
 
-    private void assertStaticConfigurationFails(String config) {
-        try {
-            EthernetTracker.parseStaticIpConfiguration(config);
-            fail("Expected to fail: " + config);
-        } catch (IllegalArgumentException e) {
-            // expected
-        }
-    }
+        assertThrows(IllegalArgumentException.class, () -> { // mask missing
+            new EthernetConfigParser("eth0;;ip=192.0.2.1", true /*isAtLeastB*/);
+        });
 
-    private void assertStaticConfiguration(StaticIpConfiguration expectedStaticIpConfig,
-                String configAsString) {
-        final IpConfiguration expectedIpConfiguration = new IpConfiguration();
-        expectedIpConfiguration.setIpAssignment(IpAssignment.STATIC);
-        expectedIpConfiguration.setProxySettings(ProxySettings.NONE);
-        expectedIpConfiguration.setStaticIpConfiguration(expectedStaticIpConfig);
+        assertThrows(IllegalArgumentException.class, () -> { // invalid ip address
+            new EthernetConfigParser("eth0;;ip=x.y.z", true /*isAtLeastB*/);
+        });
 
-        assertEquals(expectedIpConfiguration,
-                EthernetTracker.parseStaticIpConfiguration(configAsString));
+        assertThrows(IllegalArgumentException.class, () -> { // invalid dns ip
+            new EthernetConfigParser("eth0;;dns=4.4.4.4,1.2.3.A", true /*isAtLeastB*/);
+        });
+
+        assertThrows(IllegalArgumentException.class, () -> { // empty key / value
+            new EthernetConfigParser("eth0;;=", true /*isAtLeastB*/);
+        });
+
+        assertThrows(IllegalArgumentException.class, () -> { // empty value
+            new EthernetConfigParser("eth0;;ip=", true /*isAtLeastB*/);
+        });
+
+        assertThrows(IllegalArgumentException.class, () -> { // empty gateway
+            new EthernetConfigParser("eth0;;ip=192.0.2.1/24 gateway=", true /*isAtLeastB*/);
+        });
     }
 
     private NetworkCapabilities.Builder makeEthernetCapabilitiesBuilder(boolean clearDefaults) {
@@ -238,16 +234,6 @@ public class EthernetTrackerTest {
         assertThat(p.mIface).isEqualTo("eth0");
     }
 
-    @Test
-    public void testIpConfigParsing() {
-        // Note that EthernetConfigParser doesn't actually parse the IpConfig (yet).
-        final EthernetConfigParser p = new EthernetConfigParser(
-                "eth0;1,2,3;ip=192.168.0.10/24 gateway=192.168.0.1 dns=4.4.4.4,8.8.8.8;1",
-                false /*isAtLeastB*/);
-        assertThat(p.mIpConfig)
-                .isEqualTo("ip=192.168.0.10/24 gateway=192.168.0.1 dns=4.4.4.4,8.8.8.8");
-    }
-
     @Test
     public void testCreateEthernetConfigParserThrowsNpeWithNullInput() {
         assertThrows(NullPointerException.class, () -> new EthernetConfigParser(null, false));

From 074c4934cd65094dd9bb8d06ba6f05c54296fdf6 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Tue, 25 Mar 2025 11:54:24 -0700
Subject: [PATCH 010/377] Delete unused function

Test: TH
Change-Id: I1f81032ea14d87736e2c8890e9259f20aace4a0b
---
 .../android/server/ethernet/EthernetTrackerTest.java  | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/tests/unit/java/com/android/server/ethernet/EthernetTrackerTest.java b/tests/unit/java/com/android/server/ethernet/EthernetTrackerTest.java
index eac4c255f5..5d83f724ab 100644
--- a/tests/unit/java/com/android/server/ethernet/EthernetTrackerTest.java
+++ b/tests/unit/java/com/android/server/ethernet/EthernetTrackerTest.java
@@ -166,17 +166,6 @@ public class EthernetTrackerTest {
         });
     }
 
-    private NetworkCapabilities.Builder makeEthernetCapabilitiesBuilder(boolean clearDefaults) {
-        final NetworkCapabilities.Builder builder =
-                clearDefaults
-                        ? NetworkCapabilities.Builder.withoutDefaultCapabilities()
-                        : new NetworkCapabilities.Builder();
-        return builder.addCapability(NetworkCapabilities.NET_CAPABILITY_NOT_ROAMING)
-                .addCapability(NetworkCapabilities.NET_CAPABILITY_NOT_CONGESTED)
-                .addCapability(NetworkCapabilities.NET_CAPABILITY_NOT_SUSPENDED);
-    }
-
-
     @Test
     public void testNetworkCapabilityParsing() {
         final NetworkCapabilities baseNc = NetworkCapabilities.Builder.withoutDefaultCapabilities()

From 3ac88f375be442accc6ac6ab244715c60c1354ad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Tue, 25 Mar 2025 12:18:11 -0700
Subject: [PATCH 011/377] NetBpfLoad: allow 25Q3
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com
Change-Id: Iced07b6438b4702334aaf85d301987efefe153c6
---
 bpf/loader/NetBpfLoad.cpp | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/bpf/loader/NetBpfLoad.cpp b/bpf/loader/NetBpfLoad.cpp
index bdc2e8c609..74c37c4519 100644
--- a/bpf/loader/NetBpfLoad.cpp
+++ b/bpf/loader/NetBpfLoad.cpp
@@ -1832,7 +1832,9 @@ static int doLoad(char** argv, char * const envp[]) {
         int v = fscanf(f, "# %d %d %d %d %d #", &y, &q, &a, &b, &c);
         ALOGI("detected %d of 5: %dQ%d api:%d.%d.%d", v, y, q, a, b, c);
         fclose(f);
-        if (v != 5 || y != 2025 || q != 2 || a != 36 || b || c) return 1;
+        if (v != 5 || y != 2025 || a != 36 || b) return 1;
+        if (q < 2 || q > 3) return 1;
+        if (c < 0 || c > 1) return 1;
     }
 
     // Ensure we can determine the Android build type.

From aa33013ba5397977b92284b15013bae182679236 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Tue, 25 Mar 2025 13:56:55 -0700
Subject: [PATCH 012/377] clatd bpf: drop multicast
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

to avoid waking up clat daemon needlessly

(it just drops these anyway)

Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I8485f01635d5c6dd168d89279a3b390200f78c63
---
 bpf/progs/clatd.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/bpf/progs/clatd.c b/bpf/progs/clatd.c
index f4e4f3bb99..690a57236e 100644
--- a/bpf/progs/clatd.c
+++ b/bpf/progs/clatd.c
@@ -288,8 +288,8 @@ DEFINE_BPF_PROG("schedcls/egress4/clat_rawip", AID_ROOT, AID_SYSTEM, sched_cls_e
     // We cannot handle IP options, just standard 20 byte == 5 dword minimal IPv4 header
     if (ip4->ihl != 5) return TC_ACT_PIPE;
 
-    // Packet must not be multicast
-    if ((ip4->daddr & htonl(0xf0000000)) == htonl(0xe0000000)) return TC_ACT_PIPE;
+    // Packet must not be multicast, if it is just outright drop it.
+    if ((ip4->daddr & htonl(0xf0000000)) == htonl(0xe0000000)) return TC_ACT_SHOT;
 
     // Calculate the IPv4 one's complement checksum of the IPv4 header.
     __wsum sum4 = 0;

From d370f95f10fbd04bade48062198cbb2b98b91e4b Mon Sep 17 00:00:00 2001
From: Motomu Utsumi <motomuman@google.com>
Date: Tue, 25 Mar 2025 09:31:16 +0900
Subject: [PATCH 013/377] Add macro to declare a sk storage and related
 accessor functions

Test: boot
Bug: 406080305
Change-Id: I03238c72e8024d4424c06803784988570513ff39
---
 bpf/headers/include/bpf_helpers.h | 33 +++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/bpf/headers/include/bpf_helpers.h b/bpf/headers/include/bpf_helpers.h
index 199661de65..e0c524fdff 100644
--- a/bpf/headers/include/bpf_helpers.h
+++ b/bpf/headers/include/bpf_helpers.h
@@ -236,6 +236,11 @@ static void* (*bpf_ringbuf_reserve_unsafe)(const struct bpf_map_def* ringbuf,
         BPF_FUNC_ringbuf_reserve;
 static void (*bpf_ringbuf_submit_unsafe)(const void* data, __u64 flags) = (void*)
         BPF_FUNC_ringbuf_submit;
+static void* (*bpf_sk_storage_get_unsafe) (const struct bpf_map_def* sk_storage, const void* sk,
+                                           const void* value, unsigned long long flags) = (void*)
+        BPF_FUNC_sk_storage_get;
+static int (*bpf_sk_storage_delete_unsafe) (const struct bpf_map_def* sk_storage,
+                                            const void* sk) = (void*) BPF_FUNC_sk_storage_delete;
 
 #define BPF_ANNOTATE_KV_PAIR(name, type_key, type_val)  \
         struct ____btf_map_##name {                     \
@@ -330,6 +335,34 @@ static void (*bpf_ringbuf_submit_unsafe)(const void* data, __u64 flags) = (void*
                            PRIVATE, BPFLOADER_MIN_VER, BPFLOADER_MAX_VER,               \
                            LOAD_ON_ENG, LOAD_ON_USER, LOAD_ON_USERDEBUG)
 
+// Type safe macro to declare a sk storage and related accessor functions.
+// BPF_MAP_TYPE_SK_STORAGE was introduced in kernel 5.2 but this map requires BTF and
+// BTF is enabled on kernel 5.10 or higher.
+#define DEFINE_BPF_SK_STORAGE_EXT(the_map, ValueType, usr, grp, md, selinux, pindir,    \
+                                  share, min_loader, max_loader, ignore_eng,            \
+                                  ignore_user, ignore_userdebug, mapFlags)              \
+    DEFINE_BPF_MAP_BASE(the_map, SK_STORAGE, sizeof(uint32_t), sizeof(ValueType),       \
+                        0, usr, grp, md, selinux, pindir, share,                        \
+                        KVER_5_10, KVER_INF, min_loader, max_loader,                    \
+                        ignore_eng, ignore_user, ignore_userdebug, mapFlags);           \
+    BPF_ANNOTATE_KV_PAIR(the_map, uint32_t, ValueType);                                 \
+                                                                                        \
+    static inline __always_inline __unused ValueType* bpf_##the_map##_get(              \
+            const struct bpf_sock* sk, const ValueType* v, unsigned long long flags) {  \
+        return bpf_sk_storage_get_unsafe(&the_map, sk, v, flags);                       \
+    };                                                                                  \
+                                                                                        \
+    static inline __always_inline __unused int bpf_##the_map##_delete(                  \
+            const struct bpf_sock* sk) {                                                \
+        return bpf_sk_storage_delete_unsafe(&the_map, sk);                              \
+    };
+
+#define DEFINE_BPF_SK_STORAGE(the_map, TypeOfValue)                                      \
+    DEFINE_BPF_SK_STORAGE_EXT(the_map, TypeOfValue,                                      \
+                              AID_ROOT, AID_NET_BW_ACCT, 0060, "fs_bpf_net_shared", "",  \
+                              PRIVATE, BPFLOADER_MIN_VER, BPFLOADER_MAX_VER,             \
+                              LOAD_ON_ENG, LOAD_ON_USER, LOAD_ON_USERDEBUG, 0)
+
 /* There exist buggy kernels with pre-T OS, that due to
  * kernel patch "[ALPS05162612] bpf: fix ubsan error"
  * do not support userspace writes into non-zero index of bpf map arrays.

From 70793af736c76ce118b09b9379af28c3b4efc513 Mon Sep 17 00:00:00 2001
From: Motomu Utsumi <motomuman@google.com>
Date: Tue, 25 Mar 2025 09:33:41 +0900
Subject: [PATCH 014/377] Declare map with BPF_MAP_TYPE_SK_STORAGE

Test: adb logcat | grep sk_storage on 4.19 and 5.10 kernel
Bug: 406080305
Change-Id: I6400882146e8fd686a4260c5bf586a8f73032c71
---
 bpf/progs/netd.c | 2 ++
 bpf/progs/netd.h | 5 +++++
 2 files changed, 7 insertions(+)

diff --git a/bpf/progs/netd.c b/bpf/progs/netd.c
index b146e4539e..49c93daa6c 100644
--- a/bpf/progs/netd.c
+++ b/bpf/progs/netd.c
@@ -81,6 +81,8 @@ DEFINE_BPF_MAP_NO_NETD(ingress_discard_map, HASH, IngressDiscardKey, IngressDisc
 DEFINE_BPF_MAP_RW_NETD(lock_array_test_map, ARRAY, uint32_t, bool, 1)
 DEFINE_BPF_MAP_RW_NETD(lock_hash_test_map, HASH, uint32_t, bool, 1)
 
+DEFINE_BPF_SK_STORAGE(sk_storage, SkStorageValue)
+
 /* never actually used from ebpf */
 DEFINE_BPF_MAP_NO_NETD(iface_index_name_map, HASH, uint32_t, IfaceValue, IFACE_INDEX_NAME_MAP_SIZE)
 
diff --git a/bpf/progs/netd.h b/bpf/progs/netd.h
index 8400679a2a..aa5f9cc9bf 100644
--- a/bpf/progs/netd.h
+++ b/bpf/progs/netd.h
@@ -90,6 +90,11 @@ typedef struct {
 } PacketTrace;
 STRUCT_SIZE(PacketTrace, 8+4+4 + 4+4 + 2+2 + 1+1+1+1);
 
+typedef struct {
+    uint64_t cookie;
+} SkStorageValue;
+STRUCT_SIZE(SkStorageValue, 8);
+
 // Since we cannot garbage collect the stats map since device boot, we need to make these maps as
 // large as possible. The maximum size of number of map entries we can have is depend on the rlimit
 // of MEM_LOCK granted to netd. The memory space needed by each map can be calculated by the

From 8fab64955bdf33ea15d1c349180d96045e313b4d Mon Sep 17 00:00:00 2001
From: Motomu Utsumi <motomuman@google.com>
Date: Tue, 25 Mar 2025 10:47:42 +0900
Subject: [PATCH 015/377] Store socket cookie to sk storage in inet_create hook
 on 5.10+ kernel

Test: adb logcat | grep inet_create on 4.19 and 5.10 kernel
Bug: 406080305
Change-Id: Ia6685d8827ea1570b950aff63bcae242e28ba637
---
 bpf/progs/netd.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/bpf/progs/netd.c b/bpf/progs/netd.c
index 49c93daa6c..60c5a1c2ea 100644
--- a/bpf/progs/netd.c
+++ b/bpf/progs/netd.c
@@ -772,11 +772,26 @@ static __always_inline inline uint8_t get_app_permissions() {
     return permissions ? *permissions : BPF_PERMISSION_INTERNET;
 }
 
-DEFINE_NETD_BPF_PROG_KVER("cgroupsock/inet_create", inet_socket_create, KVER_4_14)
-(__unused struct bpf_sock* sk) {
+static __always_inline inline int inet_socket_create(struct bpf_sock* sk,
+                                                     const struct kver_uint kver) {
+    if (KVER_IS_AT_LEAST(kver, 5, 10, 0)) {
+        SkStorageValue *v = bpf_sk_storage_get(sk, 0, BPF_SK_STORAGE_GET_F_CREATE);
+        if (v) v->cookie = bpf_get_sk_cookie(sk);
+    }
     return (get_app_permissions() & BPF_PERMISSION_INTERNET) ? BPF_ALLOW : BPF_DISALLOW;
 }
 
+DEFINE_NETD_BPF_PROG_KVER("cgroupsock/inet_create$5_10", inet_socket_create_5_10, KVER_5_10)
+(struct bpf_sock* sk) {
+    return inet_socket_create(sk, KVER_5_10);
+}
+
+DEFINE_NETD_BPF_PROG_KVER_RANGE("cgroupsock/inet_create$4_14",
+                                inet_socket_create_4_14, KVER_4_14, KVER_5_10)
+(struct bpf_sock* sk) {
+    return inet_socket_create(sk, KVER_4_14);
+}
+
 DEFINE_NETD_BPF_PROG_KVER("cgroupsockrelease/inet_release", inet_socket_release, KVER_5_10)
 (struct bpf_sock* sk) {
     uint64_t cookie = bpf_get_sk_cookie(sk);

From 627b8c6d343e2a38869cdbff9c1d09a15716b47a Mon Sep 17 00:00:00 2001
From: Motomu Utsumi <motomuman@google.com>
Date: Thu, 20 Feb 2025 16:54:12 +0900
Subject: [PATCH 016/377] Add hidden API to register/unregister QUIC connection
 close payload

QUIC stack running on the app process will call this API and register
QUIC UDP socket and UDP payload that can close QUIC connection.

When the app loses network access (e.g. due to freezer or firewall
chain), ConnectivityService 1)destroys the registered UDP socket by
sending a SOCK_DESTROY netlink message and 2)sends the registered UDP
payload to the server. This prevents unnecessary modem wakeups caused
by packets from the server after the apps lose network access.

Additionally, to close QUIC connection for apps that crash or are
killed, ConnectivityService sends the registered UDP payload when it
receives a socket destroy diag message for the registered socket.

Bug: 311792075
Test: CSDestroySocketTest CtsNetTestCases
Change-Id: I6cd727bd8bb0fe1d17360edfa395f73d24da6920
---
 .../src/android/net/ConnectivityManager.java  |  64 +++
 .../src/android/net/IConnectivityManager.aidl |   3 +
 .../android/server/ConnectivityService.java   |  60 +++
 .../connectivity/ConnectivityFlags.java       |   2 +
 .../connectivity/QuicConnectionCloser.java    | 406 ++++++++++++++++++
 .../net/cts/ConnectivityManagerTest.java      | 328 +++++++++++++-
 .../server/ConnectivityServiceTest.java       |   1 +
 .../connectivity/QuicConnectionCloserTest.kt  | 232 ++++++++++
 .../CSDestroySocketTest.kt                    |  11 +-
 .../server/connectivityservice/base/CSTest.kt |  10 +
 10 files changed, 1110 insertions(+), 7 deletions(-)
 create mode 100644 service/src/com/android/server/connectivity/QuicConnectionCloser.java
 create mode 100644 tests/unit/java/com/android/server/connectivity/QuicConnectionCloserTest.kt

diff --git a/framework/src/android/net/ConnectivityManager.java b/framework/src/android/net/ConnectivityManager.java
index f8a1293a34..3a7d070670 100644
--- a/framework/src/android/net/ConnectivityManager.java
+++ b/framework/src/android/net/ConnectivityManager.java
@@ -6856,4 +6856,68 @@ public class ConnectivityManager {
             throw e.rethrowFromSystemServer();
         }
     }
+
+    /**
+     * Register QUIC UDP socket and UDP payload that can close QUIC connection.
+     *
+     * When the app loses network access (e.g. due to freezer or firewall chain),
+     * ConnectivityService 1)destroys the registered UDP socket by sending a SOCK_DESTROY netlink
+     * message and 2)sends the registered UDP payload to the server.
+     * This prevents unnecessary modem wakeups caused by packets from the server after the apps
+     * lose network access.
+     *
+     * Additionally, to close QUIC connection for apps that crash or are killed, ConnectivityService
+     * sends the registered UDP payload when it receives a socket destroy diag message for the
+     * registered socket.
+     *
+     * If apps call this method, they must call {@link #unregisterQuicConnectionClosePayload} before
+     * they close the QUIC connection and the socket.
+     * Otherwise, the registered UDP payload will be sent to the server, even if the QUIC connection
+     * was already properly closed. This is because ConnectivityService cannot distinguish whether
+     * the socket was closed due to the app being killed or because the app forgets to call
+     * {@link #unregisterQuicConnectionClosePayload}.
+     *
+     * The registered payload will be sent using the source and destination addresses and ports of
+     * the connected UDP socket provided. So, the app must not reuse the same socket to reconnect
+     * to a different server, even if first calls unregisterQuicConnectionClosePayload. This is
+     * because this method operates asynchronously.
+     *
+     * If the number of registered socket and payload hits the limit, ConnectivityService silently
+     * ignores new registration. ConnectivityService cannot know about this synchronously, but the
+     * caller couldn't really do anything with this information anyway.
+     * TODO: Consider adding a result listener if this API becomes public.
+     *
+     * @param pfd The {@link ParcelFileDescriptor} for the connected UDP socket.
+     *            The registered payload will be sent using the source and destination addresses and
+     *            ports of this connected UDP socket.
+     * @param payload The UDP payload that can close QUIC connection.
+     *
+     * @hide
+     */
+    public void registerQuicConnectionClosePayload(final ParcelFileDescriptor pfd,
+            final byte[] payload) {
+        try {
+            mService.registerQuicConnectionClosePayload(pfd, payload);
+        } catch (RemoteException e) {
+            throw e.rethrowFromSystemServer();
+        }
+    }
+
+    /**
+     * Unregister the QUIC socket previously registered by
+     * {@link #registerQuicConnectionClosePayload}
+     *
+     * This method is a no-op if the provided UDP socket is not registered.
+     *
+     * @param pfd The {@link ParcelFileDescriptor} for the UDP socket.
+     *
+     * @hide
+     */
+    public void unregisterQuicConnectionClosePayload(final ParcelFileDescriptor pfd) {
+        try {
+            mService.unregisterQuicConnectionClosePayload(pfd);
+        } catch (RemoteException e) {
+            throw e.rethrowFromSystemServer();
+        }
+    }
 }
diff --git a/framework/src/android/net/IConnectivityManager.aidl b/framework/src/android/net/IConnectivityManager.aidl
index a270684c40..0146e729a7 100644
--- a/framework/src/android/net/IConnectivityManager.aidl
+++ b/framework/src/android/net/IConnectivityManager.aidl
@@ -266,4 +266,7 @@ interface IConnectivityManager
     long getEnabledConnectivityManagerFeatures();
 
     boolean isConnectivityServiceFeatureEnabledForTesting(String featureFlag);
+
+    oneway void registerQuicConnectionClosePayload(in ParcelFileDescriptor pfd, in byte[] payload);
+    oneway void unregisterQuicConnectionClosePayload(in ParcelFileDescriptor pfd);
 }
diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index 45b431f1e7..7f317930a4 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -156,6 +156,7 @@ import static com.android.net.module.util.PermissionUtils.enforceNetworkStackPer
 import static com.android.net.module.util.PermissionUtils.hasAnyPermissionOf;
 import static com.android.server.ConnectivityStatsLog.CONNECTIVITY_STATE_SAMPLE;
 import static com.android.server.connectivity.ConnectivityFlags.CELLULAR_DATA_INACTIVITY_TIMEOUT;
+import static com.android.server.connectivity.ConnectivityFlags.CLOSE_QUIC_CONNECTION;
 import static com.android.server.connectivity.ConnectivityFlags.DELAY_DESTROY_SOCKETS;
 import static com.android.server.connectivity.ConnectivityFlags.INGRESS_TO_VPN_ADDRESS_FILTERING;
 import static com.android.server.connectivity.ConnectivityFlags.NAMESPACE_TETHERING_BOOT;
@@ -389,6 +390,7 @@ import com.android.server.connectivity.PermissionMonitor;
 import com.android.server.connectivity.ProfileNetworkPreferenceInfo;
 import com.android.server.connectivity.ProxyTracker;
 import com.android.server.connectivity.QosCallbackTracker;
+import com.android.server.connectivity.QuicConnectionCloser;
 import com.android.server.connectivity.SatelliteAccessController;
 import com.android.server.connectivity.UidRangeUtils;
 import com.android.server.connectivity.VpnNetworkPreferenceInfo;
@@ -1104,6 +1106,13 @@ public class ConnectivityService extends IConnectivityManager.Stub {
     // Flag to drop packets to VPN addresses ingressing via non-VPN interfaces.
     private final boolean mIngressToVpnAddressFiltering;
 
+    // Flag to close QUIC connection for registered sockets when apps lose network access.
+    private final boolean mCloseQuicConnection;
+
+    // This is null if mCloseQuicConnection is false
+    @Nullable
+    private final QuicConnectionCloser mQuicConnectionCloser;
+
     /**
      * Implements support for the legacy "one network per network type" model.
      *
@@ -1825,6 +1834,14 @@ public class ConnectivityService extends IConnectivityManager.Stub {
             handler.sendMessageDelayed(
                     handler.obtainMessage(EVENT_INITIAL_EVALUATION_TIMEOUT, network), delayMs);
         }
+
+        /**
+         * Create {@link QuicConnectionCloser}.
+         */
+        public QuicConnectionCloser makeQuicConnectionCloser(
+                final SparseArray<NetworkAgentInfo> networkForNetId, final Handler handler) {
+            return new QuicConnectionCloser(networkForNetId, handler);
+        }
     }
 
     public ConnectivityService(Context context) {
@@ -2133,6 +2150,13 @@ public class ConnectivityService extends IConnectivityManager.Stub {
                 && mDeps.isFeatureNotChickenedOut(mContext, INGRESS_TO_VPN_ADDRESS_FILTERING);
 
         mL2capNetworkProvider = mDeps.makeL2capNetworkProvider(mContext);
+
+        mCloseQuicConnection = mDeps.isFeatureEnabled(context, CLOSE_QUIC_CONNECTION);
+        if (mCloseQuicConnection) {
+            mQuicConnectionCloser = mDeps.makeQuicConnectionCloser(mNetworkForNetId, mHandler);
+        } else {
+            mQuicConnectionCloser = null;
+        }
     }
 
     /**
@@ -3687,6 +3711,11 @@ public class ConnectivityService extends IConnectivityManager.Stub {
         } catch (SocketException | InterruptedIOException | ErrnoException e) {
             loge("Failed to destroy sockets: " + e);
         }
+
+        if (mCloseQuicConnection) {
+            mQuicConnectionCloser.closeQuicConnectionByUids(uids);
+        }
+
         mDestroySocketPendingUids.clear();
     }
 
@@ -4516,6 +4545,12 @@ public class ConnectivityService extends IConnectivityManager.Stub {
         mNetworkActivityTracker.dump(pw);
         pw.decreaseIndent();
 
+        pw.println();
+        pw.println("Close QUIC connection: " + mCloseQuicConnection);
+        if (mCloseQuicConnection) {
+            mQuicConnectionCloser.dump(pw);
+        }
+
         pw.println();
         pw.println("Multicast routing supported: " +
                 (mMulticastRoutingCoordinatorService != null));
@@ -15125,8 +15160,33 @@ public class ConnectivityService extends IConnectivityManager.Stub {
                 return mIngressToVpnAddressFiltering;
             case QUEUE_NETWORK_AGENT_EVENTS_IN_SYSTEM_SERVER:
                 return mQueueNetworkAgentEventsInSystemServer;
+            case CLOSE_QUIC_CONNECTION:
+                return mCloseQuicConnection;
             default:
                 throw new IllegalArgumentException("Unknown flag: " + featureFlag);
         }
     }
+
+    @Override
+    public void registerQuicConnectionClosePayload(final ParcelFileDescriptor pfd,
+            final byte[] payload) {
+        if (!mCloseQuicConnection) {
+            IoUtils.closeQuietly(pfd);
+            return;
+        }
+        // pfd is closed by registerQuicConnectionClosePayload
+        mQuicConnectionCloser.registerQuicConnectionClosePayload(mDeps.getCallingUid(),
+                pfd, payload);
+    }
+
+    @Override
+    public void unregisterQuicConnectionClosePayload(final ParcelFileDescriptor pfd) {
+        if (!mCloseQuicConnection) {
+            IoUtils.closeQuietly(pfd);
+            return;
+        }
+        // pfd is closed by unregisterQuicConnectionClosePayload
+        mQuicConnectionCloser.unregisterQuicConnectionClosePayload(pfd);
+    }
+
 }
diff --git a/service/src/com/android/server/connectivity/ConnectivityFlags.java b/service/src/com/android/server/connectivity/ConnectivityFlags.java
index 74bd2351ac..fd24951049 100644
--- a/service/src/com/android/server/connectivity/ConnectivityFlags.java
+++ b/service/src/com/android/server/connectivity/ConnectivityFlags.java
@@ -65,6 +65,8 @@ public final class ConnectivityFlags {
     public static final String QUEUE_NETWORK_AGENT_EVENTS_IN_SYSTEM_SERVER =
             "queue_network_agent_events_in_system_server";
 
+    public static final String CLOSE_QUIC_CONNECTION = "close_quic_connection";
+
     private boolean mNoRematchAllRequestsOnRegister;
 
     /**
diff --git a/service/src/com/android/server/connectivity/QuicConnectionCloser.java b/service/src/com/android/server/connectivity/QuicConnectionCloser.java
new file mode 100644
index 0000000000..ce5d61c92b
--- /dev/null
+++ b/service/src/com/android/server/connectivity/QuicConnectionCloser.java
@@ -0,0 +1,406 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.server.connectivity;
+
+import static android.system.OsConstants.ENOENT;
+import static android.system.OsConstants.SOL_SOCKET;
+import static android.system.OsConstants.SO_SNDTIMEO;
+
+import android.annotation.NonNull;
+import android.net.Network;
+import android.net.NetworkUtils;
+import android.os.Handler;
+import android.os.ParcelFileDescriptor;
+import android.system.ErrnoException;
+import android.system.Os;
+import android.system.StructTimeval;
+import android.util.ArrayMap;
+import android.util.IndentingPrintWriter;
+import android.util.Log;
+import android.util.SparseArray;
+
+import com.android.internal.annotations.GuardedBy;
+import com.android.internal.annotations.VisibleForTesting;
+import com.android.net.module.util.HandlerUtils;
+import com.android.net.module.util.SharedLog;
+import com.android.net.module.util.SkDestroyListener;
+import com.android.net.module.util.netlink.InetDiagMessage;
+
+import libcore.io.IoUtils;
+
+import java.io.FileDescriptor;
+import java.io.IOException;
+import java.io.InterruptedIOException;
+import java.net.DatagramSocket;
+import java.net.InetSocketAddress;
+import java.net.SocketException;
+import java.util.Iterator;
+import java.util.Map;
+import java.util.Set;
+import java.util.function.Consumer;
+
+public class QuicConnectionCloser {
+    private static final String TAG = QuicConnectionCloser.class.getSimpleName();
+
+    private static final int SOCKET_WRITE_TIMEOUT_MS = 100;
+
+    // Map from socket cookie to QUIC connection close information
+    private final Map<Long, QuicConnectionCloseInfo>
+            mRegisteredQuicConnectionCloseInfos = new ArrayMap<>();
+
+    // The maximum number of QUIC connection close information entries that can be registered
+    // concurrently.
+    private static final int MAX_REGISTERED_QUIC_CONNECTION_CLOSE_INFO = 1000;
+
+    private final Handler mHandler;
+
+    // Reference to ConnectivityService#mNetworkForNetId, must be synchronized on itself.
+    // mHandler in this class is associated with the ConnectivityService handler thread.
+    // The only code that can update mNetworkForNetId runs on that thread, so no entries can be
+    // updated while the code in this class is running on mHandler thread.
+    @GuardedBy("mNetworkForNetId")
+    private final SparseArray<NetworkAgentInfo> mNetworkForNetId;
+
+    @NonNull
+    private final Dependencies mDeps;
+
+    /**
+     * Class to store the necessary information for closing a QUIC connection.
+     */
+    private static class QuicConnectionCloseInfo {
+        public final int uid;
+        public final int netId;
+        public final long cookie;
+        public final InetSocketAddress src;
+        public final InetSocketAddress dst;
+        public final byte[] payload;
+
+        QuicConnectionCloseInfo(int uid, int netId, long cookie, InetSocketAddress src,
+                InetSocketAddress dst, byte[] payload) {
+            this.uid = uid;
+            this.netId = netId;
+            this.cookie = cookie;
+            this.src = src;
+            this.dst = dst;
+            this.payload = payload;
+        }
+
+        @Override
+        public String toString() {
+            return "QuicConnectionCloseInfo{"
+                    + "uid: " + uid
+                    + ", netId: " + netId
+                    + ", cookie: " + cookie
+                    + ", src: " + src
+                    + ", dst: " + dst
+                    + ", payload length: " + payload.length
+                    + "}";
+        }
+    }
+
+    public static class Dependencies {
+        /**
+         * Send a UDP packet with the specified source and destination address and port over the
+         * specified network.
+         *
+         * @param network The {@link Network} over which the UDP packet will be sent.
+         * @param src     The source {@link InetSocketAddress} of the UDP packet to be sent.
+         * @param dst     The destination {@link InetSocketAddress} of the UDP packet to be sent.
+         * @param payload The UDP payload to be sent.
+         */
+        public void sendQuicConnectionClosePayload(final Network network,
+                final InetSocketAddress src, final InetSocketAddress dst, final byte[] payload)
+                throws IOException, ErrnoException {
+            final DatagramSocket socket = new DatagramSocket(src);
+            network.bindSocket(socket);
+            socket.connect(dst);
+            Os.setsockoptTimeval(socket.getFileDescriptor$(), SOL_SOCKET, SO_SNDTIMEO,
+                    StructTimeval.fromMillis(SOCKET_WRITE_TIMEOUT_MS));
+            Os.write(socket.getFileDescriptor$(), payload, 0 /* byteOffset */, payload.length);
+        }
+
+        /**
+         * Call {@link InetDiagMessage#destroyUdpSocket}
+         */
+        public void destroyUdpSocket(final InetSocketAddress src, final InetSocketAddress dst,
+                final long cookie)
+                throws SocketException, InterruptedIOException, ErrnoException {
+            InetDiagMessage.destroyUdpSocket(src, dst, 0 /* ifindex */, cookie);
+        }
+
+        /**
+         * Call {@link SkDestroyListener#makeSkDestroyListener}
+         */
+        public SkDestroyListener makeSkDestroyListener(final Consumer<InetDiagMessage> consumer,
+                final Handler handler) {
+            return SkDestroyListener.makeSkDestroyListener(consumer, false /* monitorTcpSocket */,
+                    true /* monitorUdpSocket */, handler, new SharedLog(TAG));
+        }
+
+        /**
+         * Call {@link NetworkUtils#getSocketCookie}
+         */
+        public long getSocketCookie(final FileDescriptor fd) throws ErrnoException {
+            return NetworkUtils.getSocketCookie(fd);
+        }
+
+        /**
+         * Call {@link Os#getsockoptInt}
+         */
+        public int getsockoptInt(final FileDescriptor fd, final int level, final int option)
+                throws ErrnoException {
+            return Os.getsockoptInt(fd, level, option);
+        }
+
+        /**
+         * Call {@link Os#getsockname}}
+         */
+        public InetSocketAddress getsockname(final FileDescriptor fd) throws ErrnoException {
+            return (InetSocketAddress) Os.getsockname(fd);
+        }
+
+        /**
+         * Call {@link Os#getpeername}
+         */
+        public InetSocketAddress getpeername(final FileDescriptor fd) throws ErrnoException {
+            return (InetSocketAddress) Os.getpeername(fd);
+        }
+    }
+
+    public QuicConnectionCloser(final SparseArray<NetworkAgentInfo> networkForNetId,
+            final Handler handler) {
+        this(networkForNetId, handler, new Dependencies());
+    }
+
+    @VisibleForTesting
+    public QuicConnectionCloser(final SparseArray<NetworkAgentInfo> networkForNetId,
+            final Handler handler, final Dependencies deps) {
+        mNetworkForNetId = networkForNetId;
+        mHandler = handler;
+        mDeps = deps;
+
+        // handleUdpSocketDestroy must be posted to the thread to avoid racing with
+        // handleUnregisterQuicConnectionCloseInfo, even though they both run on the same thread.
+        // Specifically, the following can happen:
+        // unregisterQuicConnectionClosePayload posts handleUnregisterQuicConnectionCloseInfo to
+        // the handler and then closes the fd.
+        // The close() will cause the kernel to enqueue a netlink message to the SkDestroyHandler's
+        // fd.
+        // It's possible that the MessageQueue of the handler sees both the SkDestroyHandler's fd
+        // and the MessageQueue fd go active at the same time, and chooses to run the netlink
+        // event first.
+        // As a result, handleUdpSocketDestroy runs before handleUnregisterQuicConnectionCloseInfo,
+        // and the code incorrectly sends a close packet for a socket that the app has already
+        // unregistered.
+        // Posting handleUdpSocketDestroy to the handler ensures that it always runs after
+        // handleUnregisterQuicConnectionCloseInfo. It doesn't matter if the
+        // handleUdpSocketDestroy is delayed, because it will only send a packet if
+        // mRegisteredQuicConnectionCloseInfos contains the socket cookie, and socket cookies are
+        // never reused.
+        final SkDestroyListener udpSkDestroyListener = mDeps.makeSkDestroyListener(
+                (inetDiagMessage) -> handler.post(() -> handleUdpSocketDestroy(inetDiagMessage)),
+                handler);
+        handler.post(udpSkDestroyListener::start);
+    }
+
+    private void ensureRunningOnHandlerThread() {
+        HandlerUtils.ensureRunningOnHandlerThread(mHandler);
+    }
+
+    /**
+     * Close registered QUIC connection by uids
+     *
+     * @param uids target uids to close QUIC connections
+     */
+    public void closeQuicConnectionByUids(final Set<Integer> uids) {
+        ensureRunningOnHandlerThread();
+
+        for (Iterator<Map.Entry<Long, QuicConnectionCloseInfo>> it =
+                mRegisteredQuicConnectionCloseInfos.entrySet().iterator(); it.hasNext();) {
+            final QuicConnectionCloseInfo info = it.next().getValue();
+            if (uids.contains(info.uid)) {
+                closeQuicConnection(info, true /* destroySocket */);
+                it.remove();
+            }
+        }
+    }
+
+    private NetworkAgentInfo getNetworkAgentInfoForNetId(int netId) {
+        synchronized (mNetworkForNetId) {
+            return mNetworkForNetId.get(netId);
+        }
+    }
+
+    private void closeQuicConnection(final QuicConnectionCloseInfo info,
+            final boolean destroySocket) {
+        ensureRunningOnHandlerThread();
+
+        Log.d(TAG, "Close QUIC socket for " + info + ", destroySocket=" + destroySocket);
+        final NetworkAgentInfo nai = getNetworkAgentInfoForNetId(info.netId);
+        if (nai == null || !nai.linkProperties.getAddresses().contains(info.src.getAddress())) {
+            // The device should not send a packet with an unused source address.
+            return;
+        }
+
+        if (destroySocket) {
+            try {
+                mDeps.destroyUdpSocket(info.src, info.dst, info.cookie);
+            } catch (ErrnoException | SocketException | InterruptedIOException e) {
+                if (e instanceof ErrnoException && ((ErrnoException) e).errno == ENOENT) {
+                    // This can happen if the socket is already closed, but unregister message is
+                    // not processed yet.
+                    return;
+                }
+                Log.e(TAG, "Failed to destroy QUIC socket for " + info + ": " + e);
+                return;
+            }
+        }
+
+        try {
+            mDeps.sendQuicConnectionClosePayload(nai.network(), info.src, info.dst, info.payload);
+        } catch (ErrnoException | IOException e) {
+            Log.e(TAG, "Failed to send registered QUIC connection close payload for "
+                    + info + ": " + e);
+        }
+    }
+
+    /**
+     * Close QUIC connection if the registered socket was destroyed
+     *
+     * @param inetDiagMessage {@link InetDiagMessage} received from kernel
+     */
+    private void handleUdpSocketDestroy(final InetDiagMessage inetDiagMessage) {
+        ensureRunningOnHandlerThread();
+
+        final long cookie = inetDiagMessage.inetDiagMsg.id.cookie;
+        final QuicConnectionCloseInfo info = mRegisteredQuicConnectionCloseInfos.remove(cookie);
+        if (info == null) {
+            // Destroyed socket is not registered or already unregistered.
+            return;
+        }
+
+        // App registered a QUIC connection close payload and this socket, but the socket was
+        // closed before the socket was unregistered.
+        // This can happen if the app crashes or is killed.
+        closeQuicConnection(info, false /* destroySocket */);
+    }
+
+    /**
+     * Register the QUIC connection close information
+     *
+     * @param info {@link QuicConnectionCloseInfo} to register
+     */
+    private void handleRegisterQuicConnectionCloseInfo(final QuicConnectionCloseInfo info) {
+        ensureRunningOnHandlerThread();
+
+        if (mRegisteredQuicConnectionCloseInfos.size()
+                >= MAX_REGISTERED_QUIC_CONNECTION_CLOSE_INFO) {
+            Log.e(TAG, "Failed to register QUIC connection close information."
+                    + " number of registered information exceeded "
+                    + MAX_REGISTERED_QUIC_CONNECTION_CLOSE_INFO);
+            return;
+        }
+        mRegisteredQuicConnectionCloseInfos.put(info.cookie, info);
+    }
+
+    // TODO: Use OsConstants.SO_MARK once this API is available
+    private static final int SO_MARK = 36;
+
+    /**
+     * Register QUIC socket and connection close payload
+     *
+     * @param uid The uid of the socket owner
+     * @param pfd The {@link ParcelFileDescriptor} for the connected UDP socket.
+     * @param payload The UDP payload that can close QUIC connection.
+     */
+    public void registerQuicConnectionClosePayload(final int uid, final ParcelFileDescriptor pfd,
+            final byte[] payload) {
+        try {
+            final FileDescriptor fd = pfd.getFileDescriptor();
+            // See FWMARK_NET_ID_MASK in Fwmark.h
+            final int netId = mDeps.getsockoptInt(fd, SOL_SOCKET, SO_MARK) & 0xffff;
+            // The peer name could change if the socket is reconnected to a different server.
+            // But, it is the caller's responsibility to avoid this, as explicitly stated in the
+            // Javadoc of ConnectivityManager#registerQuicConnectionClosePayload.
+            final QuicConnectionCloseInfo info = new QuicConnectionCloseInfo(
+                    uid,
+                    netId,
+                    mDeps.getSocketCookie(fd),
+                    mDeps.getsockname(fd),
+                    mDeps.getpeername(fd),
+                    payload);
+            mHandler.post(() -> handleRegisterQuicConnectionCloseInfo(info));
+        } catch (ErrnoException e) {
+            Log.e(TAG, "Failed to register QUIC connection close information", e);
+        } finally {
+            // |pfd| must remain open until the message is posted to the handler thread, because
+            // doing so ensures that the socket is not closed even if the app calls close().
+            // Keeping it open avoids the following threading issue with SkDestroyListener :
+            // If the PFD was closed before posting the message, then SkDestroyListener might
+            // get a "socket destroyed" message from Netlink immediately and post to the handler
+            // thread before this method posts its own message, resulting in a leak of the
+            // mRegisteredQuicConnectionCloseInfo entry.
+            // While the PFD is held, Netlink will not send the socket destroy message to
+            // SkDestroyListener, and thus the message posted by SkDestroyListener as
+            // a reaction to it will be processed after the message posted by this method.
+            IoUtils.closeQuietly(pfd);
+        }
+    }
+
+    /**
+     * Unregister the QUIC connection close information
+     *
+     * @param cookie cookie of the socket whose connection close information should be unregistered
+     */
+    private void handleUnregisterQuicConnectionCloseInfo(final long cookie) {
+        ensureRunningOnHandlerThread();
+
+        mRegisteredQuicConnectionCloseInfos.remove(cookie);
+    }
+
+    /**
+     * Unregister the QUIC socket
+     *
+     * @param pfd The {@link ParcelFileDescriptor} for the UDP socket.
+     */
+    public void unregisterQuicConnectionClosePayload(final ParcelFileDescriptor pfd) {
+        try {
+            final long cookie = mDeps.getSocketCookie(pfd.getFileDescriptor());
+            mHandler.post(() -> handleUnregisterQuicConnectionCloseInfo(cookie));
+        } catch (ErrnoException e) {
+            Log.e(TAG, "Failed to unregister QUIC connection close information: " + e);
+        } finally {
+            // |pfd| must be closed after posting the message to the handler thread to avoid the
+            // threading issue with SkDestroyListener.
+            // See the comment in registerQuicConnectionClosePayload.
+            IoUtils.closeQuietly(pfd);
+        }
+    }
+
+    /**
+     * Dump QUIC connection closer information
+     */
+    public void dump(final IndentingPrintWriter pw) {
+        pw.println("Registered QUIC connection close information: "
+                + mRegisteredQuicConnectionCloseInfos.size());
+        pw.increaseIndent();
+        for (QuicConnectionCloseInfo info: mRegisteredQuicConnectionCloseInfos.values()) {
+            pw.println(info);
+        }
+        pw.decreaseIndent();
+    }
+}
diff --git a/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java b/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
index 87c2b9e5d1..e20e457b01 100644
--- a/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
+++ b/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
@@ -21,6 +21,7 @@ import static android.Manifest.permission.ACCESS_FINE_LOCATION;
 import static android.Manifest.permission.ACCESS_NETWORK_STATE;
 import static android.Manifest.permission.CONNECTIVITY_INTERNAL;
 import static android.Manifest.permission.CONNECTIVITY_USE_RESTRICTED_NETWORKS;
+import static android.Manifest.permission.MANAGE_TEST_NETWORKS;
 import static android.Manifest.permission.NETWORK_FACTORY;
 import static android.Manifest.permission.NETWORK_SETTINGS;
 import static android.Manifest.permission.NETWORK_SETUP_WIZARD;
@@ -100,6 +101,11 @@ import static android.provider.Settings.Global.NETWORK_METERED_MULTIPATH_PREFERE
 import static android.system.OsConstants.AF_INET;
 import static android.system.OsConstants.AF_INET6;
 import static android.system.OsConstants.AF_UNSPEC;
+import static android.system.OsConstants.ECONNABORTED;
+import static android.system.OsConstants.EDESTADDRREQ;
+import static android.system.OsConstants.IPPROTO_UDP;
+import static android.system.OsConstants.POLLIN;
+import static android.system.OsConstants.SOCK_DGRAM;
 
 import static com.android.compatibility.common.util.SystemUtil.callWithShellPermissionIdentity;
 import static com.android.compatibility.common.util.SystemUtil.runShellCommand;
@@ -182,7 +188,9 @@ import android.os.ConditionVariable;
 import android.os.Handler;
 import android.os.Looper;
 import android.os.MessageQueue;
+import android.os.ParcelFileDescriptor;
 import android.os.Process;
+import android.os.RemoteException;
 import android.os.ServiceManager;
 import android.os.SystemClock;
 import android.os.UserHandle;
@@ -190,6 +198,9 @@ import android.os.VintfRuntimeInfo;
 import android.platform.test.annotations.AppModeFull;
 import android.provider.DeviceConfig;
 import android.provider.Settings;
+import android.system.ErrnoException;
+import android.system.Os;
+import android.system.StructPollfd;
 import android.telephony.SubscriptionManager;
 import android.telephony.TelephonyManager;
 import android.text.TextUtils;
@@ -205,6 +216,10 @@ import com.android.internal.util.ArrayUtils;
 import com.android.modules.utils.build.SdkLevel;
 import com.android.net.module.util.CollectionUtils;
 import com.android.net.module.util.DnsPacket;
+import com.android.net.module.util.Struct;
+import com.android.net.module.util.structs.Ipv4Header;
+import com.android.net.module.util.structs.Ipv6Header;
+import com.android.net.module.util.structs.UdpHeader;
 import com.android.networkstack.apishim.ConnectivityManagerShimImpl;
 import com.android.networkstack.apishim.ConstantsShim;
 import com.android.networkstack.apishim.NetworkInformationShimImpl;
@@ -228,6 +243,7 @@ import com.android.testutils.TestableNetworkCallback;
 
 import junit.framework.AssertionFailedError;
 
+import libcore.io.IoUtils;
 import libcore.io.Streams;
 
 import org.junit.After;
@@ -253,6 +269,7 @@ import java.net.MalformedURLException;
 import java.net.Socket;
 import java.net.SocketException;
 import java.net.URL;
+import java.nio.ByteBuffer;
 import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
 import java.util.Arrays;
@@ -352,6 +369,15 @@ public class ConnectivityManagerTest {
     // Re-connecting to the AP, obtaining an IP address, revalidating can take a long time
     private static final long WIFI_CONNECT_TIMEOUT_MS = 60_000L;
 
+    // Timeout for waiting the QUIC connection close information registration/unregistration
+    private static final long QUIC_CONNECTION_CLOSE_INFO_REGISTRATION_TIMEOUT_MS = 500L;
+
+    // Timeout for waiting the QUIC connection close packet to be sent
+    private static final long QUIC_CONNECTION_CLOSE_PACKET_TIMEOUT_MS = 200L;
+
+    // Name of the feature flag for closing quic connection
+    private static final String CLOSE_QUIC_CONNECTION = "close_quic_connection";
+
     private Context mContext;
     private Instrumentation mInstrumentation;
     private ConnectivityManager mCm;
@@ -2389,8 +2415,8 @@ public class ConnectivityManagerTest {
         waitForAvailable(cb);
     }
 
-    private void waitForAvailable(@NonNull final TestableNetworkCallback cb) {
-        cb.eventuallyExpect(CallbackEntry.AVAILABLE, NETWORK_CALLBACK_TIMEOUT_MS,
+    private CallbackEntry.Available waitForAvailable(@NonNull final TestableNetworkCallback cb) {
+        return cb.eventuallyExpect(CallbackEntry.AVAILABLE, NETWORK_CALLBACK_TIMEOUT_MS,
                 c -> c instanceof CallbackEntry.Available);
     }
 
@@ -4131,4 +4157,302 @@ public class ConnectivityManagerTest {
         assertThrows(UnsupportedOperationException.class, () -> mCm.tether("iface"));
         assertThrows(UnsupportedOperationException.class, () -> mCm.untether("iface"));
     }
+
+    private ParcelFileDescriptor setupTestNetworkAndGetFd() {
+        return runWithShellPermissionIdentity(() -> {
+            final TestNetworkManager tnm = mContext.getSystemService(TestNetworkManager.class);
+            final List<LinkAddress> linkAddresses = List.of(new LinkAddress("192.0.2.2/24"),
+                    new LinkAddress("2001:db8:1:2::2/64"));
+            final TestNetworkInterface iface = tnm.createTunInterface(linkAddresses);
+            tnm.setupTestNetwork(iface.getInterfaceName(), new Binder());
+            return iface.getFileDescriptor();
+        }, MANAGE_TEST_NETWORKS);
+    }
+
+    private Network getTestNetwork() {
+        final TestableNetworkCallback callback = networkCallbackRule.requestNetwork(
+                new NetworkRequest.Builder()
+                        .removeCapability(NetworkCapabilities.NET_CAPABILITY_NOT_VPN)
+                        .removeCapability(NetworkCapabilities.NET_CAPABILITY_TRUSTED)
+                        .addTransportType(TRANSPORT_TEST)
+                        .build()
+        );
+        return waitForAvailable(callback).getNetwork();
+    }
+
+    private void waitForQuicConnectionCloseInfoRegistration(final int myUid,
+            final boolean expectRegistered)
+            throws ErrnoException, RemoteException, InterruptedException {
+        final long timeout = SystemClock.elapsedRealtime()
+                + QUIC_CONNECTION_CLOSE_INFO_REGISTRATION_TIMEOUT_MS;
+        while (timeout > SystemClock.elapsedRealtime()) {
+            if (DumpTestUtils.dumpServiceWithShellPermission(
+                    Context.CONNECTIVITY_SERVICE, "--short")
+                    .contains("QuicConnectionCloseInfo{uid: " + myUid) == expectRegistered) {
+                return;
+            }
+            Thread.sleep(50);
+        }
+        fail("Failed to register/unregister QUIC connection close information in "
+                + QUIC_CONNECTION_CLOSE_INFO_REGISTRATION_TIMEOUT_MS
+                + "ms, expectRegistered=" + expectRegistered);
+    }
+
+    private void doTestRegisterQuicConnectionClosePayload(final boolean isV6,
+            final boolean unregister, final boolean closeSocket, final boolean blockNetwork,
+            final boolean expectPacketSent) throws Exception {
+        final InetAddress dstAddress = isV6 ? InetAddresses.parseNumericAddress("2001:db8:1:2::3")
+                : InetAddresses.parseNumericAddress("192.0.2.3");
+        final InetSocketAddress dstSockAddress = new InetSocketAddress(dstAddress, 443);
+        final int myUid = Process.myUid();
+
+        final ParcelFileDescriptor tunFd = setupTestNetworkAndGetFd();
+        final Network testNetwork = getTestNetwork();
+
+        // Firewall chain status will be restored after the test.
+        final boolean wasChainEnabled = runWithShellPermissionIdentity(() ->
+                mCm.getFirewallChainEnabled(FIREWALL_CHAIN_BACKGROUND), NETWORK_SETTINGS);
+        final int previousUidFirewallRule = runWithShellPermissionIdentity(() ->
+                mCm.getUidFirewallRule(FIREWALL_CHAIN_BACKGROUND, myUid), NETWORK_SETTINGS);
+        runWithShellPermissionIdentity(() -> {
+            mCm.setFirewallChainEnabled(FIREWALL_CHAIN_BACKGROUND, true /* enable */);
+            mCm.setUidFirewallRule(FIREWALL_CHAIN_BACKGROUND, myUid, FIREWALL_RULE_ALLOW);
+        }, NETWORK_SETTINGS);
+
+        final FileDescriptor sock = Os.socket(isV6 ? AF_INET6 : AF_INET, SOCK_DGRAM, IPPROTO_UDP);
+        final ParcelFileDescriptor pfd = ParcelFileDescriptor.fromFd(sock.getInt$());
+        testNetwork.bindSocket(sock);
+        Os.connect(sock, dstSockAddress);
+        final InetSocketAddress srcSockAddress = (InetSocketAddress) Os.getsockname(sock);
+
+        testAndCleanup(() -> {
+            final Random random = new Random();
+            final byte[] payload = new byte[100];
+            random.nextBytes(payload);
+
+            // register/unregisterQuicConnectionClosePayload are oneway binder calls,
+            // while setUidFirewallRule is a two-way binder call. So if
+            // setUidFirewallRule is called immediately after them, it's possible that
+            // setUidFirewallRule could be processed before them.
+            // To ensure that uid networking is blocked after the connection close information
+            // is registered/unregistered, wait for the registration/unregistration.
+            mCm.registerQuicConnectionClosePayload(pfd, payload);
+            waitForQuicConnectionCloseInfoRegistration(myUid, true /* expectRegistered */);
+            if (unregister) {
+                mCm.unregisterQuicConnectionClosePayload(pfd);
+                waitForQuicConnectionCloseInfoRegistration(myUid, false /* expectRegistered */);
+            }
+
+            if (closeSocket) {
+                Os.close(sock);
+                pfd.close();
+            }
+
+            if (blockNetwork) {
+                runWithShellPermissionIdentity(() ->
+                        mCm.setUidFirewallRule(FIREWALL_CHAIN_BACKGROUND, myUid,
+                                FIREWALL_RULE_DENY), NETWORK_SETTINGS);
+            }
+
+            final long timeout = SystemClock.elapsedRealtime()
+                    + QUIC_CONNECTION_CLOSE_PACKET_TIMEOUT_MS;
+            long remainingTimeMs;
+            while ((remainingTimeMs = timeout - SystemClock.elapsedRealtime()) > 0) {
+                final StructPollfd pollfd = new StructPollfd();
+                pollfd.events = (short) POLLIN;
+                pollfd.fd = tunFd.getFileDescriptor();
+                final int ret = Os.poll(new StructPollfd[] { pollfd }, (int) remainingTimeMs);
+                if (ret == 0) {
+                    continue;
+                }
+
+                final byte[] recvData = new byte[200];
+                final int readSize = Os.read(tunFd.getFileDescriptor(), recvData,
+                        0 /* byteOffset */, recvData.length);
+
+                if (readSize < payload.length
+                        || !Arrays.equals(payload, 0, payload.length,
+                        recvData, readSize - payload.length, readSize)) {
+                    continue;
+                }
+                // If the control comes here then the payload was received, otherwise poll would
+                // have returned 0 or the test above would have matched it and gone to continue.
+                if (!expectPacketSent) {
+                    fail("Unexpectedly received the QUIC connection close packet.");
+                }
+
+                final ByteBuffer buf = ByteBuffer.wrap(recvData, 0 /* offset */, readSize);
+                if (isV6) {
+                    final Ipv6Header header = Struct.parse(Ipv6Header.class, buf);
+                    assertEquals(srcSockAddress.getAddress(), header.srcIp);
+                    assertEquals(dstSockAddress.getAddress(), header.dstIp);
+                } else {
+                    final Ipv4Header header = Struct.parse(Ipv4Header.class, buf);
+                    assertEquals(srcSockAddress.getAddress(), header.srcIp);
+                    assertEquals(dstSockAddress.getAddress(), header.dstIp);
+                }
+                final UdpHeader udpHeader = Struct.parse(UdpHeader.class, buf);
+                assertEquals(srcSockAddress.getPort(), udpHeader.srcPort);
+                assertEquals(dstSockAddress.getPort(), udpHeader.dstPort);
+                assertEquals(payload.length + Struct.getSize(UdpHeader.class), udpHeader.length);
+
+                if (!closeSocket) {
+                    // After the socket is destroyed and QUIC connection is closed by
+                    // ConnectivityService, writing to the UDP socket should throw.
+                    try {
+                        Os.write(sock, payload, 0 /* byteOffset */, payload.length);
+                        fail("Write to the destroyed socket must throw.");
+                    } catch (ErrnoException e) {
+                        assertEquals(EDESTADDRREQ, e.errno);
+                    }
+                    try {
+                        Os.sendto(sock, payload, 0 /* byteOffset */,
+                                payload.length, 0 /* flags */, dstSockAddress);
+                        fail("Sendto with the destroyed socket must throw.");
+                    } catch (ErrnoException e) {
+                        assertEquals(ECONNABORTED, e.errno);
+                    }
+                }
+                return;
+            }
+            if (expectPacketSent) {
+                fail("Did not receive the QUIC connection close packet.");
+            }
+        }, /* cleanup */ () -> {
+            runWithShellPermissionIdentity(() -> {
+                mContext.getSystemService(TestNetworkManager.class).teardownTestNetwork(
+                        testNetwork);
+            }, MANAGE_TEST_NETWORKS);
+            IoUtils.closeQuietly(tunFd);
+            IoUtils.closeQuietly(sock);
+            IoUtils.closeQuietly(pfd);
+        }, /* cleanup */ () -> {
+            // Restore firewall chain global status
+            runWithShellPermissionIdentity(() -> {
+                mCm.setFirewallChainEnabled(FIREWALL_CHAIN_BACKGROUND, wasChainEnabled);
+            }, NETWORK_SETTINGS);
+        }, /* cleanup */ () -> {
+            // Restore firewall chain status for myUid
+            runWithShellPermissionIdentity(() -> {
+                try {
+                    mCm.setUidFirewallRule(FIREWALL_CHAIN_BACKGROUND, myUid,
+                            previousUidFirewallRule);
+                } catch (IllegalStateException ignored) {
+                    // Removing match causes an exception when the rule entry for the uid does
+                    // not exist. But this is fine and can be ignored.
+                }
+            }, NETWORK_SETTINGS);
+        });
+    }
+
+    @Test
+    @IgnoreUpTo(Build.VERSION_CODES.R)
+    @ConnectivityModuleTest
+    @AppModeFull(reason = "Cannot create test network in instant app mode")
+    public void testRegisterQuicConnectionClosePayload_blockNetwork() throws Exception {
+        assumeTrue(mCm.isConnectivityServiceFeatureEnabledForTesting(CLOSE_QUIC_CONNECTION));
+
+        // Network is blocked while the connection close payload is registered.
+        // Packet should be sent.
+        doTestRegisterQuicConnectionClosePayload(
+                false /* isV6 */, false /* unregister */, false /* closeSocket */,
+                true /* blockNetwork */, true /* expectPacketSent */);
+        doTestRegisterQuicConnectionClosePayload(
+                true /* isV6 */, false /* unregister */, false /* closeSocket */,
+                true /* blockNetwork */, true /* expectPacketSent */);
+
+        // Network is blocked after the connection close payload is unregistered.
+        // Packet should not be sent.
+        doTestRegisterQuicConnectionClosePayload(
+                false /* isV6 */, true /* unregister */, false /* closeSocket */,
+                true /* blockNetwork */, false /* expectPacketSent */);
+        doTestRegisterQuicConnectionClosePayload(
+                true /* isV6 */, true /* unregister */, false /* closeSocket */,
+                true /* blockNetwork */, false /* expectPacketSent */);
+    }
+
+    @Test
+    @IgnoreUpTo(Build.VERSION_CODES.R)
+    @ConnectivityModuleTest
+    @AppModeFull(reason = "Cannot create test network in instant app mode")
+    public void testRegisterQuicConnectionClosePayload_closeSocket() throws Exception {
+        assumeTrue(mCm.isConnectivityServiceFeatureEnabledForTesting(CLOSE_QUIC_CONNECTION));
+
+        // Registered socket is closed while the connection close payload is registered.
+        // Packet should be sent. This simulates that apps crash or are killed.
+        doTestRegisterQuicConnectionClosePayload(
+                false /* isV6 */, false /* unregister */, true /* closeSocket */,
+                false /* blockNetwork */, true /* expectPacketSent */);
+        doTestRegisterQuicConnectionClosePayload(
+                true /* isV6 */, false /* unregister */, true /* closeSocket */,
+                false /* blockNetwork */, true /* expectPacketSent */);
+    }
+
+    /**
+     * Repeat register a connection close payload, unregister it, and then close the socket.
+     * The registered payload must not be sent because it is unregistered before the socket
+     * is closed.
+     * This test tries to detect threading issues between
+     * register/unregisterQuicConnectionClosePayload and socket destroy message handling.
+     */
+    @Test
+    @IgnoreUpTo(Build.VERSION_CODES.R)
+    @ConnectivityModuleTest
+    @AppModeFull(reason = "Cannot create test network in instant app mode")
+    public void testRegisterQuicConnectionClosePayload_closeSocketAfterUnregister()
+            throws Exception {
+        assumeTrue(mCm.isConnectivityServiceFeatureEnabledForTesting(CLOSE_QUIC_CONNECTION));
+
+        final ParcelFileDescriptor tunFd = setupTestNetworkAndGetFd();
+        final Network testNetwork = getTestNetwork();
+
+        final Random random = new Random();
+        final byte[] payload = new byte[100];
+        random.nextBytes(payload);
+
+        final InetSocketAddress dstSockAddress =
+                new InetSocketAddress(InetAddresses.parseNumericAddress("2001:db8:1:2::3"), 443);
+        for (int i = 0; i < 100; i++) {
+            final FileDescriptor sock = Os.socket(AF_INET6, SOCK_DGRAM, IPPROTO_UDP);
+            testNetwork.bindSocket(sock);
+            Os.connect(sock, dstSockAddress);
+
+            final ParcelFileDescriptor pfd = ParcelFileDescriptor.fromFd(sock.getInt$());
+            mCm.registerQuicConnectionClosePayload(pfd, payload);
+            mCm.unregisterQuicConnectionClosePayload(pfd);
+            Os.close(sock);
+            pfd.close();
+        }
+
+        testAndCleanup(() -> {
+            final long timeout = SystemClock.elapsedRealtime()
+                    + QUIC_CONNECTION_CLOSE_PACKET_TIMEOUT_MS;
+            long remainingTimeMs;
+            while ((remainingTimeMs = timeout - SystemClock.elapsedRealtime()) > 0) {
+                StructPollfd pollfd = new StructPollfd();
+                pollfd.events = (short) POLLIN;
+                pollfd.fd = tunFd.getFileDescriptor();
+                final int ret = Os.poll(new StructPollfd[]{pollfd}, (int) remainingTimeMs);
+                if (ret == 0) {
+                    continue;
+                }
+
+                final byte[] recvData = new byte[200];
+                final int readSize = Os.read(tunFd.getFileDescriptor(), recvData,
+                        0 /* byteOffset */, recvData.length);
+                if (readSize < payload.length
+                        || !Arrays.equals(payload, 0, payload.length,
+                        recvData, readSize - payload.length, readSize)) {
+                    continue;
+                }
+                fail("Unexpectedly received the QUIC connection close packet.");
+            }
+        }, /* cleanup */ () -> {
+            runWithShellPermissionIdentity(() -> {
+                mContext.getSystemService(TestNetworkManager.class).teardownTestNetwork(
+                        testNetwork);
+            }, MANAGE_TEST_NETWORKS);
+            IoUtils.closeQuietly(tunFd);
+        });
+    }
 }
diff --git a/tests/unit/java/com/android/server/ConnectivityServiceTest.java b/tests/unit/java/com/android/server/ConnectivityServiceTest.java
index 8c90e01086..bd26b95764 100755
--- a/tests/unit/java/com/android/server/ConnectivityServiceTest.java
+++ b/tests/unit/java/com/android/server/ConnectivityServiceTest.java
@@ -2188,6 +2188,7 @@ public class ConnectivityServiceTest {
                 case ConnectivityFlags.USE_DECLARED_METHODS_FOR_CALLBACKS:
                 case ConnectivityFlags.QUEUE_CALLBACKS_FOR_FROZEN_APPS:
                 case ConnectivityFlags.BACKGROUND_FIREWALL_CHAIN:
+                case ConnectivityFlags.CLOSE_QUIC_CONNECTION:
                 case ConnectivityService.KEY_DESTROY_FROZEN_SOCKETS_VERSION:
                     return true;
                 default:
diff --git a/tests/unit/java/com/android/server/connectivity/QuicConnectionCloserTest.kt b/tests/unit/java/com/android/server/connectivity/QuicConnectionCloserTest.kt
new file mode 100644
index 0000000000..9e1c090f2c
--- /dev/null
+++ b/tests/unit/java/com/android/server/connectivity/QuicConnectionCloserTest.kt
@@ -0,0 +1,232 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.server.connectivity
+
+import android.net.InetAddresses
+import android.net.LinkAddress
+import android.net.LinkProperties
+import android.net.Network
+import android.net.TEST_IFACE
+import android.os.Build
+import android.os.Handler
+import android.os.Looper
+import android.os.ParcelFileDescriptor
+import android.system.OsConstants.SOL_SOCKET
+import android.util.SparseArray
+import com.android.net.module.util.SkDestroyListener
+import com.android.net.module.util.netlink.InetDiagMessage
+import com.android.net.module.util.netlink.StructInetDiagSockId
+import com.android.net.module.util.netlink.StructNlMsgHdr
+import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
+import com.android.testutils.DevSdkIgnoreRunner
+import com.android.testutils.visibleOnHandlerThread
+import java.net.InetSocketAddress
+import java.util.function.Consumer
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.mockito.ArgumentCaptor
+import org.mockito.InOrder
+import org.mockito.Mockito.any
+import org.mockito.Mockito.anyLong
+import org.mockito.Mockito.doReturn
+import org.mockito.Mockito.eq
+import org.mockito.Mockito.inOrder
+import org.mockito.Mockito.mock
+import org.mockito.Mockito.never
+import org.mockito.Mockito.verify
+
+private const val TEST_UID = 1234
+private const val TEST_NETID = 789
+private const val TEST_SOCKET_COOKIE = 12321L
+
+// TODO: Use OsConstants.SO_MARK once this API is available
+private const val SO_MARK = 36
+
+private val TEST_SRC_ADDRESS = InetAddresses.parseNumericAddress("2001:db8:1:2::2")
+private val TEST_SRC_SOCKET_ADDRESS = InetSocketAddress(
+        TEST_SRC_ADDRESS,
+        1234
+)
+private val TEST_DST_SOCKET_ADDRESS = InetSocketAddress(
+        InetAddresses.parseNumericAddress("2001:db8:1:2::3"),
+        443
+)
+private val TEST_LP = LinkProperties().apply {
+    interfaceName = TEST_IFACE
+    addLinkAddress(LinkAddress(TEST_SRC_ADDRESS, 64))
+}
+private val TEST_NETWORK = Network(TEST_NETID)
+private val TEST_PAYLOAD = byteArrayOf(0, 1, 2, 3, 4, 5)
+
+@RunWith(DevSdkIgnoreRunner::class)
+@IgnoreUpTo(Build.VERSION_CODES.R)
+class QuicConnectionCloserTest {
+    private val pfd = mock(ParcelFileDescriptor::class.java)
+    private val skDestroyListener = mock(SkDestroyListener::class.java)
+    private val handler by lazy { Handler(Looper.getMainLooper()) }
+
+    private val mDeps = mock(QuicConnectionCloser.Dependencies::class.java).also {
+        doReturn(TEST_NETID).`when`(it).getsockoptInt(any(), eq(SOL_SOCKET), eq(SO_MARK))
+        doReturn(TEST_SOCKET_COOKIE).`when`(it).getSocketCookie(any())
+        doReturn(TEST_SRC_SOCKET_ADDRESS).`when`(it).getsockname(any())
+        doReturn(TEST_DST_SOCKET_ADDRESS).`when`(it).getpeername(any())
+        doReturn(skDestroyListener).`when`(it).makeSkDestroyListener(any(), any())
+    }
+
+    private val nai = mock(NetworkAgentInfo::class.java).also {
+        it.linkProperties = TEST_LP
+        doReturn(TEST_NETWORK).`when`(it).network()
+    }
+
+    private val networkForNetId = SparseArray<NetworkAgentInfo>().apply {
+        put(TEST_NETID, nai)
+    }
+
+    private val mQuicConnectionCloser = QuicConnectionCloser(networkForNetId, handler, mDeps)
+
+    private fun InOrder.expectDestroyUdpSocket() = verify(mDeps).destroyUdpSocket(
+            TEST_SRC_SOCKET_ADDRESS,
+            TEST_DST_SOCKET_ADDRESS,
+            TEST_SOCKET_COOKIE
+    )
+
+    private fun InOrder.assertNoDestroyUdpSocket() = verify(mDeps, never()).destroyUdpSocket(
+            any(),
+            any(),
+            anyLong()
+    )
+
+    private fun InOrder.expectSendQuicConnectionClosePayload() =
+            verify(mDeps).sendQuicConnectionClosePayload(
+                    TEST_NETWORK,
+                    TEST_SRC_SOCKET_ADDRESS,
+                    TEST_DST_SOCKET_ADDRESS,
+                    TEST_PAYLOAD
+            )
+
+    private fun InOrder.assertNoSendQuicConnectionClosePayload() =
+            verify(mDeps, never()).sendQuicConnectionClosePayload(
+                    any(),
+                    any(),
+                    any(),
+                    any()
+            )
+
+    @Test
+    fun testCloseQuicConnectionByUids() {
+        mQuicConnectionCloser.registerQuicConnectionClosePayload(TEST_UID, pfd, TEST_PAYLOAD)
+        visibleOnHandlerThread(handler) {
+            mQuicConnectionCloser.closeQuicConnectionByUids(setOf(TEST_UID))
+        }
+
+        val inOrder = inOrder(mDeps)
+        inOrder.expectDestroyUdpSocket()
+        inOrder.expectSendQuicConnectionClosePayload()
+    }
+
+    @Test
+    fun testCloseQuicConnectionByUids_unregisterQuicConnectionCloseInfo() {
+        mQuicConnectionCloser.registerQuicConnectionClosePayload(TEST_UID, pfd, TEST_PAYLOAD)
+        mQuicConnectionCloser.unregisterQuicConnectionClosePayload(pfd)
+        visibleOnHandlerThread(handler) {
+            mQuicConnectionCloser.closeQuicConnectionByUids(setOf(TEST_UID))
+        }
+
+        val inOrder = inOrder(mDeps)
+        inOrder.assertNoDestroyUdpSocket()
+        inOrder.assertNoSendQuicConnectionClosePayload()
+    }
+
+    @Test
+    fun testCloseQuicConnectionByUids_networkDisconnected() {
+        mQuicConnectionCloser.registerQuicConnectionClosePayload(TEST_UID, pfd, TEST_PAYLOAD)
+        // closeQuicConnectionByUids determines that the network is disconnected by
+        // checking if it's absent from the networkForNetId set.
+        synchronized (networkForNetId) {
+            networkForNetId.clear()
+        }
+        visibleOnHandlerThread(handler) {
+            mQuicConnectionCloser.closeQuicConnectionByUids(setOf(TEST_UID))
+        }
+
+        val inOrder = inOrder(mDeps)
+        inOrder.assertNoDestroyUdpSocket()
+        inOrder.assertNoSendQuicConnectionClosePayload()
+    }
+
+    @Test
+    fun testCloseQuicConnectionByUids_networkAddressChange() {
+        mQuicConnectionCloser.registerQuicConnectionClosePayload(TEST_UID, pfd, TEST_PAYLOAD)
+        // Update address to different address from TEST_SRC_SOCKET_ADDRESS
+        nai.linkProperties = LinkProperties().apply {
+            interfaceName = TEST_IFACE
+            addLinkAddress(LinkAddress(InetAddresses.parseNumericAddress("2001:db8:1:3::2"), 64))
+        }
+        visibleOnHandlerThread(handler) {
+            mQuicConnectionCloser.closeQuicConnectionByUids(setOf(TEST_UID))
+        }
+
+        val inOrder = inOrder(mDeps)
+        inOrder.assertNoDestroyUdpSocket()
+        inOrder.assertNoSendQuicConnectionClosePayload()
+    }
+
+    private fun getSkDestroyListenerCallback(): Consumer<InetDiagMessage> {
+        val captor = ArgumentCaptor.forClass(Consumer::class.java)
+                as ArgumentCaptor<Consumer<InetDiagMessage>>
+        verify(mDeps).makeSkDestroyListener(captor.capture(), any())
+        return captor.value
+    }
+
+    @Test
+    fun testHandleUdpSocketDestroy() {
+        mQuicConnectionCloser.registerQuicConnectionClosePayload(TEST_UID, pfd, TEST_PAYLOAD)
+
+        val inetDiagMessage = InetDiagMessage(StructNlMsgHdr())
+        inetDiagMessage.inetDiagMsg.id = StructInetDiagSockId(
+                TEST_SRC_SOCKET_ADDRESS,
+                TEST_DST_SOCKET_ADDRESS,
+                0 /* ifindex */,
+                TEST_SOCKET_COOKIE
+        )
+        getSkDestroyListenerCallback().accept(inetDiagMessage)
+
+        val inOrder = inOrder(mDeps)
+        // DestroyUdpSocket is not called since the socket is already closed
+        inOrder.assertNoDestroyUdpSocket()
+        inOrder.expectSendQuicConnectionClosePayload()
+    }
+
+    @Test
+    fun testHandleUdpSocketDestroy_unregisterBeforeSocketClose() {
+        mQuicConnectionCloser.registerQuicConnectionClosePayload(TEST_UID, pfd, TEST_PAYLOAD)
+        mQuicConnectionCloser.unregisterQuicConnectionClosePayload(pfd)
+
+        val inetDiagMessage = InetDiagMessage(StructNlMsgHdr())
+        inetDiagMessage.inetDiagMsg.id = StructInetDiagSockId(
+                TEST_SRC_SOCKET_ADDRESS,
+                TEST_DST_SOCKET_ADDRESS,
+                0 /* ifindex */,
+                TEST_SOCKET_COOKIE
+        )
+        getSkDestroyListenerCallback().accept(inetDiagMessage)
+
+        val inOrder = inOrder(mDeps)
+        inOrder.assertNoDestroyUdpSocket()
+        inOrder.assertNoSendQuicConnectionClosePayload()
+    }
+}
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSDestroySocketTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSDestroySocketTest.kt
index bc5be7865c..56d934bf51 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSDestroySocketTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSDestroySocketTest.kt
@@ -155,7 +155,6 @@ class CSDestroySocketTest : CSTest() {
     @Test
     fun testReplaceFirewallChain() {
         val netdEventListener = getRegisteredNetdUnsolicitedEventListener()
-        val inOrder = inOrder(destroySocketsWrapper)
 
         val cellAgent = Agent(nc = cellNc(), lp = cellLp())
         cellAgent.connect()
@@ -193,8 +192,8 @@ class CSDestroySocketTest : CSTest() {
                 .`when`(bpfNetMaps).getUidNetworkingBlockedReasons(TEST_UID2)
         cm.replaceFirewallChain(FIREWALL_CHAIN_BACKGROUND, intArrayOf(TEST_UID2))
         waitForIdle()
-        inOrder.verify(destroySocketsWrapper, never())
-                .destroyLiveTcpSocketsByOwnerUids(setOf(TEST_UID))
+        verify(destroySocketsWrapper, never()).destroyLiveTcpSocketsByOwnerUids(setOf(TEST_UID))
+        verify(quicConnectionCloser, never()).closeQuicConnectionByUids(setOf(TEST_UID))
 
         netdEventListener.onInterfaceClassActivityChanged(
                 true, // isActive
@@ -203,8 +202,8 @@ class CSDestroySocketTest : CSTest() {
                 TEST_UID
         )
         waitForIdle()
-        inOrder.verify(destroySocketsWrapper)
-                .destroyLiveTcpSocketsByOwnerUids(setOf(TEST_UID))
+        verify(destroySocketsWrapper).destroyLiveTcpSocketsByOwnerUids(setOf(TEST_UID))
+        verify(quicConnectionCloser).closeQuicConnectionByUids(setOf(TEST_UID))
 
         cellAgent.disconnect()
     }
@@ -277,8 +276,10 @@ class CSDestroySocketTest : CSTest() {
 
         if (expectDestroySockets) {
             verify(destroySocketsWrapper).destroyLiveTcpSocketsByOwnerUids(setOf(TEST_UID))
+            verify(quicConnectionCloser).closeQuicConnectionByUids(setOf(TEST_UID))
         } else {
             verify(destroySocketsWrapper, never()).destroyLiveTcpSocketsByOwnerUids(setOf(TEST_UID))
+            verify(quicConnectionCloser, never()).closeQuicConnectionByUids(setOf(TEST_UID))
         }
     }
 
diff --git a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
index 5c55483ee9..d7ecfd6159 100644
--- a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
@@ -58,6 +58,7 @@ import android.permission.PermissionManager.PermissionResult
 import android.telephony.SubscriptionManager
 import android.telephony.TelephonyManager
 import android.testing.TestableContext
+import android.util.SparseArray
 import androidx.test.platform.app.InstrumentationRegistry
 import com.android.internal.app.IBatteryStats
 import com.android.internal.util.test.BroadcastInterceptingContext
@@ -72,9 +73,11 @@ import com.android.server.connectivity.InterfaceTracker
 import com.android.server.connectivity.MulticastRoutingCoordinatorService
 import com.android.server.connectivity.MultinetworkPolicyTracker
 import com.android.server.connectivity.MultinetworkPolicyTrackerTestDependencies
+import com.android.server.connectivity.NetworkAgentInfo
 import com.android.server.connectivity.NetworkRequestStateStatsMetrics
 import com.android.server.connectivity.PermissionMonitor
 import com.android.server.connectivity.ProxyTracker
+import com.android.server.connectivity.QuicConnectionCloser
 import com.android.server.connectivity.SatelliteAccessController
 import com.android.testutils.visibleOnHandlerThread
 import com.android.testutils.waitForIdle
@@ -171,6 +174,7 @@ open class CSTest {
         it[ConnectivityFlags.USE_DECLARED_METHODS_FOR_CALLBACKS] = true
         it[ConnectivityFlags.QUEUE_CALLBACKS_FOR_FROZEN_APPS] = true
         it[ConnectivityFlags.QUEUE_NETWORK_AGENT_EVENTS_IN_SYSTEM_SERVER] = true
+        it[ConnectivityFlags.CLOSE_QUIC_CONNECTION] = true
     }
     fun setFeatureEnabled(flag: String, enabled: Boolean) = enabledFeatures.set(flag, enabled)
 
@@ -219,6 +223,7 @@ open class CSTest {
 
     val multicastRoutingCoordinatorService = mock<MulticastRoutingCoordinatorService>()
     val satelliteAccessController = mock<SatelliteAccessController>()
+    val quicConnectionCloser = mock<QuicConnectionCloser>()
     val destroySocketsWrapper = mock<DestroySocketsWrapper>()
 
     val deps = CSDeps()
@@ -412,6 +417,11 @@ open class CSTest {
         }
 
         override fun makeL2capNetworkProvider(context: Context) = null
+
+        override fun makeQuicConnectionCloser(
+                networkForNetId: SparseArray<NetworkAgentInfo>,
+                handler: Handler
+        ): QuicConnectionCloser = quicConnectionCloser
     }
 
     inner class PermDeps : PermissionMonitor.Dependencies() {

From 58498d1eeeccc56485ba3e5240476b2fea9025bf Mon Sep 17 00:00:00 2001
From: Motomu Utsumi <motomuman@google.com>
Date: Wed, 12 Mar 2025 08:55:50 +0900
Subject: [PATCH 017/377] Remove unnecessary ifindex arg from destroyUdpSocket

Bug: 311792075
Test: m
Change-Id: I0eb70c1248aff347e6f988789f340e117fceea33
---
 .../com/android/server/connectivity/QuicConnectionCloser.java | 2 +-
 .../com/android/net/module/util/netlink/InetDiagMessage.java  | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/service/src/com/android/server/connectivity/QuicConnectionCloser.java b/service/src/com/android/server/connectivity/QuicConnectionCloser.java
index ce5d61c92b..c064cf3a5b 100644
--- a/service/src/com/android/server/connectivity/QuicConnectionCloser.java
+++ b/service/src/com/android/server/connectivity/QuicConnectionCloser.java
@@ -139,7 +139,7 @@ public class QuicConnectionCloser {
         public void destroyUdpSocket(final InetSocketAddress src, final InetSocketAddress dst,
                 final long cookie)
                 throws SocketException, InterruptedIOException, ErrnoException {
-            InetDiagMessage.destroyUdpSocket(src, dst, 0 /* ifindex */, cookie);
+            InetDiagMessage.destroyUdpSocket(src, dst, cookie);
         }
 
         /**
diff --git a/staticlibs/device/com/android/net/module/util/netlink/InetDiagMessage.java b/staticlibs/device/com/android/net/module/util/netlink/InetDiagMessage.java
index c9a89ec1dd..f776f4755f 100644
--- a/staticlibs/device/com/android/net/module/util/netlink/InetDiagMessage.java
+++ b/staticlibs/device/com/android/net/module/util/netlink/InetDiagMessage.java
@@ -491,7 +491,7 @@ public class InetDiagMessage extends NetlinkMessage {
      * Close the udp socket which can be uniquely identified with the cookie and other information.
      */
     public static void destroyUdpSocket(final InetSocketAddress src, final InetSocketAddress dst,
-            final int ifIndex, final long cookie)
+            final long cookie)
             throws ErrnoException, SocketException, InterruptedIOException {
         FileDescriptor fd = null;
 
@@ -502,7 +502,7 @@ public class InetDiagMessage extends NetlinkMessage {
             final StructInetDiagSockId id = new StructInetDiagSockId(
                     src,
                     dst,
-                    ifIndex,
+                    0 /* ifIndex */,
                     cookie
             );
             sendNetlinkDestroyRequest(fd, IPPROTO_UDP, id, (short) family, 0 /* state */);

From 68b852a69cdd9a4783b32936ac7f68ef9679a8c0 Mon Sep 17 00:00:00 2001
From: "Chaitanya Cheemala (xWF)" <ccheemala@google.com>
Date: Wed, 26 Mar 2025 03:07:07 -0700
Subject: [PATCH 018/377] Revert "Remove unnecessary ifindex arg from
 destroyUdpSocket"

Revert submission 3538339

Reason for revert: Likely culprit for b/406432012 - verifying through ABTD before revert submission. This is part of the standard investigation process, and does not mean your CL will be reverted.

Reverted changes: /q/submissionid:3538339

Change-Id: I70395af68b0f28e5c333333cb03a42f7633b0d5d
---
 .../com/android/server/connectivity/QuicConnectionCloser.java | 2 +-
 .../com/android/net/module/util/netlink/InetDiagMessage.java  | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/service/src/com/android/server/connectivity/QuicConnectionCloser.java b/service/src/com/android/server/connectivity/QuicConnectionCloser.java
index c064cf3a5b..ce5d61c92b 100644
--- a/service/src/com/android/server/connectivity/QuicConnectionCloser.java
+++ b/service/src/com/android/server/connectivity/QuicConnectionCloser.java
@@ -139,7 +139,7 @@ public class QuicConnectionCloser {
         public void destroyUdpSocket(final InetSocketAddress src, final InetSocketAddress dst,
                 final long cookie)
                 throws SocketException, InterruptedIOException, ErrnoException {
-            InetDiagMessage.destroyUdpSocket(src, dst, cookie);
+            InetDiagMessage.destroyUdpSocket(src, dst, 0 /* ifindex */, cookie);
         }
 
         /**
diff --git a/staticlibs/device/com/android/net/module/util/netlink/InetDiagMessage.java b/staticlibs/device/com/android/net/module/util/netlink/InetDiagMessage.java
index f776f4755f..c9a89ec1dd 100644
--- a/staticlibs/device/com/android/net/module/util/netlink/InetDiagMessage.java
+++ b/staticlibs/device/com/android/net/module/util/netlink/InetDiagMessage.java
@@ -491,7 +491,7 @@ public class InetDiagMessage extends NetlinkMessage {
      * Close the udp socket which can be uniquely identified with the cookie and other information.
      */
     public static void destroyUdpSocket(final InetSocketAddress src, final InetSocketAddress dst,
-            final long cookie)
+            final int ifIndex, final long cookie)
             throws ErrnoException, SocketException, InterruptedIOException {
         FileDescriptor fd = null;
 
@@ -502,7 +502,7 @@ public class InetDiagMessage extends NetlinkMessage {
             final StructInetDiagSockId id = new StructInetDiagSockId(
                     src,
                     dst,
-                    0 /* ifIndex */,
+                    ifIndex,
                     cookie
             );
             sendNetlinkDestroyRequest(fd, IPPROTO_UDP, id, (short) family, 0 /* state */);

From 947b53b0d39fe165d5f0273b6349a1f866681c10 Mon Sep 17 00:00:00 2001
From: "Chaitanya Cheemala (xWF)" <ccheemala@google.com>
Date: Wed, 26 Mar 2025 03:07:07 -0700
Subject: [PATCH 019/377] Revert "Add hidden API to register/unregister QUIC
 connection cl..."

Revert submission 3538339

Reason for revert: Likely culprit for b/406432012 - verifying through ABTD before revert submission. This is part of the standard investigation process, and does not mean your CL will be reverted.

Reverted changes: /q/submissionid:3538339

Change-Id: I61b02f2b1b667e9a41b677f8062e8e96aac09f6e
---
 .../src/android/net/ConnectivityManager.java  |  64 ---
 .../src/android/net/IConnectivityManager.aidl |   3 -
 .../android/server/ConnectivityService.java   |  60 ---
 .../connectivity/ConnectivityFlags.java       |   2 -
 .../connectivity/QuicConnectionCloser.java    | 406 ------------------
 .../net/cts/ConnectivityManagerTest.java      | 328 +-------------
 .../server/ConnectivityServiceTest.java       |   1 -
 .../connectivity/QuicConnectionCloserTest.kt  | 232 ----------
 .../CSDestroySocketTest.kt                    |  11 +-
 .../server/connectivityservice/base/CSTest.kt |  10 -
 10 files changed, 7 insertions(+), 1110 deletions(-)
 delete mode 100644 service/src/com/android/server/connectivity/QuicConnectionCloser.java
 delete mode 100644 tests/unit/java/com/android/server/connectivity/QuicConnectionCloserTest.kt

diff --git a/framework/src/android/net/ConnectivityManager.java b/framework/src/android/net/ConnectivityManager.java
index 3a7d070670..f8a1293a34 100644
--- a/framework/src/android/net/ConnectivityManager.java
+++ b/framework/src/android/net/ConnectivityManager.java
@@ -6856,68 +6856,4 @@ public class ConnectivityManager {
             throw e.rethrowFromSystemServer();
         }
     }
-
-    /**
-     * Register QUIC UDP socket and UDP payload that can close QUIC connection.
-     *
-     * When the app loses network access (e.g. due to freezer or firewall chain),
-     * ConnectivityService 1)destroys the registered UDP socket by sending a SOCK_DESTROY netlink
-     * message and 2)sends the registered UDP payload to the server.
-     * This prevents unnecessary modem wakeups caused by packets from the server after the apps
-     * lose network access.
-     *
-     * Additionally, to close QUIC connection for apps that crash or are killed, ConnectivityService
-     * sends the registered UDP payload when it receives a socket destroy diag message for the
-     * registered socket.
-     *
-     * If apps call this method, they must call {@link #unregisterQuicConnectionClosePayload} before
-     * they close the QUIC connection and the socket.
-     * Otherwise, the registered UDP payload will be sent to the server, even if the QUIC connection
-     * was already properly closed. This is because ConnectivityService cannot distinguish whether
-     * the socket was closed due to the app being killed or because the app forgets to call
-     * {@link #unregisterQuicConnectionClosePayload}.
-     *
-     * The registered payload will be sent using the source and destination addresses and ports of
-     * the connected UDP socket provided. So, the app must not reuse the same socket to reconnect
-     * to a different server, even if first calls unregisterQuicConnectionClosePayload. This is
-     * because this method operates asynchronously.
-     *
-     * If the number of registered socket and payload hits the limit, ConnectivityService silently
-     * ignores new registration. ConnectivityService cannot know about this synchronously, but the
-     * caller couldn't really do anything with this information anyway.
-     * TODO: Consider adding a result listener if this API becomes public.
-     *
-     * @param pfd The {@link ParcelFileDescriptor} for the connected UDP socket.
-     *            The registered payload will be sent using the source and destination addresses and
-     *            ports of this connected UDP socket.
-     * @param payload The UDP payload that can close QUIC connection.
-     *
-     * @hide
-     */
-    public void registerQuicConnectionClosePayload(final ParcelFileDescriptor pfd,
-            final byte[] payload) {
-        try {
-            mService.registerQuicConnectionClosePayload(pfd, payload);
-        } catch (RemoteException e) {
-            throw e.rethrowFromSystemServer();
-        }
-    }
-
-    /**
-     * Unregister the QUIC socket previously registered by
-     * {@link #registerQuicConnectionClosePayload}
-     *
-     * This method is a no-op if the provided UDP socket is not registered.
-     *
-     * @param pfd The {@link ParcelFileDescriptor} for the UDP socket.
-     *
-     * @hide
-     */
-    public void unregisterQuicConnectionClosePayload(final ParcelFileDescriptor pfd) {
-        try {
-            mService.unregisterQuicConnectionClosePayload(pfd);
-        } catch (RemoteException e) {
-            throw e.rethrowFromSystemServer();
-        }
-    }
 }
diff --git a/framework/src/android/net/IConnectivityManager.aidl b/framework/src/android/net/IConnectivityManager.aidl
index 0146e729a7..a270684c40 100644
--- a/framework/src/android/net/IConnectivityManager.aidl
+++ b/framework/src/android/net/IConnectivityManager.aidl
@@ -266,7 +266,4 @@ interface IConnectivityManager
     long getEnabledConnectivityManagerFeatures();
 
     boolean isConnectivityServiceFeatureEnabledForTesting(String featureFlag);
-
-    oneway void registerQuicConnectionClosePayload(in ParcelFileDescriptor pfd, in byte[] payload);
-    oneway void unregisterQuicConnectionClosePayload(in ParcelFileDescriptor pfd);
 }
diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index 7f317930a4..45b431f1e7 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -156,7 +156,6 @@ import static com.android.net.module.util.PermissionUtils.enforceNetworkStackPer
 import static com.android.net.module.util.PermissionUtils.hasAnyPermissionOf;
 import static com.android.server.ConnectivityStatsLog.CONNECTIVITY_STATE_SAMPLE;
 import static com.android.server.connectivity.ConnectivityFlags.CELLULAR_DATA_INACTIVITY_TIMEOUT;
-import static com.android.server.connectivity.ConnectivityFlags.CLOSE_QUIC_CONNECTION;
 import static com.android.server.connectivity.ConnectivityFlags.DELAY_DESTROY_SOCKETS;
 import static com.android.server.connectivity.ConnectivityFlags.INGRESS_TO_VPN_ADDRESS_FILTERING;
 import static com.android.server.connectivity.ConnectivityFlags.NAMESPACE_TETHERING_BOOT;
@@ -390,7 +389,6 @@ import com.android.server.connectivity.PermissionMonitor;
 import com.android.server.connectivity.ProfileNetworkPreferenceInfo;
 import com.android.server.connectivity.ProxyTracker;
 import com.android.server.connectivity.QosCallbackTracker;
-import com.android.server.connectivity.QuicConnectionCloser;
 import com.android.server.connectivity.SatelliteAccessController;
 import com.android.server.connectivity.UidRangeUtils;
 import com.android.server.connectivity.VpnNetworkPreferenceInfo;
@@ -1106,13 +1104,6 @@ public class ConnectivityService extends IConnectivityManager.Stub {
     // Flag to drop packets to VPN addresses ingressing via non-VPN interfaces.
     private final boolean mIngressToVpnAddressFiltering;
 
-    // Flag to close QUIC connection for registered sockets when apps lose network access.
-    private final boolean mCloseQuicConnection;
-
-    // This is null if mCloseQuicConnection is false
-    @Nullable
-    private final QuicConnectionCloser mQuicConnectionCloser;
-
     /**
      * Implements support for the legacy "one network per network type" model.
      *
@@ -1834,14 +1825,6 @@ public class ConnectivityService extends IConnectivityManager.Stub {
             handler.sendMessageDelayed(
                     handler.obtainMessage(EVENT_INITIAL_EVALUATION_TIMEOUT, network), delayMs);
         }
-
-        /**
-         * Create {@link QuicConnectionCloser}.
-         */
-        public QuicConnectionCloser makeQuicConnectionCloser(
-                final SparseArray<NetworkAgentInfo> networkForNetId, final Handler handler) {
-            return new QuicConnectionCloser(networkForNetId, handler);
-        }
     }
 
     public ConnectivityService(Context context) {
@@ -2150,13 +2133,6 @@ public class ConnectivityService extends IConnectivityManager.Stub {
                 && mDeps.isFeatureNotChickenedOut(mContext, INGRESS_TO_VPN_ADDRESS_FILTERING);
 
         mL2capNetworkProvider = mDeps.makeL2capNetworkProvider(mContext);
-
-        mCloseQuicConnection = mDeps.isFeatureEnabled(context, CLOSE_QUIC_CONNECTION);
-        if (mCloseQuicConnection) {
-            mQuicConnectionCloser = mDeps.makeQuicConnectionCloser(mNetworkForNetId, mHandler);
-        } else {
-            mQuicConnectionCloser = null;
-        }
     }
 
     /**
@@ -3711,11 +3687,6 @@ public class ConnectivityService extends IConnectivityManager.Stub {
         } catch (SocketException | InterruptedIOException | ErrnoException e) {
             loge("Failed to destroy sockets: " + e);
         }
-
-        if (mCloseQuicConnection) {
-            mQuicConnectionCloser.closeQuicConnectionByUids(uids);
-        }
-
         mDestroySocketPendingUids.clear();
     }
 
@@ -4545,12 +4516,6 @@ public class ConnectivityService extends IConnectivityManager.Stub {
         mNetworkActivityTracker.dump(pw);
         pw.decreaseIndent();
 
-        pw.println();
-        pw.println("Close QUIC connection: " + mCloseQuicConnection);
-        if (mCloseQuicConnection) {
-            mQuicConnectionCloser.dump(pw);
-        }
-
         pw.println();
         pw.println("Multicast routing supported: " +
                 (mMulticastRoutingCoordinatorService != null));
@@ -15160,33 +15125,8 @@ public class ConnectivityService extends IConnectivityManager.Stub {
                 return mIngressToVpnAddressFiltering;
             case QUEUE_NETWORK_AGENT_EVENTS_IN_SYSTEM_SERVER:
                 return mQueueNetworkAgentEventsInSystemServer;
-            case CLOSE_QUIC_CONNECTION:
-                return mCloseQuicConnection;
             default:
                 throw new IllegalArgumentException("Unknown flag: " + featureFlag);
         }
     }
-
-    @Override
-    public void registerQuicConnectionClosePayload(final ParcelFileDescriptor pfd,
-            final byte[] payload) {
-        if (!mCloseQuicConnection) {
-            IoUtils.closeQuietly(pfd);
-            return;
-        }
-        // pfd is closed by registerQuicConnectionClosePayload
-        mQuicConnectionCloser.registerQuicConnectionClosePayload(mDeps.getCallingUid(),
-                pfd, payload);
-    }
-
-    @Override
-    public void unregisterQuicConnectionClosePayload(final ParcelFileDescriptor pfd) {
-        if (!mCloseQuicConnection) {
-            IoUtils.closeQuietly(pfd);
-            return;
-        }
-        // pfd is closed by unregisterQuicConnectionClosePayload
-        mQuicConnectionCloser.unregisterQuicConnectionClosePayload(pfd);
-    }
-
 }
diff --git a/service/src/com/android/server/connectivity/ConnectivityFlags.java b/service/src/com/android/server/connectivity/ConnectivityFlags.java
index fd24951049..74bd2351ac 100644
--- a/service/src/com/android/server/connectivity/ConnectivityFlags.java
+++ b/service/src/com/android/server/connectivity/ConnectivityFlags.java
@@ -65,8 +65,6 @@ public final class ConnectivityFlags {
     public static final String QUEUE_NETWORK_AGENT_EVENTS_IN_SYSTEM_SERVER =
             "queue_network_agent_events_in_system_server";
 
-    public static final String CLOSE_QUIC_CONNECTION = "close_quic_connection";
-
     private boolean mNoRematchAllRequestsOnRegister;
 
     /**
diff --git a/service/src/com/android/server/connectivity/QuicConnectionCloser.java b/service/src/com/android/server/connectivity/QuicConnectionCloser.java
deleted file mode 100644
index ce5d61c92b..0000000000
--- a/service/src/com/android/server/connectivity/QuicConnectionCloser.java
+++ /dev/null
@@ -1,406 +0,0 @@
-/*
- * Copyright (C) 2025 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package com.android.server.connectivity;
-
-import static android.system.OsConstants.ENOENT;
-import static android.system.OsConstants.SOL_SOCKET;
-import static android.system.OsConstants.SO_SNDTIMEO;
-
-import android.annotation.NonNull;
-import android.net.Network;
-import android.net.NetworkUtils;
-import android.os.Handler;
-import android.os.ParcelFileDescriptor;
-import android.system.ErrnoException;
-import android.system.Os;
-import android.system.StructTimeval;
-import android.util.ArrayMap;
-import android.util.IndentingPrintWriter;
-import android.util.Log;
-import android.util.SparseArray;
-
-import com.android.internal.annotations.GuardedBy;
-import com.android.internal.annotations.VisibleForTesting;
-import com.android.net.module.util.HandlerUtils;
-import com.android.net.module.util.SharedLog;
-import com.android.net.module.util.SkDestroyListener;
-import com.android.net.module.util.netlink.InetDiagMessage;
-
-import libcore.io.IoUtils;
-
-import java.io.FileDescriptor;
-import java.io.IOException;
-import java.io.InterruptedIOException;
-import java.net.DatagramSocket;
-import java.net.InetSocketAddress;
-import java.net.SocketException;
-import java.util.Iterator;
-import java.util.Map;
-import java.util.Set;
-import java.util.function.Consumer;
-
-public class QuicConnectionCloser {
-    private static final String TAG = QuicConnectionCloser.class.getSimpleName();
-
-    private static final int SOCKET_WRITE_TIMEOUT_MS = 100;
-
-    // Map from socket cookie to QUIC connection close information
-    private final Map<Long, QuicConnectionCloseInfo>
-            mRegisteredQuicConnectionCloseInfos = new ArrayMap<>();
-
-    // The maximum number of QUIC connection close information entries that can be registered
-    // concurrently.
-    private static final int MAX_REGISTERED_QUIC_CONNECTION_CLOSE_INFO = 1000;
-
-    private final Handler mHandler;
-
-    // Reference to ConnectivityService#mNetworkForNetId, must be synchronized on itself.
-    // mHandler in this class is associated with the ConnectivityService handler thread.
-    // The only code that can update mNetworkForNetId runs on that thread, so no entries can be
-    // updated while the code in this class is running on mHandler thread.
-    @GuardedBy("mNetworkForNetId")
-    private final SparseArray<NetworkAgentInfo> mNetworkForNetId;
-
-    @NonNull
-    private final Dependencies mDeps;
-
-    /**
-     * Class to store the necessary information for closing a QUIC connection.
-     */
-    private static class QuicConnectionCloseInfo {
-        public final int uid;
-        public final int netId;
-        public final long cookie;
-        public final InetSocketAddress src;
-        public final InetSocketAddress dst;
-        public final byte[] payload;
-
-        QuicConnectionCloseInfo(int uid, int netId, long cookie, InetSocketAddress src,
-                InetSocketAddress dst, byte[] payload) {
-            this.uid = uid;
-            this.netId = netId;
-            this.cookie = cookie;
-            this.src = src;
-            this.dst = dst;
-            this.payload = payload;
-        }
-
-        @Override
-        public String toString() {
-            return "QuicConnectionCloseInfo{"
-                    + "uid: " + uid
-                    + ", netId: " + netId
-                    + ", cookie: " + cookie
-                    + ", src: " + src
-                    + ", dst: " + dst
-                    + ", payload length: " + payload.length
-                    + "}";
-        }
-    }
-
-    public static class Dependencies {
-        /**
-         * Send a UDP packet with the specified source and destination address and port over the
-         * specified network.
-         *
-         * @param network The {@link Network} over which the UDP packet will be sent.
-         * @param src     The source {@link InetSocketAddress} of the UDP packet to be sent.
-         * @param dst     The destination {@link InetSocketAddress} of the UDP packet to be sent.
-         * @param payload The UDP payload to be sent.
-         */
-        public void sendQuicConnectionClosePayload(final Network network,
-                final InetSocketAddress src, final InetSocketAddress dst, final byte[] payload)
-                throws IOException, ErrnoException {
-            final DatagramSocket socket = new DatagramSocket(src);
-            network.bindSocket(socket);
-            socket.connect(dst);
-            Os.setsockoptTimeval(socket.getFileDescriptor$(), SOL_SOCKET, SO_SNDTIMEO,
-                    StructTimeval.fromMillis(SOCKET_WRITE_TIMEOUT_MS));
-            Os.write(socket.getFileDescriptor$(), payload, 0 /* byteOffset */, payload.length);
-        }
-
-        /**
-         * Call {@link InetDiagMessage#destroyUdpSocket}
-         */
-        public void destroyUdpSocket(final InetSocketAddress src, final InetSocketAddress dst,
-                final long cookie)
-                throws SocketException, InterruptedIOException, ErrnoException {
-            InetDiagMessage.destroyUdpSocket(src, dst, 0 /* ifindex */, cookie);
-        }
-
-        /**
-         * Call {@link SkDestroyListener#makeSkDestroyListener}
-         */
-        public SkDestroyListener makeSkDestroyListener(final Consumer<InetDiagMessage> consumer,
-                final Handler handler) {
-            return SkDestroyListener.makeSkDestroyListener(consumer, false /* monitorTcpSocket */,
-                    true /* monitorUdpSocket */, handler, new SharedLog(TAG));
-        }
-
-        /**
-         * Call {@link NetworkUtils#getSocketCookie}
-         */
-        public long getSocketCookie(final FileDescriptor fd) throws ErrnoException {
-            return NetworkUtils.getSocketCookie(fd);
-        }
-
-        /**
-         * Call {@link Os#getsockoptInt}
-         */
-        public int getsockoptInt(final FileDescriptor fd, final int level, final int option)
-                throws ErrnoException {
-            return Os.getsockoptInt(fd, level, option);
-        }
-
-        /**
-         * Call {@link Os#getsockname}}
-         */
-        public InetSocketAddress getsockname(final FileDescriptor fd) throws ErrnoException {
-            return (InetSocketAddress) Os.getsockname(fd);
-        }
-
-        /**
-         * Call {@link Os#getpeername}
-         */
-        public InetSocketAddress getpeername(final FileDescriptor fd) throws ErrnoException {
-            return (InetSocketAddress) Os.getpeername(fd);
-        }
-    }
-
-    public QuicConnectionCloser(final SparseArray<NetworkAgentInfo> networkForNetId,
-            final Handler handler) {
-        this(networkForNetId, handler, new Dependencies());
-    }
-
-    @VisibleForTesting
-    public QuicConnectionCloser(final SparseArray<NetworkAgentInfo> networkForNetId,
-            final Handler handler, final Dependencies deps) {
-        mNetworkForNetId = networkForNetId;
-        mHandler = handler;
-        mDeps = deps;
-
-        // handleUdpSocketDestroy must be posted to the thread to avoid racing with
-        // handleUnregisterQuicConnectionCloseInfo, even though they both run on the same thread.
-        // Specifically, the following can happen:
-        // unregisterQuicConnectionClosePayload posts handleUnregisterQuicConnectionCloseInfo to
-        // the handler and then closes the fd.
-        // The close() will cause the kernel to enqueue a netlink message to the SkDestroyHandler's
-        // fd.
-        // It's possible that the MessageQueue of the handler sees both the SkDestroyHandler's fd
-        // and the MessageQueue fd go active at the same time, and chooses to run the netlink
-        // event first.
-        // As a result, handleUdpSocketDestroy runs before handleUnregisterQuicConnectionCloseInfo,
-        // and the code incorrectly sends a close packet for a socket that the app has already
-        // unregistered.
-        // Posting handleUdpSocketDestroy to the handler ensures that it always runs after
-        // handleUnregisterQuicConnectionCloseInfo. It doesn't matter if the
-        // handleUdpSocketDestroy is delayed, because it will only send a packet if
-        // mRegisteredQuicConnectionCloseInfos contains the socket cookie, and socket cookies are
-        // never reused.
-        final SkDestroyListener udpSkDestroyListener = mDeps.makeSkDestroyListener(
-                (inetDiagMessage) -> handler.post(() -> handleUdpSocketDestroy(inetDiagMessage)),
-                handler);
-        handler.post(udpSkDestroyListener::start);
-    }
-
-    private void ensureRunningOnHandlerThread() {
-        HandlerUtils.ensureRunningOnHandlerThread(mHandler);
-    }
-
-    /**
-     * Close registered QUIC connection by uids
-     *
-     * @param uids target uids to close QUIC connections
-     */
-    public void closeQuicConnectionByUids(final Set<Integer> uids) {
-        ensureRunningOnHandlerThread();
-
-        for (Iterator<Map.Entry<Long, QuicConnectionCloseInfo>> it =
-                mRegisteredQuicConnectionCloseInfos.entrySet().iterator(); it.hasNext();) {
-            final QuicConnectionCloseInfo info = it.next().getValue();
-            if (uids.contains(info.uid)) {
-                closeQuicConnection(info, true /* destroySocket */);
-                it.remove();
-            }
-        }
-    }
-
-    private NetworkAgentInfo getNetworkAgentInfoForNetId(int netId) {
-        synchronized (mNetworkForNetId) {
-            return mNetworkForNetId.get(netId);
-        }
-    }
-
-    private void closeQuicConnection(final QuicConnectionCloseInfo info,
-            final boolean destroySocket) {
-        ensureRunningOnHandlerThread();
-
-        Log.d(TAG, "Close QUIC socket for " + info + ", destroySocket=" + destroySocket);
-        final NetworkAgentInfo nai = getNetworkAgentInfoForNetId(info.netId);
-        if (nai == null || !nai.linkProperties.getAddresses().contains(info.src.getAddress())) {
-            // The device should not send a packet with an unused source address.
-            return;
-        }
-
-        if (destroySocket) {
-            try {
-                mDeps.destroyUdpSocket(info.src, info.dst, info.cookie);
-            } catch (ErrnoException | SocketException | InterruptedIOException e) {
-                if (e instanceof ErrnoException && ((ErrnoException) e).errno == ENOENT) {
-                    // This can happen if the socket is already closed, but unregister message is
-                    // not processed yet.
-                    return;
-                }
-                Log.e(TAG, "Failed to destroy QUIC socket for " + info + ": " + e);
-                return;
-            }
-        }
-
-        try {
-            mDeps.sendQuicConnectionClosePayload(nai.network(), info.src, info.dst, info.payload);
-        } catch (ErrnoException | IOException e) {
-            Log.e(TAG, "Failed to send registered QUIC connection close payload for "
-                    + info + ": " + e);
-        }
-    }
-
-    /**
-     * Close QUIC connection if the registered socket was destroyed
-     *
-     * @param inetDiagMessage {@link InetDiagMessage} received from kernel
-     */
-    private void handleUdpSocketDestroy(final InetDiagMessage inetDiagMessage) {
-        ensureRunningOnHandlerThread();
-
-        final long cookie = inetDiagMessage.inetDiagMsg.id.cookie;
-        final QuicConnectionCloseInfo info = mRegisteredQuicConnectionCloseInfos.remove(cookie);
-        if (info == null) {
-            // Destroyed socket is not registered or already unregistered.
-            return;
-        }
-
-        // App registered a QUIC connection close payload and this socket, but the socket was
-        // closed before the socket was unregistered.
-        // This can happen if the app crashes or is killed.
-        closeQuicConnection(info, false /* destroySocket */);
-    }
-
-    /**
-     * Register the QUIC connection close information
-     *
-     * @param info {@link QuicConnectionCloseInfo} to register
-     */
-    private void handleRegisterQuicConnectionCloseInfo(final QuicConnectionCloseInfo info) {
-        ensureRunningOnHandlerThread();
-
-        if (mRegisteredQuicConnectionCloseInfos.size()
-                >= MAX_REGISTERED_QUIC_CONNECTION_CLOSE_INFO) {
-            Log.e(TAG, "Failed to register QUIC connection close information."
-                    + " number of registered information exceeded "
-                    + MAX_REGISTERED_QUIC_CONNECTION_CLOSE_INFO);
-            return;
-        }
-        mRegisteredQuicConnectionCloseInfos.put(info.cookie, info);
-    }
-
-    // TODO: Use OsConstants.SO_MARK once this API is available
-    private static final int SO_MARK = 36;
-
-    /**
-     * Register QUIC socket and connection close payload
-     *
-     * @param uid The uid of the socket owner
-     * @param pfd The {@link ParcelFileDescriptor} for the connected UDP socket.
-     * @param payload The UDP payload that can close QUIC connection.
-     */
-    public void registerQuicConnectionClosePayload(final int uid, final ParcelFileDescriptor pfd,
-            final byte[] payload) {
-        try {
-            final FileDescriptor fd = pfd.getFileDescriptor();
-            // See FWMARK_NET_ID_MASK in Fwmark.h
-            final int netId = mDeps.getsockoptInt(fd, SOL_SOCKET, SO_MARK) & 0xffff;
-            // The peer name could change if the socket is reconnected to a different server.
-            // But, it is the caller's responsibility to avoid this, as explicitly stated in the
-            // Javadoc of ConnectivityManager#registerQuicConnectionClosePayload.
-            final QuicConnectionCloseInfo info = new QuicConnectionCloseInfo(
-                    uid,
-                    netId,
-                    mDeps.getSocketCookie(fd),
-                    mDeps.getsockname(fd),
-                    mDeps.getpeername(fd),
-                    payload);
-            mHandler.post(() -> handleRegisterQuicConnectionCloseInfo(info));
-        } catch (ErrnoException e) {
-            Log.e(TAG, "Failed to register QUIC connection close information", e);
-        } finally {
-            // |pfd| must remain open until the message is posted to the handler thread, because
-            // doing so ensures that the socket is not closed even if the app calls close().
-            // Keeping it open avoids the following threading issue with SkDestroyListener :
-            // If the PFD was closed before posting the message, then SkDestroyListener might
-            // get a "socket destroyed" message from Netlink immediately and post to the handler
-            // thread before this method posts its own message, resulting in a leak of the
-            // mRegisteredQuicConnectionCloseInfo entry.
-            // While the PFD is held, Netlink will not send the socket destroy message to
-            // SkDestroyListener, and thus the message posted by SkDestroyListener as
-            // a reaction to it will be processed after the message posted by this method.
-            IoUtils.closeQuietly(pfd);
-        }
-    }
-
-    /**
-     * Unregister the QUIC connection close information
-     *
-     * @param cookie cookie of the socket whose connection close information should be unregistered
-     */
-    private void handleUnregisterQuicConnectionCloseInfo(final long cookie) {
-        ensureRunningOnHandlerThread();
-
-        mRegisteredQuicConnectionCloseInfos.remove(cookie);
-    }
-
-    /**
-     * Unregister the QUIC socket
-     *
-     * @param pfd The {@link ParcelFileDescriptor} for the UDP socket.
-     */
-    public void unregisterQuicConnectionClosePayload(final ParcelFileDescriptor pfd) {
-        try {
-            final long cookie = mDeps.getSocketCookie(pfd.getFileDescriptor());
-            mHandler.post(() -> handleUnregisterQuicConnectionCloseInfo(cookie));
-        } catch (ErrnoException e) {
-            Log.e(TAG, "Failed to unregister QUIC connection close information: " + e);
-        } finally {
-            // |pfd| must be closed after posting the message to the handler thread to avoid the
-            // threading issue with SkDestroyListener.
-            // See the comment in registerQuicConnectionClosePayload.
-            IoUtils.closeQuietly(pfd);
-        }
-    }
-
-    /**
-     * Dump QUIC connection closer information
-     */
-    public void dump(final IndentingPrintWriter pw) {
-        pw.println("Registered QUIC connection close information: "
-                + mRegisteredQuicConnectionCloseInfos.size());
-        pw.increaseIndent();
-        for (QuicConnectionCloseInfo info: mRegisteredQuicConnectionCloseInfos.values()) {
-            pw.println(info);
-        }
-        pw.decreaseIndent();
-    }
-}
diff --git a/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java b/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
index e20e457b01..87c2b9e5d1 100644
--- a/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
+++ b/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
@@ -21,7 +21,6 @@ import static android.Manifest.permission.ACCESS_FINE_LOCATION;
 import static android.Manifest.permission.ACCESS_NETWORK_STATE;
 import static android.Manifest.permission.CONNECTIVITY_INTERNAL;
 import static android.Manifest.permission.CONNECTIVITY_USE_RESTRICTED_NETWORKS;
-import static android.Manifest.permission.MANAGE_TEST_NETWORKS;
 import static android.Manifest.permission.NETWORK_FACTORY;
 import static android.Manifest.permission.NETWORK_SETTINGS;
 import static android.Manifest.permission.NETWORK_SETUP_WIZARD;
@@ -101,11 +100,6 @@ import static android.provider.Settings.Global.NETWORK_METERED_MULTIPATH_PREFERE
 import static android.system.OsConstants.AF_INET;
 import static android.system.OsConstants.AF_INET6;
 import static android.system.OsConstants.AF_UNSPEC;
-import static android.system.OsConstants.ECONNABORTED;
-import static android.system.OsConstants.EDESTADDRREQ;
-import static android.system.OsConstants.IPPROTO_UDP;
-import static android.system.OsConstants.POLLIN;
-import static android.system.OsConstants.SOCK_DGRAM;
 
 import static com.android.compatibility.common.util.SystemUtil.callWithShellPermissionIdentity;
 import static com.android.compatibility.common.util.SystemUtil.runShellCommand;
@@ -188,9 +182,7 @@ import android.os.ConditionVariable;
 import android.os.Handler;
 import android.os.Looper;
 import android.os.MessageQueue;
-import android.os.ParcelFileDescriptor;
 import android.os.Process;
-import android.os.RemoteException;
 import android.os.ServiceManager;
 import android.os.SystemClock;
 import android.os.UserHandle;
@@ -198,9 +190,6 @@ import android.os.VintfRuntimeInfo;
 import android.platform.test.annotations.AppModeFull;
 import android.provider.DeviceConfig;
 import android.provider.Settings;
-import android.system.ErrnoException;
-import android.system.Os;
-import android.system.StructPollfd;
 import android.telephony.SubscriptionManager;
 import android.telephony.TelephonyManager;
 import android.text.TextUtils;
@@ -216,10 +205,6 @@ import com.android.internal.util.ArrayUtils;
 import com.android.modules.utils.build.SdkLevel;
 import com.android.net.module.util.CollectionUtils;
 import com.android.net.module.util.DnsPacket;
-import com.android.net.module.util.Struct;
-import com.android.net.module.util.structs.Ipv4Header;
-import com.android.net.module.util.structs.Ipv6Header;
-import com.android.net.module.util.structs.UdpHeader;
 import com.android.networkstack.apishim.ConnectivityManagerShimImpl;
 import com.android.networkstack.apishim.ConstantsShim;
 import com.android.networkstack.apishim.NetworkInformationShimImpl;
@@ -243,7 +228,6 @@ import com.android.testutils.TestableNetworkCallback;
 
 import junit.framework.AssertionFailedError;
 
-import libcore.io.IoUtils;
 import libcore.io.Streams;
 
 import org.junit.After;
@@ -269,7 +253,6 @@ import java.net.MalformedURLException;
 import java.net.Socket;
 import java.net.SocketException;
 import java.net.URL;
-import java.nio.ByteBuffer;
 import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
 import java.util.Arrays;
@@ -369,15 +352,6 @@ public class ConnectivityManagerTest {
     // Re-connecting to the AP, obtaining an IP address, revalidating can take a long time
     private static final long WIFI_CONNECT_TIMEOUT_MS = 60_000L;
 
-    // Timeout for waiting the QUIC connection close information registration/unregistration
-    private static final long QUIC_CONNECTION_CLOSE_INFO_REGISTRATION_TIMEOUT_MS = 500L;
-
-    // Timeout for waiting the QUIC connection close packet to be sent
-    private static final long QUIC_CONNECTION_CLOSE_PACKET_TIMEOUT_MS = 200L;
-
-    // Name of the feature flag for closing quic connection
-    private static final String CLOSE_QUIC_CONNECTION = "close_quic_connection";
-
     private Context mContext;
     private Instrumentation mInstrumentation;
     private ConnectivityManager mCm;
@@ -2415,8 +2389,8 @@ public class ConnectivityManagerTest {
         waitForAvailable(cb);
     }
 
-    private CallbackEntry.Available waitForAvailable(@NonNull final TestableNetworkCallback cb) {
-        return cb.eventuallyExpect(CallbackEntry.AVAILABLE, NETWORK_CALLBACK_TIMEOUT_MS,
+    private void waitForAvailable(@NonNull final TestableNetworkCallback cb) {
+        cb.eventuallyExpect(CallbackEntry.AVAILABLE, NETWORK_CALLBACK_TIMEOUT_MS,
                 c -> c instanceof CallbackEntry.Available);
     }
 
@@ -4157,302 +4131,4 @@ public class ConnectivityManagerTest {
         assertThrows(UnsupportedOperationException.class, () -> mCm.tether("iface"));
         assertThrows(UnsupportedOperationException.class, () -> mCm.untether("iface"));
     }
-
-    private ParcelFileDescriptor setupTestNetworkAndGetFd() {
-        return runWithShellPermissionIdentity(() -> {
-            final TestNetworkManager tnm = mContext.getSystemService(TestNetworkManager.class);
-            final List<LinkAddress> linkAddresses = List.of(new LinkAddress("192.0.2.2/24"),
-                    new LinkAddress("2001:db8:1:2::2/64"));
-            final TestNetworkInterface iface = tnm.createTunInterface(linkAddresses);
-            tnm.setupTestNetwork(iface.getInterfaceName(), new Binder());
-            return iface.getFileDescriptor();
-        }, MANAGE_TEST_NETWORKS);
-    }
-
-    private Network getTestNetwork() {
-        final TestableNetworkCallback callback = networkCallbackRule.requestNetwork(
-                new NetworkRequest.Builder()
-                        .removeCapability(NetworkCapabilities.NET_CAPABILITY_NOT_VPN)
-                        .removeCapability(NetworkCapabilities.NET_CAPABILITY_TRUSTED)
-                        .addTransportType(TRANSPORT_TEST)
-                        .build()
-        );
-        return waitForAvailable(callback).getNetwork();
-    }
-
-    private void waitForQuicConnectionCloseInfoRegistration(final int myUid,
-            final boolean expectRegistered)
-            throws ErrnoException, RemoteException, InterruptedException {
-        final long timeout = SystemClock.elapsedRealtime()
-                + QUIC_CONNECTION_CLOSE_INFO_REGISTRATION_TIMEOUT_MS;
-        while (timeout > SystemClock.elapsedRealtime()) {
-            if (DumpTestUtils.dumpServiceWithShellPermission(
-                    Context.CONNECTIVITY_SERVICE, "--short")
-                    .contains("QuicConnectionCloseInfo{uid: " + myUid) == expectRegistered) {
-                return;
-            }
-            Thread.sleep(50);
-        }
-        fail("Failed to register/unregister QUIC connection close information in "
-                + QUIC_CONNECTION_CLOSE_INFO_REGISTRATION_TIMEOUT_MS
-                + "ms, expectRegistered=" + expectRegistered);
-    }
-
-    private void doTestRegisterQuicConnectionClosePayload(final boolean isV6,
-            final boolean unregister, final boolean closeSocket, final boolean blockNetwork,
-            final boolean expectPacketSent) throws Exception {
-        final InetAddress dstAddress = isV6 ? InetAddresses.parseNumericAddress("2001:db8:1:2::3")
-                : InetAddresses.parseNumericAddress("192.0.2.3");
-        final InetSocketAddress dstSockAddress = new InetSocketAddress(dstAddress, 443);
-        final int myUid = Process.myUid();
-
-        final ParcelFileDescriptor tunFd = setupTestNetworkAndGetFd();
-        final Network testNetwork = getTestNetwork();
-
-        // Firewall chain status will be restored after the test.
-        final boolean wasChainEnabled = runWithShellPermissionIdentity(() ->
-                mCm.getFirewallChainEnabled(FIREWALL_CHAIN_BACKGROUND), NETWORK_SETTINGS);
-        final int previousUidFirewallRule = runWithShellPermissionIdentity(() ->
-                mCm.getUidFirewallRule(FIREWALL_CHAIN_BACKGROUND, myUid), NETWORK_SETTINGS);
-        runWithShellPermissionIdentity(() -> {
-            mCm.setFirewallChainEnabled(FIREWALL_CHAIN_BACKGROUND, true /* enable */);
-            mCm.setUidFirewallRule(FIREWALL_CHAIN_BACKGROUND, myUid, FIREWALL_RULE_ALLOW);
-        }, NETWORK_SETTINGS);
-
-        final FileDescriptor sock = Os.socket(isV6 ? AF_INET6 : AF_INET, SOCK_DGRAM, IPPROTO_UDP);
-        final ParcelFileDescriptor pfd = ParcelFileDescriptor.fromFd(sock.getInt$());
-        testNetwork.bindSocket(sock);
-        Os.connect(sock, dstSockAddress);
-        final InetSocketAddress srcSockAddress = (InetSocketAddress) Os.getsockname(sock);
-
-        testAndCleanup(() -> {
-            final Random random = new Random();
-            final byte[] payload = new byte[100];
-            random.nextBytes(payload);
-
-            // register/unregisterQuicConnectionClosePayload are oneway binder calls,
-            // while setUidFirewallRule is a two-way binder call. So if
-            // setUidFirewallRule is called immediately after them, it's possible that
-            // setUidFirewallRule could be processed before them.
-            // To ensure that uid networking is blocked after the connection close information
-            // is registered/unregistered, wait for the registration/unregistration.
-            mCm.registerQuicConnectionClosePayload(pfd, payload);
-            waitForQuicConnectionCloseInfoRegistration(myUid, true /* expectRegistered */);
-            if (unregister) {
-                mCm.unregisterQuicConnectionClosePayload(pfd);
-                waitForQuicConnectionCloseInfoRegistration(myUid, false /* expectRegistered */);
-            }
-
-            if (closeSocket) {
-                Os.close(sock);
-                pfd.close();
-            }
-
-            if (blockNetwork) {
-                runWithShellPermissionIdentity(() ->
-                        mCm.setUidFirewallRule(FIREWALL_CHAIN_BACKGROUND, myUid,
-                                FIREWALL_RULE_DENY), NETWORK_SETTINGS);
-            }
-
-            final long timeout = SystemClock.elapsedRealtime()
-                    + QUIC_CONNECTION_CLOSE_PACKET_TIMEOUT_MS;
-            long remainingTimeMs;
-            while ((remainingTimeMs = timeout - SystemClock.elapsedRealtime()) > 0) {
-                final StructPollfd pollfd = new StructPollfd();
-                pollfd.events = (short) POLLIN;
-                pollfd.fd = tunFd.getFileDescriptor();
-                final int ret = Os.poll(new StructPollfd[] { pollfd }, (int) remainingTimeMs);
-                if (ret == 0) {
-                    continue;
-                }
-
-                final byte[] recvData = new byte[200];
-                final int readSize = Os.read(tunFd.getFileDescriptor(), recvData,
-                        0 /* byteOffset */, recvData.length);
-
-                if (readSize < payload.length
-                        || !Arrays.equals(payload, 0, payload.length,
-                        recvData, readSize - payload.length, readSize)) {
-                    continue;
-                }
-                // If the control comes here then the payload was received, otherwise poll would
-                // have returned 0 or the test above would have matched it and gone to continue.
-                if (!expectPacketSent) {
-                    fail("Unexpectedly received the QUIC connection close packet.");
-                }
-
-                final ByteBuffer buf = ByteBuffer.wrap(recvData, 0 /* offset */, readSize);
-                if (isV6) {
-                    final Ipv6Header header = Struct.parse(Ipv6Header.class, buf);
-                    assertEquals(srcSockAddress.getAddress(), header.srcIp);
-                    assertEquals(dstSockAddress.getAddress(), header.dstIp);
-                } else {
-                    final Ipv4Header header = Struct.parse(Ipv4Header.class, buf);
-                    assertEquals(srcSockAddress.getAddress(), header.srcIp);
-                    assertEquals(dstSockAddress.getAddress(), header.dstIp);
-                }
-                final UdpHeader udpHeader = Struct.parse(UdpHeader.class, buf);
-                assertEquals(srcSockAddress.getPort(), udpHeader.srcPort);
-                assertEquals(dstSockAddress.getPort(), udpHeader.dstPort);
-                assertEquals(payload.length + Struct.getSize(UdpHeader.class), udpHeader.length);
-
-                if (!closeSocket) {
-                    // After the socket is destroyed and QUIC connection is closed by
-                    // ConnectivityService, writing to the UDP socket should throw.
-                    try {
-                        Os.write(sock, payload, 0 /* byteOffset */, payload.length);
-                        fail("Write to the destroyed socket must throw.");
-                    } catch (ErrnoException e) {
-                        assertEquals(EDESTADDRREQ, e.errno);
-                    }
-                    try {
-                        Os.sendto(sock, payload, 0 /* byteOffset */,
-                                payload.length, 0 /* flags */, dstSockAddress);
-                        fail("Sendto with the destroyed socket must throw.");
-                    } catch (ErrnoException e) {
-                        assertEquals(ECONNABORTED, e.errno);
-                    }
-                }
-                return;
-            }
-            if (expectPacketSent) {
-                fail("Did not receive the QUIC connection close packet.");
-            }
-        }, /* cleanup */ () -> {
-            runWithShellPermissionIdentity(() -> {
-                mContext.getSystemService(TestNetworkManager.class).teardownTestNetwork(
-                        testNetwork);
-            }, MANAGE_TEST_NETWORKS);
-            IoUtils.closeQuietly(tunFd);
-            IoUtils.closeQuietly(sock);
-            IoUtils.closeQuietly(pfd);
-        }, /* cleanup */ () -> {
-            // Restore firewall chain global status
-            runWithShellPermissionIdentity(() -> {
-                mCm.setFirewallChainEnabled(FIREWALL_CHAIN_BACKGROUND, wasChainEnabled);
-            }, NETWORK_SETTINGS);
-        }, /* cleanup */ () -> {
-            // Restore firewall chain status for myUid
-            runWithShellPermissionIdentity(() -> {
-                try {
-                    mCm.setUidFirewallRule(FIREWALL_CHAIN_BACKGROUND, myUid,
-                            previousUidFirewallRule);
-                } catch (IllegalStateException ignored) {
-                    // Removing match causes an exception when the rule entry for the uid does
-                    // not exist. But this is fine and can be ignored.
-                }
-            }, NETWORK_SETTINGS);
-        });
-    }
-
-    @Test
-    @IgnoreUpTo(Build.VERSION_CODES.R)
-    @ConnectivityModuleTest
-    @AppModeFull(reason = "Cannot create test network in instant app mode")
-    public void testRegisterQuicConnectionClosePayload_blockNetwork() throws Exception {
-        assumeTrue(mCm.isConnectivityServiceFeatureEnabledForTesting(CLOSE_QUIC_CONNECTION));
-
-        // Network is blocked while the connection close payload is registered.
-        // Packet should be sent.
-        doTestRegisterQuicConnectionClosePayload(
-                false /* isV6 */, false /* unregister */, false /* closeSocket */,
-                true /* blockNetwork */, true /* expectPacketSent */);
-        doTestRegisterQuicConnectionClosePayload(
-                true /* isV6 */, false /* unregister */, false /* closeSocket */,
-                true /* blockNetwork */, true /* expectPacketSent */);
-
-        // Network is blocked after the connection close payload is unregistered.
-        // Packet should not be sent.
-        doTestRegisterQuicConnectionClosePayload(
-                false /* isV6 */, true /* unregister */, false /* closeSocket */,
-                true /* blockNetwork */, false /* expectPacketSent */);
-        doTestRegisterQuicConnectionClosePayload(
-                true /* isV6 */, true /* unregister */, false /* closeSocket */,
-                true /* blockNetwork */, false /* expectPacketSent */);
-    }
-
-    @Test
-    @IgnoreUpTo(Build.VERSION_CODES.R)
-    @ConnectivityModuleTest
-    @AppModeFull(reason = "Cannot create test network in instant app mode")
-    public void testRegisterQuicConnectionClosePayload_closeSocket() throws Exception {
-        assumeTrue(mCm.isConnectivityServiceFeatureEnabledForTesting(CLOSE_QUIC_CONNECTION));
-
-        // Registered socket is closed while the connection close payload is registered.
-        // Packet should be sent. This simulates that apps crash or are killed.
-        doTestRegisterQuicConnectionClosePayload(
-                false /* isV6 */, false /* unregister */, true /* closeSocket */,
-                false /* blockNetwork */, true /* expectPacketSent */);
-        doTestRegisterQuicConnectionClosePayload(
-                true /* isV6 */, false /* unregister */, true /* closeSocket */,
-                false /* blockNetwork */, true /* expectPacketSent */);
-    }
-
-    /**
-     * Repeat register a connection close payload, unregister it, and then close the socket.
-     * The registered payload must not be sent because it is unregistered before the socket
-     * is closed.
-     * This test tries to detect threading issues between
-     * register/unregisterQuicConnectionClosePayload and socket destroy message handling.
-     */
-    @Test
-    @IgnoreUpTo(Build.VERSION_CODES.R)
-    @ConnectivityModuleTest
-    @AppModeFull(reason = "Cannot create test network in instant app mode")
-    public void testRegisterQuicConnectionClosePayload_closeSocketAfterUnregister()
-            throws Exception {
-        assumeTrue(mCm.isConnectivityServiceFeatureEnabledForTesting(CLOSE_QUIC_CONNECTION));
-
-        final ParcelFileDescriptor tunFd = setupTestNetworkAndGetFd();
-        final Network testNetwork = getTestNetwork();
-
-        final Random random = new Random();
-        final byte[] payload = new byte[100];
-        random.nextBytes(payload);
-
-        final InetSocketAddress dstSockAddress =
-                new InetSocketAddress(InetAddresses.parseNumericAddress("2001:db8:1:2::3"), 443);
-        for (int i = 0; i < 100; i++) {
-            final FileDescriptor sock = Os.socket(AF_INET6, SOCK_DGRAM, IPPROTO_UDP);
-            testNetwork.bindSocket(sock);
-            Os.connect(sock, dstSockAddress);
-
-            final ParcelFileDescriptor pfd = ParcelFileDescriptor.fromFd(sock.getInt$());
-            mCm.registerQuicConnectionClosePayload(pfd, payload);
-            mCm.unregisterQuicConnectionClosePayload(pfd);
-            Os.close(sock);
-            pfd.close();
-        }
-
-        testAndCleanup(() -> {
-            final long timeout = SystemClock.elapsedRealtime()
-                    + QUIC_CONNECTION_CLOSE_PACKET_TIMEOUT_MS;
-            long remainingTimeMs;
-            while ((remainingTimeMs = timeout - SystemClock.elapsedRealtime()) > 0) {
-                StructPollfd pollfd = new StructPollfd();
-                pollfd.events = (short) POLLIN;
-                pollfd.fd = tunFd.getFileDescriptor();
-                final int ret = Os.poll(new StructPollfd[]{pollfd}, (int) remainingTimeMs);
-                if (ret == 0) {
-                    continue;
-                }
-
-                final byte[] recvData = new byte[200];
-                final int readSize = Os.read(tunFd.getFileDescriptor(), recvData,
-                        0 /* byteOffset */, recvData.length);
-                if (readSize < payload.length
-                        || !Arrays.equals(payload, 0, payload.length,
-                        recvData, readSize - payload.length, readSize)) {
-                    continue;
-                }
-                fail("Unexpectedly received the QUIC connection close packet.");
-            }
-        }, /* cleanup */ () -> {
-            runWithShellPermissionIdentity(() -> {
-                mContext.getSystemService(TestNetworkManager.class).teardownTestNetwork(
-                        testNetwork);
-            }, MANAGE_TEST_NETWORKS);
-            IoUtils.closeQuietly(tunFd);
-        });
-    }
 }
diff --git a/tests/unit/java/com/android/server/ConnectivityServiceTest.java b/tests/unit/java/com/android/server/ConnectivityServiceTest.java
index bd26b95764..8c90e01086 100755
--- a/tests/unit/java/com/android/server/ConnectivityServiceTest.java
+++ b/tests/unit/java/com/android/server/ConnectivityServiceTest.java
@@ -2188,7 +2188,6 @@ public class ConnectivityServiceTest {
                 case ConnectivityFlags.USE_DECLARED_METHODS_FOR_CALLBACKS:
                 case ConnectivityFlags.QUEUE_CALLBACKS_FOR_FROZEN_APPS:
                 case ConnectivityFlags.BACKGROUND_FIREWALL_CHAIN:
-                case ConnectivityFlags.CLOSE_QUIC_CONNECTION:
                 case ConnectivityService.KEY_DESTROY_FROZEN_SOCKETS_VERSION:
                     return true;
                 default:
diff --git a/tests/unit/java/com/android/server/connectivity/QuicConnectionCloserTest.kt b/tests/unit/java/com/android/server/connectivity/QuicConnectionCloserTest.kt
deleted file mode 100644
index 9e1c090f2c..0000000000
--- a/tests/unit/java/com/android/server/connectivity/QuicConnectionCloserTest.kt
+++ /dev/null
@@ -1,232 +0,0 @@
-/*
- * Copyright (C) 2025 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package com.android.server.connectivity
-
-import android.net.InetAddresses
-import android.net.LinkAddress
-import android.net.LinkProperties
-import android.net.Network
-import android.net.TEST_IFACE
-import android.os.Build
-import android.os.Handler
-import android.os.Looper
-import android.os.ParcelFileDescriptor
-import android.system.OsConstants.SOL_SOCKET
-import android.util.SparseArray
-import com.android.net.module.util.SkDestroyListener
-import com.android.net.module.util.netlink.InetDiagMessage
-import com.android.net.module.util.netlink.StructInetDiagSockId
-import com.android.net.module.util.netlink.StructNlMsgHdr
-import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
-import com.android.testutils.DevSdkIgnoreRunner
-import com.android.testutils.visibleOnHandlerThread
-import java.net.InetSocketAddress
-import java.util.function.Consumer
-import org.junit.Test
-import org.junit.runner.RunWith
-import org.mockito.ArgumentCaptor
-import org.mockito.InOrder
-import org.mockito.Mockito.any
-import org.mockito.Mockito.anyLong
-import org.mockito.Mockito.doReturn
-import org.mockito.Mockito.eq
-import org.mockito.Mockito.inOrder
-import org.mockito.Mockito.mock
-import org.mockito.Mockito.never
-import org.mockito.Mockito.verify
-
-private const val TEST_UID = 1234
-private const val TEST_NETID = 789
-private const val TEST_SOCKET_COOKIE = 12321L
-
-// TODO: Use OsConstants.SO_MARK once this API is available
-private const val SO_MARK = 36
-
-private val TEST_SRC_ADDRESS = InetAddresses.parseNumericAddress("2001:db8:1:2::2")
-private val TEST_SRC_SOCKET_ADDRESS = InetSocketAddress(
-        TEST_SRC_ADDRESS,
-        1234
-)
-private val TEST_DST_SOCKET_ADDRESS = InetSocketAddress(
-        InetAddresses.parseNumericAddress("2001:db8:1:2::3"),
-        443
-)
-private val TEST_LP = LinkProperties().apply {
-    interfaceName = TEST_IFACE
-    addLinkAddress(LinkAddress(TEST_SRC_ADDRESS, 64))
-}
-private val TEST_NETWORK = Network(TEST_NETID)
-private val TEST_PAYLOAD = byteArrayOf(0, 1, 2, 3, 4, 5)
-
-@RunWith(DevSdkIgnoreRunner::class)
-@IgnoreUpTo(Build.VERSION_CODES.R)
-class QuicConnectionCloserTest {
-    private val pfd = mock(ParcelFileDescriptor::class.java)
-    private val skDestroyListener = mock(SkDestroyListener::class.java)
-    private val handler by lazy { Handler(Looper.getMainLooper()) }
-
-    private val mDeps = mock(QuicConnectionCloser.Dependencies::class.java).also {
-        doReturn(TEST_NETID).`when`(it).getsockoptInt(any(), eq(SOL_SOCKET), eq(SO_MARK))
-        doReturn(TEST_SOCKET_COOKIE).`when`(it).getSocketCookie(any())
-        doReturn(TEST_SRC_SOCKET_ADDRESS).`when`(it).getsockname(any())
-        doReturn(TEST_DST_SOCKET_ADDRESS).`when`(it).getpeername(any())
-        doReturn(skDestroyListener).`when`(it).makeSkDestroyListener(any(), any())
-    }
-
-    private val nai = mock(NetworkAgentInfo::class.java).also {
-        it.linkProperties = TEST_LP
-        doReturn(TEST_NETWORK).`when`(it).network()
-    }
-
-    private val networkForNetId = SparseArray<NetworkAgentInfo>().apply {
-        put(TEST_NETID, nai)
-    }
-
-    private val mQuicConnectionCloser = QuicConnectionCloser(networkForNetId, handler, mDeps)
-
-    private fun InOrder.expectDestroyUdpSocket() = verify(mDeps).destroyUdpSocket(
-            TEST_SRC_SOCKET_ADDRESS,
-            TEST_DST_SOCKET_ADDRESS,
-            TEST_SOCKET_COOKIE
-    )
-
-    private fun InOrder.assertNoDestroyUdpSocket() = verify(mDeps, never()).destroyUdpSocket(
-            any(),
-            any(),
-            anyLong()
-    )
-
-    private fun InOrder.expectSendQuicConnectionClosePayload() =
-            verify(mDeps).sendQuicConnectionClosePayload(
-                    TEST_NETWORK,
-                    TEST_SRC_SOCKET_ADDRESS,
-                    TEST_DST_SOCKET_ADDRESS,
-                    TEST_PAYLOAD
-            )
-
-    private fun InOrder.assertNoSendQuicConnectionClosePayload() =
-            verify(mDeps, never()).sendQuicConnectionClosePayload(
-                    any(),
-                    any(),
-                    any(),
-                    any()
-            )
-
-    @Test
-    fun testCloseQuicConnectionByUids() {
-        mQuicConnectionCloser.registerQuicConnectionClosePayload(TEST_UID, pfd, TEST_PAYLOAD)
-        visibleOnHandlerThread(handler) {
-            mQuicConnectionCloser.closeQuicConnectionByUids(setOf(TEST_UID))
-        }
-
-        val inOrder = inOrder(mDeps)
-        inOrder.expectDestroyUdpSocket()
-        inOrder.expectSendQuicConnectionClosePayload()
-    }
-
-    @Test
-    fun testCloseQuicConnectionByUids_unregisterQuicConnectionCloseInfo() {
-        mQuicConnectionCloser.registerQuicConnectionClosePayload(TEST_UID, pfd, TEST_PAYLOAD)
-        mQuicConnectionCloser.unregisterQuicConnectionClosePayload(pfd)
-        visibleOnHandlerThread(handler) {
-            mQuicConnectionCloser.closeQuicConnectionByUids(setOf(TEST_UID))
-        }
-
-        val inOrder = inOrder(mDeps)
-        inOrder.assertNoDestroyUdpSocket()
-        inOrder.assertNoSendQuicConnectionClosePayload()
-    }
-
-    @Test
-    fun testCloseQuicConnectionByUids_networkDisconnected() {
-        mQuicConnectionCloser.registerQuicConnectionClosePayload(TEST_UID, pfd, TEST_PAYLOAD)
-        // closeQuicConnectionByUids determines that the network is disconnected by
-        // checking if it's absent from the networkForNetId set.
-        synchronized (networkForNetId) {
-            networkForNetId.clear()
-        }
-        visibleOnHandlerThread(handler) {
-            mQuicConnectionCloser.closeQuicConnectionByUids(setOf(TEST_UID))
-        }
-
-        val inOrder = inOrder(mDeps)
-        inOrder.assertNoDestroyUdpSocket()
-        inOrder.assertNoSendQuicConnectionClosePayload()
-    }
-
-    @Test
-    fun testCloseQuicConnectionByUids_networkAddressChange() {
-        mQuicConnectionCloser.registerQuicConnectionClosePayload(TEST_UID, pfd, TEST_PAYLOAD)
-        // Update address to different address from TEST_SRC_SOCKET_ADDRESS
-        nai.linkProperties = LinkProperties().apply {
-            interfaceName = TEST_IFACE
-            addLinkAddress(LinkAddress(InetAddresses.parseNumericAddress("2001:db8:1:3::2"), 64))
-        }
-        visibleOnHandlerThread(handler) {
-            mQuicConnectionCloser.closeQuicConnectionByUids(setOf(TEST_UID))
-        }
-
-        val inOrder = inOrder(mDeps)
-        inOrder.assertNoDestroyUdpSocket()
-        inOrder.assertNoSendQuicConnectionClosePayload()
-    }
-
-    private fun getSkDestroyListenerCallback(): Consumer<InetDiagMessage> {
-        val captor = ArgumentCaptor.forClass(Consumer::class.java)
-                as ArgumentCaptor<Consumer<InetDiagMessage>>
-        verify(mDeps).makeSkDestroyListener(captor.capture(), any())
-        return captor.value
-    }
-
-    @Test
-    fun testHandleUdpSocketDestroy() {
-        mQuicConnectionCloser.registerQuicConnectionClosePayload(TEST_UID, pfd, TEST_PAYLOAD)
-
-        val inetDiagMessage = InetDiagMessage(StructNlMsgHdr())
-        inetDiagMessage.inetDiagMsg.id = StructInetDiagSockId(
-                TEST_SRC_SOCKET_ADDRESS,
-                TEST_DST_SOCKET_ADDRESS,
-                0 /* ifindex */,
-                TEST_SOCKET_COOKIE
-        )
-        getSkDestroyListenerCallback().accept(inetDiagMessage)
-
-        val inOrder = inOrder(mDeps)
-        // DestroyUdpSocket is not called since the socket is already closed
-        inOrder.assertNoDestroyUdpSocket()
-        inOrder.expectSendQuicConnectionClosePayload()
-    }
-
-    @Test
-    fun testHandleUdpSocketDestroy_unregisterBeforeSocketClose() {
-        mQuicConnectionCloser.registerQuicConnectionClosePayload(TEST_UID, pfd, TEST_PAYLOAD)
-        mQuicConnectionCloser.unregisterQuicConnectionClosePayload(pfd)
-
-        val inetDiagMessage = InetDiagMessage(StructNlMsgHdr())
-        inetDiagMessage.inetDiagMsg.id = StructInetDiagSockId(
-                TEST_SRC_SOCKET_ADDRESS,
-                TEST_DST_SOCKET_ADDRESS,
-                0 /* ifindex */,
-                TEST_SOCKET_COOKIE
-        )
-        getSkDestroyListenerCallback().accept(inetDiagMessage)
-
-        val inOrder = inOrder(mDeps)
-        inOrder.assertNoDestroyUdpSocket()
-        inOrder.assertNoSendQuicConnectionClosePayload()
-    }
-}
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSDestroySocketTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSDestroySocketTest.kt
index 56d934bf51..bc5be7865c 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSDestroySocketTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSDestroySocketTest.kt
@@ -155,6 +155,7 @@ class CSDestroySocketTest : CSTest() {
     @Test
     fun testReplaceFirewallChain() {
         val netdEventListener = getRegisteredNetdUnsolicitedEventListener()
+        val inOrder = inOrder(destroySocketsWrapper)
 
         val cellAgent = Agent(nc = cellNc(), lp = cellLp())
         cellAgent.connect()
@@ -192,8 +193,8 @@ class CSDestroySocketTest : CSTest() {
                 .`when`(bpfNetMaps).getUidNetworkingBlockedReasons(TEST_UID2)
         cm.replaceFirewallChain(FIREWALL_CHAIN_BACKGROUND, intArrayOf(TEST_UID2))
         waitForIdle()
-        verify(destroySocketsWrapper, never()).destroyLiveTcpSocketsByOwnerUids(setOf(TEST_UID))
-        verify(quicConnectionCloser, never()).closeQuicConnectionByUids(setOf(TEST_UID))
+        inOrder.verify(destroySocketsWrapper, never())
+                .destroyLiveTcpSocketsByOwnerUids(setOf(TEST_UID))
 
         netdEventListener.onInterfaceClassActivityChanged(
                 true, // isActive
@@ -202,8 +203,8 @@ class CSDestroySocketTest : CSTest() {
                 TEST_UID
         )
         waitForIdle()
-        verify(destroySocketsWrapper).destroyLiveTcpSocketsByOwnerUids(setOf(TEST_UID))
-        verify(quicConnectionCloser).closeQuicConnectionByUids(setOf(TEST_UID))
+        inOrder.verify(destroySocketsWrapper)
+                .destroyLiveTcpSocketsByOwnerUids(setOf(TEST_UID))
 
         cellAgent.disconnect()
     }
@@ -276,10 +277,8 @@ class CSDestroySocketTest : CSTest() {
 
         if (expectDestroySockets) {
             verify(destroySocketsWrapper).destroyLiveTcpSocketsByOwnerUids(setOf(TEST_UID))
-            verify(quicConnectionCloser).closeQuicConnectionByUids(setOf(TEST_UID))
         } else {
             verify(destroySocketsWrapper, never()).destroyLiveTcpSocketsByOwnerUids(setOf(TEST_UID))
-            verify(quicConnectionCloser, never()).closeQuicConnectionByUids(setOf(TEST_UID))
         }
     }
 
diff --git a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
index d7ecfd6159..5c55483ee9 100644
--- a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
@@ -58,7 +58,6 @@ import android.permission.PermissionManager.PermissionResult
 import android.telephony.SubscriptionManager
 import android.telephony.TelephonyManager
 import android.testing.TestableContext
-import android.util.SparseArray
 import androidx.test.platform.app.InstrumentationRegistry
 import com.android.internal.app.IBatteryStats
 import com.android.internal.util.test.BroadcastInterceptingContext
@@ -73,11 +72,9 @@ import com.android.server.connectivity.InterfaceTracker
 import com.android.server.connectivity.MulticastRoutingCoordinatorService
 import com.android.server.connectivity.MultinetworkPolicyTracker
 import com.android.server.connectivity.MultinetworkPolicyTrackerTestDependencies
-import com.android.server.connectivity.NetworkAgentInfo
 import com.android.server.connectivity.NetworkRequestStateStatsMetrics
 import com.android.server.connectivity.PermissionMonitor
 import com.android.server.connectivity.ProxyTracker
-import com.android.server.connectivity.QuicConnectionCloser
 import com.android.server.connectivity.SatelliteAccessController
 import com.android.testutils.visibleOnHandlerThread
 import com.android.testutils.waitForIdle
@@ -174,7 +171,6 @@ open class CSTest {
         it[ConnectivityFlags.USE_DECLARED_METHODS_FOR_CALLBACKS] = true
         it[ConnectivityFlags.QUEUE_CALLBACKS_FOR_FROZEN_APPS] = true
         it[ConnectivityFlags.QUEUE_NETWORK_AGENT_EVENTS_IN_SYSTEM_SERVER] = true
-        it[ConnectivityFlags.CLOSE_QUIC_CONNECTION] = true
     }
     fun setFeatureEnabled(flag: String, enabled: Boolean) = enabledFeatures.set(flag, enabled)
 
@@ -223,7 +219,6 @@ open class CSTest {
 
     val multicastRoutingCoordinatorService = mock<MulticastRoutingCoordinatorService>()
     val satelliteAccessController = mock<SatelliteAccessController>()
-    val quicConnectionCloser = mock<QuicConnectionCloser>()
     val destroySocketsWrapper = mock<DestroySocketsWrapper>()
 
     val deps = CSDeps()
@@ -417,11 +412,6 @@ open class CSTest {
         }
 
         override fun makeL2capNetworkProvider(context: Context) = null
-
-        override fun makeQuicConnectionCloser(
-                networkForNetId: SparseArray<NetworkAgentInfo>,
-                handler: Handler
-        ): QuicConnectionCloser = quicConnectionCloser
     }
 
     inner class PermDeps : PermissionMonitor.Dependencies() {

From 65a26519c00bfb9b45bec30153cb2306577d2fc1 Mon Sep 17 00:00:00 2001
From: Chris Desir <cdesir@google.com>
Date: Wed, 26 Mar 2025 15:25:11 -0700
Subject: [PATCH 020/377] Fix transport override

The EthernetConfigParser was adding the transportType on top of the
TRANSPORT_ETHERNET of DEFAULT_CAPABILITIES, causing multiple transport
types to be added.

This was causing an IllegalStateException when trying to set the
NetworkSpecifier within the EthernetNetworkFactory.

This only applies for when isAtLeastB && capabilitiesString.equals("*")
is true (as the parsed capability is equal to DEFAULT_CAPABILITIES).

Flag: TEST_ONLY
Bug: 405172885
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.ethernet.EthernetTrackerTest
Change-Id: I6678a52ddc87b8ad66c602c68335f3e2073d7231
---
 .../server/ethernet/EthernetTracker.java        |  6 +++++-
 .../server/ethernet/EthernetTrackerTest.java    | 17 ++++++++++++++++-
 2 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/service-t/src/com/android/server/ethernet/EthernetTracker.java b/service-t/src/com/android/server/ethernet/EthernetTracker.java
index c3749bd628..e01a5c9a18 100644
--- a/service-t/src/com/android/server/ethernet/EthernetTracker.java
+++ b/service-t/src/com/android/server/ethernet/EthernetTracker.java
@@ -933,7 +933,11 @@ public class EthernetTracker {
             if (isAtLeastB && capabilitiesString.equals("*")) {
                 // On Android B+, a "*" string defaults to the same set of default
                 // capabilities assigned to unconfigured interfaces.
-                return new NetworkCapabilities(DEFAULT_CAPABILITIES);
+                // Note that the transport type is populated later with the result of
+                // parseTransportType().
+                return new NetworkCapabilities.Builder(DEFAULT_CAPABILITIES)
+                        .removeTransportType(NetworkCapabilities.TRANSPORT_ETHERNET)
+                        .build();
             }
 
             for (String strNetworkCapability : capabilitiesString.split(",")) {
diff --git a/tests/unit/java/com/android/server/ethernet/EthernetTrackerTest.java b/tests/unit/java/com/android/server/ethernet/EthernetTrackerTest.java
index 5d83f724ab..c6ae03985c 100644
--- a/tests/unit/java/com/android/server/ethernet/EthernetTrackerTest.java
+++ b/tests/unit/java/com/android/server/ethernet/EthernetTrackerTest.java
@@ -18,6 +18,7 @@ package com.android.server.ethernet;
 
 import static android.net.TestNetworkManager.TEST_TAP_PREFIX;
 
+import static com.android.server.ethernet.EthernetTracker.DEFAULT_CAPABILITIES;
 import static com.google.common.truth.Truth.assertThat;
 
 import static org.junit.Assert.assertFalse;
@@ -185,7 +186,7 @@ public class EthernetTrackerTest {
 
         // On Android B+, "*" defaults to using DEFAULT_CAPABILITIES.
         p = new EthernetConfigParser("eth0;*;;;;;;", true /*isAtLeastB*/);
-        assertThat(p.mCaps).isEqualTo(EthernetTracker.DEFAULT_CAPABILITIES);
+        assertThat(p.mCaps).isEqualTo(DEFAULT_CAPABILITIES);
 
         // But not so before B.
         p = new EthernetConfigParser("eth0;*", false /*isAtLeastB*/);
@@ -205,10 +206,24 @@ public class EthernetTrackerTest {
         // TRANSPORT_VPN (4) is not allowed.
         p = new EthernetConfigParser("eth0;;;4", false /*isAtLeastB*/);
         assertThat(p.mCaps.hasSingleTransport(NetworkCapabilities.TRANSPORT_ETHERNET)).isTrue();
+        p = new EthernetConfigParser("eth0;*;;4", true /*isAtLeastB*/);
+        assertThat(p.mCaps.hasSingleTransport(NetworkCapabilities.TRANSPORT_ETHERNET)).isTrue();
 
         // invalid capability and transport type
         p = new EthernetConfigParser("eth0;-1,a,1000,,;;-1", false /*isAtLeastB*/);
         assertThat(p.mCaps).isEqualTo(baseNc);
+
+        p = new EthernetConfigParser("eth0;*;;0", false /*isAtLeastB*/);
+        assertThat(p.mCaps.hasSingleTransport(NetworkCapabilities.TRANSPORT_CELLULAR)).isTrue();
+        p = new EthernetConfigParser("eth0;*;;0", true /*isAtLeastB*/);
+        assertThat(p.mCaps.hasSingleTransport(NetworkCapabilities.TRANSPORT_CELLULAR)).isTrue();
+
+        NetworkCapabilities nc = new NetworkCapabilities.Builder(DEFAULT_CAPABILITIES)
+                .removeTransportType(NetworkCapabilities.TRANSPORT_ETHERNET)
+                .addTransportType(NetworkCapabilities.TRANSPORT_CELLULAR)
+                .build();
+        p = new EthernetConfigParser("eth0;*;;0", true /*isAtLeastB*/);
+        assertThat(p.mCaps).isEqualTo(nc);
     }
 
     @Test

From e8e28f62368efea9ed2208889a25d5223e8b4f0d Mon Sep 17 00:00:00 2001
From: Motomu Utsumi <motomuman@google.com>
Date: Wed, 26 Mar 2025 14:57:01 -0700
Subject: [PATCH 021/377] Revert "Revert "Add hidden API to register/unregister
 QUIC conne..."

Revert submission 3561690-revert-3538339-SNUWWZJNJZ

Reason for revert: NewAPI error will be fixed by separate CL

Reverted changes: /q/submissionid:3561690-revert-3538339-SNUWWZJNJZ

Change-Id: Ia7367e9332f4d376bd0be4c03c095ee00de9177a
---
 .../src/android/net/ConnectivityManager.java  |  64 +++
 .../src/android/net/IConnectivityManager.aidl |   3 +
 .../android/server/ConnectivityService.java   |  60 +++
 .../connectivity/ConnectivityFlags.java       |   2 +
 .../connectivity/QuicConnectionCloser.java    | 406 ++++++++++++++++++
 .../net/cts/ConnectivityManagerTest.java      | 328 +++++++++++++-
 .../server/ConnectivityServiceTest.java       |   1 +
 .../connectivity/QuicConnectionCloserTest.kt  | 232 ++++++++++
 .../CSDestroySocketTest.kt                    |  11 +-
 .../server/connectivityservice/base/CSTest.kt |  10 +
 10 files changed, 1110 insertions(+), 7 deletions(-)
 create mode 100644 service/src/com/android/server/connectivity/QuicConnectionCloser.java
 create mode 100644 tests/unit/java/com/android/server/connectivity/QuicConnectionCloserTest.kt

diff --git a/framework/src/android/net/ConnectivityManager.java b/framework/src/android/net/ConnectivityManager.java
index f8a1293a34..3a7d070670 100644
--- a/framework/src/android/net/ConnectivityManager.java
+++ b/framework/src/android/net/ConnectivityManager.java
@@ -6856,4 +6856,68 @@ public class ConnectivityManager {
             throw e.rethrowFromSystemServer();
         }
     }
+
+    /**
+     * Register QUIC UDP socket and UDP payload that can close QUIC connection.
+     *
+     * When the app loses network access (e.g. due to freezer or firewall chain),
+     * ConnectivityService 1)destroys the registered UDP socket by sending a SOCK_DESTROY netlink
+     * message and 2)sends the registered UDP payload to the server.
+     * This prevents unnecessary modem wakeups caused by packets from the server after the apps
+     * lose network access.
+     *
+     * Additionally, to close QUIC connection for apps that crash or are killed, ConnectivityService
+     * sends the registered UDP payload when it receives a socket destroy diag message for the
+     * registered socket.
+     *
+     * If apps call this method, they must call {@link #unregisterQuicConnectionClosePayload} before
+     * they close the QUIC connection and the socket.
+     * Otherwise, the registered UDP payload will be sent to the server, even if the QUIC connection
+     * was already properly closed. This is because ConnectivityService cannot distinguish whether
+     * the socket was closed due to the app being killed or because the app forgets to call
+     * {@link #unregisterQuicConnectionClosePayload}.
+     *
+     * The registered payload will be sent using the source and destination addresses and ports of
+     * the connected UDP socket provided. So, the app must not reuse the same socket to reconnect
+     * to a different server, even if first calls unregisterQuicConnectionClosePayload. This is
+     * because this method operates asynchronously.
+     *
+     * If the number of registered socket and payload hits the limit, ConnectivityService silently
+     * ignores new registration. ConnectivityService cannot know about this synchronously, but the
+     * caller couldn't really do anything with this information anyway.
+     * TODO: Consider adding a result listener if this API becomes public.
+     *
+     * @param pfd The {@link ParcelFileDescriptor} for the connected UDP socket.
+     *            The registered payload will be sent using the source and destination addresses and
+     *            ports of this connected UDP socket.
+     * @param payload The UDP payload that can close QUIC connection.
+     *
+     * @hide
+     */
+    public void registerQuicConnectionClosePayload(final ParcelFileDescriptor pfd,
+            final byte[] payload) {
+        try {
+            mService.registerQuicConnectionClosePayload(pfd, payload);
+        } catch (RemoteException e) {
+            throw e.rethrowFromSystemServer();
+        }
+    }
+
+    /**
+     * Unregister the QUIC socket previously registered by
+     * {@link #registerQuicConnectionClosePayload}
+     *
+     * This method is a no-op if the provided UDP socket is not registered.
+     *
+     * @param pfd The {@link ParcelFileDescriptor} for the UDP socket.
+     *
+     * @hide
+     */
+    public void unregisterQuicConnectionClosePayload(final ParcelFileDescriptor pfd) {
+        try {
+            mService.unregisterQuicConnectionClosePayload(pfd);
+        } catch (RemoteException e) {
+            throw e.rethrowFromSystemServer();
+        }
+    }
 }
diff --git a/framework/src/android/net/IConnectivityManager.aidl b/framework/src/android/net/IConnectivityManager.aidl
index a270684c40..0146e729a7 100644
--- a/framework/src/android/net/IConnectivityManager.aidl
+++ b/framework/src/android/net/IConnectivityManager.aidl
@@ -266,4 +266,7 @@ interface IConnectivityManager
     long getEnabledConnectivityManagerFeatures();
 
     boolean isConnectivityServiceFeatureEnabledForTesting(String featureFlag);
+
+    oneway void registerQuicConnectionClosePayload(in ParcelFileDescriptor pfd, in byte[] payload);
+    oneway void unregisterQuicConnectionClosePayload(in ParcelFileDescriptor pfd);
 }
diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index 45b431f1e7..7f317930a4 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -156,6 +156,7 @@ import static com.android.net.module.util.PermissionUtils.enforceNetworkStackPer
 import static com.android.net.module.util.PermissionUtils.hasAnyPermissionOf;
 import static com.android.server.ConnectivityStatsLog.CONNECTIVITY_STATE_SAMPLE;
 import static com.android.server.connectivity.ConnectivityFlags.CELLULAR_DATA_INACTIVITY_TIMEOUT;
+import static com.android.server.connectivity.ConnectivityFlags.CLOSE_QUIC_CONNECTION;
 import static com.android.server.connectivity.ConnectivityFlags.DELAY_DESTROY_SOCKETS;
 import static com.android.server.connectivity.ConnectivityFlags.INGRESS_TO_VPN_ADDRESS_FILTERING;
 import static com.android.server.connectivity.ConnectivityFlags.NAMESPACE_TETHERING_BOOT;
@@ -389,6 +390,7 @@ import com.android.server.connectivity.PermissionMonitor;
 import com.android.server.connectivity.ProfileNetworkPreferenceInfo;
 import com.android.server.connectivity.ProxyTracker;
 import com.android.server.connectivity.QosCallbackTracker;
+import com.android.server.connectivity.QuicConnectionCloser;
 import com.android.server.connectivity.SatelliteAccessController;
 import com.android.server.connectivity.UidRangeUtils;
 import com.android.server.connectivity.VpnNetworkPreferenceInfo;
@@ -1104,6 +1106,13 @@ public class ConnectivityService extends IConnectivityManager.Stub {
     // Flag to drop packets to VPN addresses ingressing via non-VPN interfaces.
     private final boolean mIngressToVpnAddressFiltering;
 
+    // Flag to close QUIC connection for registered sockets when apps lose network access.
+    private final boolean mCloseQuicConnection;
+
+    // This is null if mCloseQuicConnection is false
+    @Nullable
+    private final QuicConnectionCloser mQuicConnectionCloser;
+
     /**
      * Implements support for the legacy "one network per network type" model.
      *
@@ -1825,6 +1834,14 @@ public class ConnectivityService extends IConnectivityManager.Stub {
             handler.sendMessageDelayed(
                     handler.obtainMessage(EVENT_INITIAL_EVALUATION_TIMEOUT, network), delayMs);
         }
+
+        /**
+         * Create {@link QuicConnectionCloser}.
+         */
+        public QuicConnectionCloser makeQuicConnectionCloser(
+                final SparseArray<NetworkAgentInfo> networkForNetId, final Handler handler) {
+            return new QuicConnectionCloser(networkForNetId, handler);
+        }
     }
 
     public ConnectivityService(Context context) {
@@ -2133,6 +2150,13 @@ public class ConnectivityService extends IConnectivityManager.Stub {
                 && mDeps.isFeatureNotChickenedOut(mContext, INGRESS_TO_VPN_ADDRESS_FILTERING);
 
         mL2capNetworkProvider = mDeps.makeL2capNetworkProvider(mContext);
+
+        mCloseQuicConnection = mDeps.isFeatureEnabled(context, CLOSE_QUIC_CONNECTION);
+        if (mCloseQuicConnection) {
+            mQuicConnectionCloser = mDeps.makeQuicConnectionCloser(mNetworkForNetId, mHandler);
+        } else {
+            mQuicConnectionCloser = null;
+        }
     }
 
     /**
@@ -3687,6 +3711,11 @@ public class ConnectivityService extends IConnectivityManager.Stub {
         } catch (SocketException | InterruptedIOException | ErrnoException e) {
             loge("Failed to destroy sockets: " + e);
         }
+
+        if (mCloseQuicConnection) {
+            mQuicConnectionCloser.closeQuicConnectionByUids(uids);
+        }
+
         mDestroySocketPendingUids.clear();
     }
 
@@ -4516,6 +4545,12 @@ public class ConnectivityService extends IConnectivityManager.Stub {
         mNetworkActivityTracker.dump(pw);
         pw.decreaseIndent();
 
+        pw.println();
+        pw.println("Close QUIC connection: " + mCloseQuicConnection);
+        if (mCloseQuicConnection) {
+            mQuicConnectionCloser.dump(pw);
+        }
+
         pw.println();
         pw.println("Multicast routing supported: " +
                 (mMulticastRoutingCoordinatorService != null));
@@ -15125,8 +15160,33 @@ public class ConnectivityService extends IConnectivityManager.Stub {
                 return mIngressToVpnAddressFiltering;
             case QUEUE_NETWORK_AGENT_EVENTS_IN_SYSTEM_SERVER:
                 return mQueueNetworkAgentEventsInSystemServer;
+            case CLOSE_QUIC_CONNECTION:
+                return mCloseQuicConnection;
             default:
                 throw new IllegalArgumentException("Unknown flag: " + featureFlag);
         }
     }
+
+    @Override
+    public void registerQuicConnectionClosePayload(final ParcelFileDescriptor pfd,
+            final byte[] payload) {
+        if (!mCloseQuicConnection) {
+            IoUtils.closeQuietly(pfd);
+            return;
+        }
+        // pfd is closed by registerQuicConnectionClosePayload
+        mQuicConnectionCloser.registerQuicConnectionClosePayload(mDeps.getCallingUid(),
+                pfd, payload);
+    }
+
+    @Override
+    public void unregisterQuicConnectionClosePayload(final ParcelFileDescriptor pfd) {
+        if (!mCloseQuicConnection) {
+            IoUtils.closeQuietly(pfd);
+            return;
+        }
+        // pfd is closed by unregisterQuicConnectionClosePayload
+        mQuicConnectionCloser.unregisterQuicConnectionClosePayload(pfd);
+    }
+
 }
diff --git a/service/src/com/android/server/connectivity/ConnectivityFlags.java b/service/src/com/android/server/connectivity/ConnectivityFlags.java
index 74bd2351ac..fd24951049 100644
--- a/service/src/com/android/server/connectivity/ConnectivityFlags.java
+++ b/service/src/com/android/server/connectivity/ConnectivityFlags.java
@@ -65,6 +65,8 @@ public final class ConnectivityFlags {
     public static final String QUEUE_NETWORK_AGENT_EVENTS_IN_SYSTEM_SERVER =
             "queue_network_agent_events_in_system_server";
 
+    public static final String CLOSE_QUIC_CONNECTION = "close_quic_connection";
+
     private boolean mNoRematchAllRequestsOnRegister;
 
     /**
diff --git a/service/src/com/android/server/connectivity/QuicConnectionCloser.java b/service/src/com/android/server/connectivity/QuicConnectionCloser.java
new file mode 100644
index 0000000000..ce5d61c92b
--- /dev/null
+++ b/service/src/com/android/server/connectivity/QuicConnectionCloser.java
@@ -0,0 +1,406 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.server.connectivity;
+
+import static android.system.OsConstants.ENOENT;
+import static android.system.OsConstants.SOL_SOCKET;
+import static android.system.OsConstants.SO_SNDTIMEO;
+
+import android.annotation.NonNull;
+import android.net.Network;
+import android.net.NetworkUtils;
+import android.os.Handler;
+import android.os.ParcelFileDescriptor;
+import android.system.ErrnoException;
+import android.system.Os;
+import android.system.StructTimeval;
+import android.util.ArrayMap;
+import android.util.IndentingPrintWriter;
+import android.util.Log;
+import android.util.SparseArray;
+
+import com.android.internal.annotations.GuardedBy;
+import com.android.internal.annotations.VisibleForTesting;
+import com.android.net.module.util.HandlerUtils;
+import com.android.net.module.util.SharedLog;
+import com.android.net.module.util.SkDestroyListener;
+import com.android.net.module.util.netlink.InetDiagMessage;
+
+import libcore.io.IoUtils;
+
+import java.io.FileDescriptor;
+import java.io.IOException;
+import java.io.InterruptedIOException;
+import java.net.DatagramSocket;
+import java.net.InetSocketAddress;
+import java.net.SocketException;
+import java.util.Iterator;
+import java.util.Map;
+import java.util.Set;
+import java.util.function.Consumer;
+
+public class QuicConnectionCloser {
+    private static final String TAG = QuicConnectionCloser.class.getSimpleName();
+
+    private static final int SOCKET_WRITE_TIMEOUT_MS = 100;
+
+    // Map from socket cookie to QUIC connection close information
+    private final Map<Long, QuicConnectionCloseInfo>
+            mRegisteredQuicConnectionCloseInfos = new ArrayMap<>();
+
+    // The maximum number of QUIC connection close information entries that can be registered
+    // concurrently.
+    private static final int MAX_REGISTERED_QUIC_CONNECTION_CLOSE_INFO = 1000;
+
+    private final Handler mHandler;
+
+    // Reference to ConnectivityService#mNetworkForNetId, must be synchronized on itself.
+    // mHandler in this class is associated with the ConnectivityService handler thread.
+    // The only code that can update mNetworkForNetId runs on that thread, so no entries can be
+    // updated while the code in this class is running on mHandler thread.
+    @GuardedBy("mNetworkForNetId")
+    private final SparseArray<NetworkAgentInfo> mNetworkForNetId;
+
+    @NonNull
+    private final Dependencies mDeps;
+
+    /**
+     * Class to store the necessary information for closing a QUIC connection.
+     */
+    private static class QuicConnectionCloseInfo {
+        public final int uid;
+        public final int netId;
+        public final long cookie;
+        public final InetSocketAddress src;
+        public final InetSocketAddress dst;
+        public final byte[] payload;
+
+        QuicConnectionCloseInfo(int uid, int netId, long cookie, InetSocketAddress src,
+                InetSocketAddress dst, byte[] payload) {
+            this.uid = uid;
+            this.netId = netId;
+            this.cookie = cookie;
+            this.src = src;
+            this.dst = dst;
+            this.payload = payload;
+        }
+
+        @Override
+        public String toString() {
+            return "QuicConnectionCloseInfo{"
+                    + "uid: " + uid
+                    + ", netId: " + netId
+                    + ", cookie: " + cookie
+                    + ", src: " + src
+                    + ", dst: " + dst
+                    + ", payload length: " + payload.length
+                    + "}";
+        }
+    }
+
+    public static class Dependencies {
+        /**
+         * Send a UDP packet with the specified source and destination address and port over the
+         * specified network.
+         *
+         * @param network The {@link Network} over which the UDP packet will be sent.
+         * @param src     The source {@link InetSocketAddress} of the UDP packet to be sent.
+         * @param dst     The destination {@link InetSocketAddress} of the UDP packet to be sent.
+         * @param payload The UDP payload to be sent.
+         */
+        public void sendQuicConnectionClosePayload(final Network network,
+                final InetSocketAddress src, final InetSocketAddress dst, final byte[] payload)
+                throws IOException, ErrnoException {
+            final DatagramSocket socket = new DatagramSocket(src);
+            network.bindSocket(socket);
+            socket.connect(dst);
+            Os.setsockoptTimeval(socket.getFileDescriptor$(), SOL_SOCKET, SO_SNDTIMEO,
+                    StructTimeval.fromMillis(SOCKET_WRITE_TIMEOUT_MS));
+            Os.write(socket.getFileDescriptor$(), payload, 0 /* byteOffset */, payload.length);
+        }
+
+        /**
+         * Call {@link InetDiagMessage#destroyUdpSocket}
+         */
+        public void destroyUdpSocket(final InetSocketAddress src, final InetSocketAddress dst,
+                final long cookie)
+                throws SocketException, InterruptedIOException, ErrnoException {
+            InetDiagMessage.destroyUdpSocket(src, dst, 0 /* ifindex */, cookie);
+        }
+
+        /**
+         * Call {@link SkDestroyListener#makeSkDestroyListener}
+         */
+        public SkDestroyListener makeSkDestroyListener(final Consumer<InetDiagMessage> consumer,
+                final Handler handler) {
+            return SkDestroyListener.makeSkDestroyListener(consumer, false /* monitorTcpSocket */,
+                    true /* monitorUdpSocket */, handler, new SharedLog(TAG));
+        }
+
+        /**
+         * Call {@link NetworkUtils#getSocketCookie}
+         */
+        public long getSocketCookie(final FileDescriptor fd) throws ErrnoException {
+            return NetworkUtils.getSocketCookie(fd);
+        }
+
+        /**
+         * Call {@link Os#getsockoptInt}
+         */
+        public int getsockoptInt(final FileDescriptor fd, final int level, final int option)
+                throws ErrnoException {
+            return Os.getsockoptInt(fd, level, option);
+        }
+
+        /**
+         * Call {@link Os#getsockname}}
+         */
+        public InetSocketAddress getsockname(final FileDescriptor fd) throws ErrnoException {
+            return (InetSocketAddress) Os.getsockname(fd);
+        }
+
+        /**
+         * Call {@link Os#getpeername}
+         */
+        public InetSocketAddress getpeername(final FileDescriptor fd) throws ErrnoException {
+            return (InetSocketAddress) Os.getpeername(fd);
+        }
+    }
+
+    public QuicConnectionCloser(final SparseArray<NetworkAgentInfo> networkForNetId,
+            final Handler handler) {
+        this(networkForNetId, handler, new Dependencies());
+    }
+
+    @VisibleForTesting
+    public QuicConnectionCloser(final SparseArray<NetworkAgentInfo> networkForNetId,
+            final Handler handler, final Dependencies deps) {
+        mNetworkForNetId = networkForNetId;
+        mHandler = handler;
+        mDeps = deps;
+
+        // handleUdpSocketDestroy must be posted to the thread to avoid racing with
+        // handleUnregisterQuicConnectionCloseInfo, even though they both run on the same thread.
+        // Specifically, the following can happen:
+        // unregisterQuicConnectionClosePayload posts handleUnregisterQuicConnectionCloseInfo to
+        // the handler and then closes the fd.
+        // The close() will cause the kernel to enqueue a netlink message to the SkDestroyHandler's
+        // fd.
+        // It's possible that the MessageQueue of the handler sees both the SkDestroyHandler's fd
+        // and the MessageQueue fd go active at the same time, and chooses to run the netlink
+        // event first.
+        // As a result, handleUdpSocketDestroy runs before handleUnregisterQuicConnectionCloseInfo,
+        // and the code incorrectly sends a close packet for a socket that the app has already
+        // unregistered.
+        // Posting handleUdpSocketDestroy to the handler ensures that it always runs after
+        // handleUnregisterQuicConnectionCloseInfo. It doesn't matter if the
+        // handleUdpSocketDestroy is delayed, because it will only send a packet if
+        // mRegisteredQuicConnectionCloseInfos contains the socket cookie, and socket cookies are
+        // never reused.
+        final SkDestroyListener udpSkDestroyListener = mDeps.makeSkDestroyListener(
+                (inetDiagMessage) -> handler.post(() -> handleUdpSocketDestroy(inetDiagMessage)),
+                handler);
+        handler.post(udpSkDestroyListener::start);
+    }
+
+    private void ensureRunningOnHandlerThread() {
+        HandlerUtils.ensureRunningOnHandlerThread(mHandler);
+    }
+
+    /**
+     * Close registered QUIC connection by uids
+     *
+     * @param uids target uids to close QUIC connections
+     */
+    public void closeQuicConnectionByUids(final Set<Integer> uids) {
+        ensureRunningOnHandlerThread();
+
+        for (Iterator<Map.Entry<Long, QuicConnectionCloseInfo>> it =
+                mRegisteredQuicConnectionCloseInfos.entrySet().iterator(); it.hasNext();) {
+            final QuicConnectionCloseInfo info = it.next().getValue();
+            if (uids.contains(info.uid)) {
+                closeQuicConnection(info, true /* destroySocket */);
+                it.remove();
+            }
+        }
+    }
+
+    private NetworkAgentInfo getNetworkAgentInfoForNetId(int netId) {
+        synchronized (mNetworkForNetId) {
+            return mNetworkForNetId.get(netId);
+        }
+    }
+
+    private void closeQuicConnection(final QuicConnectionCloseInfo info,
+            final boolean destroySocket) {
+        ensureRunningOnHandlerThread();
+
+        Log.d(TAG, "Close QUIC socket for " + info + ", destroySocket=" + destroySocket);
+        final NetworkAgentInfo nai = getNetworkAgentInfoForNetId(info.netId);
+        if (nai == null || !nai.linkProperties.getAddresses().contains(info.src.getAddress())) {
+            // The device should not send a packet with an unused source address.
+            return;
+        }
+
+        if (destroySocket) {
+            try {
+                mDeps.destroyUdpSocket(info.src, info.dst, info.cookie);
+            } catch (ErrnoException | SocketException | InterruptedIOException e) {
+                if (e instanceof ErrnoException && ((ErrnoException) e).errno == ENOENT) {
+                    // This can happen if the socket is already closed, but unregister message is
+                    // not processed yet.
+                    return;
+                }
+                Log.e(TAG, "Failed to destroy QUIC socket for " + info + ": " + e);
+                return;
+            }
+        }
+
+        try {
+            mDeps.sendQuicConnectionClosePayload(nai.network(), info.src, info.dst, info.payload);
+        } catch (ErrnoException | IOException e) {
+            Log.e(TAG, "Failed to send registered QUIC connection close payload for "
+                    + info + ": " + e);
+        }
+    }
+
+    /**
+     * Close QUIC connection if the registered socket was destroyed
+     *
+     * @param inetDiagMessage {@link InetDiagMessage} received from kernel
+     */
+    private void handleUdpSocketDestroy(final InetDiagMessage inetDiagMessage) {
+        ensureRunningOnHandlerThread();
+
+        final long cookie = inetDiagMessage.inetDiagMsg.id.cookie;
+        final QuicConnectionCloseInfo info = mRegisteredQuicConnectionCloseInfos.remove(cookie);
+        if (info == null) {
+            // Destroyed socket is not registered or already unregistered.
+            return;
+        }
+
+        // App registered a QUIC connection close payload and this socket, but the socket was
+        // closed before the socket was unregistered.
+        // This can happen if the app crashes or is killed.
+        closeQuicConnection(info, false /* destroySocket */);
+    }
+
+    /**
+     * Register the QUIC connection close information
+     *
+     * @param info {@link QuicConnectionCloseInfo} to register
+     */
+    private void handleRegisterQuicConnectionCloseInfo(final QuicConnectionCloseInfo info) {
+        ensureRunningOnHandlerThread();
+
+        if (mRegisteredQuicConnectionCloseInfos.size()
+                >= MAX_REGISTERED_QUIC_CONNECTION_CLOSE_INFO) {
+            Log.e(TAG, "Failed to register QUIC connection close information."
+                    + " number of registered information exceeded "
+                    + MAX_REGISTERED_QUIC_CONNECTION_CLOSE_INFO);
+            return;
+        }
+        mRegisteredQuicConnectionCloseInfos.put(info.cookie, info);
+    }
+
+    // TODO: Use OsConstants.SO_MARK once this API is available
+    private static final int SO_MARK = 36;
+
+    /**
+     * Register QUIC socket and connection close payload
+     *
+     * @param uid The uid of the socket owner
+     * @param pfd The {@link ParcelFileDescriptor} for the connected UDP socket.
+     * @param payload The UDP payload that can close QUIC connection.
+     */
+    public void registerQuicConnectionClosePayload(final int uid, final ParcelFileDescriptor pfd,
+            final byte[] payload) {
+        try {
+            final FileDescriptor fd = pfd.getFileDescriptor();
+            // See FWMARK_NET_ID_MASK in Fwmark.h
+            final int netId = mDeps.getsockoptInt(fd, SOL_SOCKET, SO_MARK) & 0xffff;
+            // The peer name could change if the socket is reconnected to a different server.
+            // But, it is the caller's responsibility to avoid this, as explicitly stated in the
+            // Javadoc of ConnectivityManager#registerQuicConnectionClosePayload.
+            final QuicConnectionCloseInfo info = new QuicConnectionCloseInfo(
+                    uid,
+                    netId,
+                    mDeps.getSocketCookie(fd),
+                    mDeps.getsockname(fd),
+                    mDeps.getpeername(fd),
+                    payload);
+            mHandler.post(() -> handleRegisterQuicConnectionCloseInfo(info));
+        } catch (ErrnoException e) {
+            Log.e(TAG, "Failed to register QUIC connection close information", e);
+        } finally {
+            // |pfd| must remain open until the message is posted to the handler thread, because
+            // doing so ensures that the socket is not closed even if the app calls close().
+            // Keeping it open avoids the following threading issue with SkDestroyListener :
+            // If the PFD was closed before posting the message, then SkDestroyListener might
+            // get a "socket destroyed" message from Netlink immediately and post to the handler
+            // thread before this method posts its own message, resulting in a leak of the
+            // mRegisteredQuicConnectionCloseInfo entry.
+            // While the PFD is held, Netlink will not send the socket destroy message to
+            // SkDestroyListener, and thus the message posted by SkDestroyListener as
+            // a reaction to it will be processed after the message posted by this method.
+            IoUtils.closeQuietly(pfd);
+        }
+    }
+
+    /**
+     * Unregister the QUIC connection close information
+     *
+     * @param cookie cookie of the socket whose connection close information should be unregistered
+     */
+    private void handleUnregisterQuicConnectionCloseInfo(final long cookie) {
+        ensureRunningOnHandlerThread();
+
+        mRegisteredQuicConnectionCloseInfos.remove(cookie);
+    }
+
+    /**
+     * Unregister the QUIC socket
+     *
+     * @param pfd The {@link ParcelFileDescriptor} for the UDP socket.
+     */
+    public void unregisterQuicConnectionClosePayload(final ParcelFileDescriptor pfd) {
+        try {
+            final long cookie = mDeps.getSocketCookie(pfd.getFileDescriptor());
+            mHandler.post(() -> handleUnregisterQuicConnectionCloseInfo(cookie));
+        } catch (ErrnoException e) {
+            Log.e(TAG, "Failed to unregister QUIC connection close information: " + e);
+        } finally {
+            // |pfd| must be closed after posting the message to the handler thread to avoid the
+            // threading issue with SkDestroyListener.
+            // See the comment in registerQuicConnectionClosePayload.
+            IoUtils.closeQuietly(pfd);
+        }
+    }
+
+    /**
+     * Dump QUIC connection closer information
+     */
+    public void dump(final IndentingPrintWriter pw) {
+        pw.println("Registered QUIC connection close information: "
+                + mRegisteredQuicConnectionCloseInfos.size());
+        pw.increaseIndent();
+        for (QuicConnectionCloseInfo info: mRegisteredQuicConnectionCloseInfos.values()) {
+            pw.println(info);
+        }
+        pw.decreaseIndent();
+    }
+}
diff --git a/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java b/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
index 87c2b9e5d1..e20e457b01 100644
--- a/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
+++ b/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
@@ -21,6 +21,7 @@ import static android.Manifest.permission.ACCESS_FINE_LOCATION;
 import static android.Manifest.permission.ACCESS_NETWORK_STATE;
 import static android.Manifest.permission.CONNECTIVITY_INTERNAL;
 import static android.Manifest.permission.CONNECTIVITY_USE_RESTRICTED_NETWORKS;
+import static android.Manifest.permission.MANAGE_TEST_NETWORKS;
 import static android.Manifest.permission.NETWORK_FACTORY;
 import static android.Manifest.permission.NETWORK_SETTINGS;
 import static android.Manifest.permission.NETWORK_SETUP_WIZARD;
@@ -100,6 +101,11 @@ import static android.provider.Settings.Global.NETWORK_METERED_MULTIPATH_PREFERE
 import static android.system.OsConstants.AF_INET;
 import static android.system.OsConstants.AF_INET6;
 import static android.system.OsConstants.AF_UNSPEC;
+import static android.system.OsConstants.ECONNABORTED;
+import static android.system.OsConstants.EDESTADDRREQ;
+import static android.system.OsConstants.IPPROTO_UDP;
+import static android.system.OsConstants.POLLIN;
+import static android.system.OsConstants.SOCK_DGRAM;
 
 import static com.android.compatibility.common.util.SystemUtil.callWithShellPermissionIdentity;
 import static com.android.compatibility.common.util.SystemUtil.runShellCommand;
@@ -182,7 +188,9 @@ import android.os.ConditionVariable;
 import android.os.Handler;
 import android.os.Looper;
 import android.os.MessageQueue;
+import android.os.ParcelFileDescriptor;
 import android.os.Process;
+import android.os.RemoteException;
 import android.os.ServiceManager;
 import android.os.SystemClock;
 import android.os.UserHandle;
@@ -190,6 +198,9 @@ import android.os.VintfRuntimeInfo;
 import android.platform.test.annotations.AppModeFull;
 import android.provider.DeviceConfig;
 import android.provider.Settings;
+import android.system.ErrnoException;
+import android.system.Os;
+import android.system.StructPollfd;
 import android.telephony.SubscriptionManager;
 import android.telephony.TelephonyManager;
 import android.text.TextUtils;
@@ -205,6 +216,10 @@ import com.android.internal.util.ArrayUtils;
 import com.android.modules.utils.build.SdkLevel;
 import com.android.net.module.util.CollectionUtils;
 import com.android.net.module.util.DnsPacket;
+import com.android.net.module.util.Struct;
+import com.android.net.module.util.structs.Ipv4Header;
+import com.android.net.module.util.structs.Ipv6Header;
+import com.android.net.module.util.structs.UdpHeader;
 import com.android.networkstack.apishim.ConnectivityManagerShimImpl;
 import com.android.networkstack.apishim.ConstantsShim;
 import com.android.networkstack.apishim.NetworkInformationShimImpl;
@@ -228,6 +243,7 @@ import com.android.testutils.TestableNetworkCallback;
 
 import junit.framework.AssertionFailedError;
 
+import libcore.io.IoUtils;
 import libcore.io.Streams;
 
 import org.junit.After;
@@ -253,6 +269,7 @@ import java.net.MalformedURLException;
 import java.net.Socket;
 import java.net.SocketException;
 import java.net.URL;
+import java.nio.ByteBuffer;
 import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
 import java.util.Arrays;
@@ -352,6 +369,15 @@ public class ConnectivityManagerTest {
     // Re-connecting to the AP, obtaining an IP address, revalidating can take a long time
     private static final long WIFI_CONNECT_TIMEOUT_MS = 60_000L;
 
+    // Timeout for waiting the QUIC connection close information registration/unregistration
+    private static final long QUIC_CONNECTION_CLOSE_INFO_REGISTRATION_TIMEOUT_MS = 500L;
+
+    // Timeout for waiting the QUIC connection close packet to be sent
+    private static final long QUIC_CONNECTION_CLOSE_PACKET_TIMEOUT_MS = 200L;
+
+    // Name of the feature flag for closing quic connection
+    private static final String CLOSE_QUIC_CONNECTION = "close_quic_connection";
+
     private Context mContext;
     private Instrumentation mInstrumentation;
     private ConnectivityManager mCm;
@@ -2389,8 +2415,8 @@ public class ConnectivityManagerTest {
         waitForAvailable(cb);
     }
 
-    private void waitForAvailable(@NonNull final TestableNetworkCallback cb) {
-        cb.eventuallyExpect(CallbackEntry.AVAILABLE, NETWORK_CALLBACK_TIMEOUT_MS,
+    private CallbackEntry.Available waitForAvailable(@NonNull final TestableNetworkCallback cb) {
+        return cb.eventuallyExpect(CallbackEntry.AVAILABLE, NETWORK_CALLBACK_TIMEOUT_MS,
                 c -> c instanceof CallbackEntry.Available);
     }
 
@@ -4131,4 +4157,302 @@ public class ConnectivityManagerTest {
         assertThrows(UnsupportedOperationException.class, () -> mCm.tether("iface"));
         assertThrows(UnsupportedOperationException.class, () -> mCm.untether("iface"));
     }
+
+    private ParcelFileDescriptor setupTestNetworkAndGetFd() {
+        return runWithShellPermissionIdentity(() -> {
+            final TestNetworkManager tnm = mContext.getSystemService(TestNetworkManager.class);
+            final List<LinkAddress> linkAddresses = List.of(new LinkAddress("192.0.2.2/24"),
+                    new LinkAddress("2001:db8:1:2::2/64"));
+            final TestNetworkInterface iface = tnm.createTunInterface(linkAddresses);
+            tnm.setupTestNetwork(iface.getInterfaceName(), new Binder());
+            return iface.getFileDescriptor();
+        }, MANAGE_TEST_NETWORKS);
+    }
+
+    private Network getTestNetwork() {
+        final TestableNetworkCallback callback = networkCallbackRule.requestNetwork(
+                new NetworkRequest.Builder()
+                        .removeCapability(NetworkCapabilities.NET_CAPABILITY_NOT_VPN)
+                        .removeCapability(NetworkCapabilities.NET_CAPABILITY_TRUSTED)
+                        .addTransportType(TRANSPORT_TEST)
+                        .build()
+        );
+        return waitForAvailable(callback).getNetwork();
+    }
+
+    private void waitForQuicConnectionCloseInfoRegistration(final int myUid,
+            final boolean expectRegistered)
+            throws ErrnoException, RemoteException, InterruptedException {
+        final long timeout = SystemClock.elapsedRealtime()
+                + QUIC_CONNECTION_CLOSE_INFO_REGISTRATION_TIMEOUT_MS;
+        while (timeout > SystemClock.elapsedRealtime()) {
+            if (DumpTestUtils.dumpServiceWithShellPermission(
+                    Context.CONNECTIVITY_SERVICE, "--short")
+                    .contains("QuicConnectionCloseInfo{uid: " + myUid) == expectRegistered) {
+                return;
+            }
+            Thread.sleep(50);
+        }
+        fail("Failed to register/unregister QUIC connection close information in "
+                + QUIC_CONNECTION_CLOSE_INFO_REGISTRATION_TIMEOUT_MS
+                + "ms, expectRegistered=" + expectRegistered);
+    }
+
+    private void doTestRegisterQuicConnectionClosePayload(final boolean isV6,
+            final boolean unregister, final boolean closeSocket, final boolean blockNetwork,
+            final boolean expectPacketSent) throws Exception {
+        final InetAddress dstAddress = isV6 ? InetAddresses.parseNumericAddress("2001:db8:1:2::3")
+                : InetAddresses.parseNumericAddress("192.0.2.3");
+        final InetSocketAddress dstSockAddress = new InetSocketAddress(dstAddress, 443);
+        final int myUid = Process.myUid();
+
+        final ParcelFileDescriptor tunFd = setupTestNetworkAndGetFd();
+        final Network testNetwork = getTestNetwork();
+
+        // Firewall chain status will be restored after the test.
+        final boolean wasChainEnabled = runWithShellPermissionIdentity(() ->
+                mCm.getFirewallChainEnabled(FIREWALL_CHAIN_BACKGROUND), NETWORK_SETTINGS);
+        final int previousUidFirewallRule = runWithShellPermissionIdentity(() ->
+                mCm.getUidFirewallRule(FIREWALL_CHAIN_BACKGROUND, myUid), NETWORK_SETTINGS);
+        runWithShellPermissionIdentity(() -> {
+            mCm.setFirewallChainEnabled(FIREWALL_CHAIN_BACKGROUND, true /* enable */);
+            mCm.setUidFirewallRule(FIREWALL_CHAIN_BACKGROUND, myUid, FIREWALL_RULE_ALLOW);
+        }, NETWORK_SETTINGS);
+
+        final FileDescriptor sock = Os.socket(isV6 ? AF_INET6 : AF_INET, SOCK_DGRAM, IPPROTO_UDP);
+        final ParcelFileDescriptor pfd = ParcelFileDescriptor.fromFd(sock.getInt$());
+        testNetwork.bindSocket(sock);
+        Os.connect(sock, dstSockAddress);
+        final InetSocketAddress srcSockAddress = (InetSocketAddress) Os.getsockname(sock);
+
+        testAndCleanup(() -> {
+            final Random random = new Random();
+            final byte[] payload = new byte[100];
+            random.nextBytes(payload);
+
+            // register/unregisterQuicConnectionClosePayload are oneway binder calls,
+            // while setUidFirewallRule is a two-way binder call. So if
+            // setUidFirewallRule is called immediately after them, it's possible that
+            // setUidFirewallRule could be processed before them.
+            // To ensure that uid networking is blocked after the connection close information
+            // is registered/unregistered, wait for the registration/unregistration.
+            mCm.registerQuicConnectionClosePayload(pfd, payload);
+            waitForQuicConnectionCloseInfoRegistration(myUid, true /* expectRegistered */);
+            if (unregister) {
+                mCm.unregisterQuicConnectionClosePayload(pfd);
+                waitForQuicConnectionCloseInfoRegistration(myUid, false /* expectRegistered */);
+            }
+
+            if (closeSocket) {
+                Os.close(sock);
+                pfd.close();
+            }
+
+            if (blockNetwork) {
+                runWithShellPermissionIdentity(() ->
+                        mCm.setUidFirewallRule(FIREWALL_CHAIN_BACKGROUND, myUid,
+                                FIREWALL_RULE_DENY), NETWORK_SETTINGS);
+            }
+
+            final long timeout = SystemClock.elapsedRealtime()
+                    + QUIC_CONNECTION_CLOSE_PACKET_TIMEOUT_MS;
+            long remainingTimeMs;
+            while ((remainingTimeMs = timeout - SystemClock.elapsedRealtime()) > 0) {
+                final StructPollfd pollfd = new StructPollfd();
+                pollfd.events = (short) POLLIN;
+                pollfd.fd = tunFd.getFileDescriptor();
+                final int ret = Os.poll(new StructPollfd[] { pollfd }, (int) remainingTimeMs);
+                if (ret == 0) {
+                    continue;
+                }
+
+                final byte[] recvData = new byte[200];
+                final int readSize = Os.read(tunFd.getFileDescriptor(), recvData,
+                        0 /* byteOffset */, recvData.length);
+
+                if (readSize < payload.length
+                        || !Arrays.equals(payload, 0, payload.length,
+                        recvData, readSize - payload.length, readSize)) {
+                    continue;
+                }
+                // If the control comes here then the payload was received, otherwise poll would
+                // have returned 0 or the test above would have matched it and gone to continue.
+                if (!expectPacketSent) {
+                    fail("Unexpectedly received the QUIC connection close packet.");
+                }
+
+                final ByteBuffer buf = ByteBuffer.wrap(recvData, 0 /* offset */, readSize);
+                if (isV6) {
+                    final Ipv6Header header = Struct.parse(Ipv6Header.class, buf);
+                    assertEquals(srcSockAddress.getAddress(), header.srcIp);
+                    assertEquals(dstSockAddress.getAddress(), header.dstIp);
+                } else {
+                    final Ipv4Header header = Struct.parse(Ipv4Header.class, buf);
+                    assertEquals(srcSockAddress.getAddress(), header.srcIp);
+                    assertEquals(dstSockAddress.getAddress(), header.dstIp);
+                }
+                final UdpHeader udpHeader = Struct.parse(UdpHeader.class, buf);
+                assertEquals(srcSockAddress.getPort(), udpHeader.srcPort);
+                assertEquals(dstSockAddress.getPort(), udpHeader.dstPort);
+                assertEquals(payload.length + Struct.getSize(UdpHeader.class), udpHeader.length);
+
+                if (!closeSocket) {
+                    // After the socket is destroyed and QUIC connection is closed by
+                    // ConnectivityService, writing to the UDP socket should throw.
+                    try {
+                        Os.write(sock, payload, 0 /* byteOffset */, payload.length);
+                        fail("Write to the destroyed socket must throw.");
+                    } catch (ErrnoException e) {
+                        assertEquals(EDESTADDRREQ, e.errno);
+                    }
+                    try {
+                        Os.sendto(sock, payload, 0 /* byteOffset */,
+                                payload.length, 0 /* flags */, dstSockAddress);
+                        fail("Sendto with the destroyed socket must throw.");
+                    } catch (ErrnoException e) {
+                        assertEquals(ECONNABORTED, e.errno);
+                    }
+                }
+                return;
+            }
+            if (expectPacketSent) {
+                fail("Did not receive the QUIC connection close packet.");
+            }
+        }, /* cleanup */ () -> {
+            runWithShellPermissionIdentity(() -> {
+                mContext.getSystemService(TestNetworkManager.class).teardownTestNetwork(
+                        testNetwork);
+            }, MANAGE_TEST_NETWORKS);
+            IoUtils.closeQuietly(tunFd);
+            IoUtils.closeQuietly(sock);
+            IoUtils.closeQuietly(pfd);
+        }, /* cleanup */ () -> {
+            // Restore firewall chain global status
+            runWithShellPermissionIdentity(() -> {
+                mCm.setFirewallChainEnabled(FIREWALL_CHAIN_BACKGROUND, wasChainEnabled);
+            }, NETWORK_SETTINGS);
+        }, /* cleanup */ () -> {
+            // Restore firewall chain status for myUid
+            runWithShellPermissionIdentity(() -> {
+                try {
+                    mCm.setUidFirewallRule(FIREWALL_CHAIN_BACKGROUND, myUid,
+                            previousUidFirewallRule);
+                } catch (IllegalStateException ignored) {
+                    // Removing match causes an exception when the rule entry for the uid does
+                    // not exist. But this is fine and can be ignored.
+                }
+            }, NETWORK_SETTINGS);
+        });
+    }
+
+    @Test
+    @IgnoreUpTo(Build.VERSION_CODES.R)
+    @ConnectivityModuleTest
+    @AppModeFull(reason = "Cannot create test network in instant app mode")
+    public void testRegisterQuicConnectionClosePayload_blockNetwork() throws Exception {
+        assumeTrue(mCm.isConnectivityServiceFeatureEnabledForTesting(CLOSE_QUIC_CONNECTION));
+
+        // Network is blocked while the connection close payload is registered.
+        // Packet should be sent.
+        doTestRegisterQuicConnectionClosePayload(
+                false /* isV6 */, false /* unregister */, false /* closeSocket */,
+                true /* blockNetwork */, true /* expectPacketSent */);
+        doTestRegisterQuicConnectionClosePayload(
+                true /* isV6 */, false /* unregister */, false /* closeSocket */,
+                true /* blockNetwork */, true /* expectPacketSent */);
+
+        // Network is blocked after the connection close payload is unregistered.
+        // Packet should not be sent.
+        doTestRegisterQuicConnectionClosePayload(
+                false /* isV6 */, true /* unregister */, false /* closeSocket */,
+                true /* blockNetwork */, false /* expectPacketSent */);
+        doTestRegisterQuicConnectionClosePayload(
+                true /* isV6 */, true /* unregister */, false /* closeSocket */,
+                true /* blockNetwork */, false /* expectPacketSent */);
+    }
+
+    @Test
+    @IgnoreUpTo(Build.VERSION_CODES.R)
+    @ConnectivityModuleTest
+    @AppModeFull(reason = "Cannot create test network in instant app mode")
+    public void testRegisterQuicConnectionClosePayload_closeSocket() throws Exception {
+        assumeTrue(mCm.isConnectivityServiceFeatureEnabledForTesting(CLOSE_QUIC_CONNECTION));
+
+        // Registered socket is closed while the connection close payload is registered.
+        // Packet should be sent. This simulates that apps crash or are killed.
+        doTestRegisterQuicConnectionClosePayload(
+                false /* isV6 */, false /* unregister */, true /* closeSocket */,
+                false /* blockNetwork */, true /* expectPacketSent */);
+        doTestRegisterQuicConnectionClosePayload(
+                true /* isV6 */, false /* unregister */, true /* closeSocket */,
+                false /* blockNetwork */, true /* expectPacketSent */);
+    }
+
+    /**
+     * Repeat register a connection close payload, unregister it, and then close the socket.
+     * The registered payload must not be sent because it is unregistered before the socket
+     * is closed.
+     * This test tries to detect threading issues between
+     * register/unregisterQuicConnectionClosePayload and socket destroy message handling.
+     */
+    @Test
+    @IgnoreUpTo(Build.VERSION_CODES.R)
+    @ConnectivityModuleTest
+    @AppModeFull(reason = "Cannot create test network in instant app mode")
+    public void testRegisterQuicConnectionClosePayload_closeSocketAfterUnregister()
+            throws Exception {
+        assumeTrue(mCm.isConnectivityServiceFeatureEnabledForTesting(CLOSE_QUIC_CONNECTION));
+
+        final ParcelFileDescriptor tunFd = setupTestNetworkAndGetFd();
+        final Network testNetwork = getTestNetwork();
+
+        final Random random = new Random();
+        final byte[] payload = new byte[100];
+        random.nextBytes(payload);
+
+        final InetSocketAddress dstSockAddress =
+                new InetSocketAddress(InetAddresses.parseNumericAddress("2001:db8:1:2::3"), 443);
+        for (int i = 0; i < 100; i++) {
+            final FileDescriptor sock = Os.socket(AF_INET6, SOCK_DGRAM, IPPROTO_UDP);
+            testNetwork.bindSocket(sock);
+            Os.connect(sock, dstSockAddress);
+
+            final ParcelFileDescriptor pfd = ParcelFileDescriptor.fromFd(sock.getInt$());
+            mCm.registerQuicConnectionClosePayload(pfd, payload);
+            mCm.unregisterQuicConnectionClosePayload(pfd);
+            Os.close(sock);
+            pfd.close();
+        }
+
+        testAndCleanup(() -> {
+            final long timeout = SystemClock.elapsedRealtime()
+                    + QUIC_CONNECTION_CLOSE_PACKET_TIMEOUT_MS;
+            long remainingTimeMs;
+            while ((remainingTimeMs = timeout - SystemClock.elapsedRealtime()) > 0) {
+                StructPollfd pollfd = new StructPollfd();
+                pollfd.events = (short) POLLIN;
+                pollfd.fd = tunFd.getFileDescriptor();
+                final int ret = Os.poll(new StructPollfd[]{pollfd}, (int) remainingTimeMs);
+                if (ret == 0) {
+                    continue;
+                }
+
+                final byte[] recvData = new byte[200];
+                final int readSize = Os.read(tunFd.getFileDescriptor(), recvData,
+                        0 /* byteOffset */, recvData.length);
+                if (readSize < payload.length
+                        || !Arrays.equals(payload, 0, payload.length,
+                        recvData, readSize - payload.length, readSize)) {
+                    continue;
+                }
+                fail("Unexpectedly received the QUIC connection close packet.");
+            }
+        }, /* cleanup */ () -> {
+            runWithShellPermissionIdentity(() -> {
+                mContext.getSystemService(TestNetworkManager.class).teardownTestNetwork(
+                        testNetwork);
+            }, MANAGE_TEST_NETWORKS);
+            IoUtils.closeQuietly(tunFd);
+        });
+    }
 }
diff --git a/tests/unit/java/com/android/server/ConnectivityServiceTest.java b/tests/unit/java/com/android/server/ConnectivityServiceTest.java
index 8c90e01086..bd26b95764 100755
--- a/tests/unit/java/com/android/server/ConnectivityServiceTest.java
+++ b/tests/unit/java/com/android/server/ConnectivityServiceTest.java
@@ -2188,6 +2188,7 @@ public class ConnectivityServiceTest {
                 case ConnectivityFlags.USE_DECLARED_METHODS_FOR_CALLBACKS:
                 case ConnectivityFlags.QUEUE_CALLBACKS_FOR_FROZEN_APPS:
                 case ConnectivityFlags.BACKGROUND_FIREWALL_CHAIN:
+                case ConnectivityFlags.CLOSE_QUIC_CONNECTION:
                 case ConnectivityService.KEY_DESTROY_FROZEN_SOCKETS_VERSION:
                     return true;
                 default:
diff --git a/tests/unit/java/com/android/server/connectivity/QuicConnectionCloserTest.kt b/tests/unit/java/com/android/server/connectivity/QuicConnectionCloserTest.kt
new file mode 100644
index 0000000000..9e1c090f2c
--- /dev/null
+++ b/tests/unit/java/com/android/server/connectivity/QuicConnectionCloserTest.kt
@@ -0,0 +1,232 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.server.connectivity
+
+import android.net.InetAddresses
+import android.net.LinkAddress
+import android.net.LinkProperties
+import android.net.Network
+import android.net.TEST_IFACE
+import android.os.Build
+import android.os.Handler
+import android.os.Looper
+import android.os.ParcelFileDescriptor
+import android.system.OsConstants.SOL_SOCKET
+import android.util.SparseArray
+import com.android.net.module.util.SkDestroyListener
+import com.android.net.module.util.netlink.InetDiagMessage
+import com.android.net.module.util.netlink.StructInetDiagSockId
+import com.android.net.module.util.netlink.StructNlMsgHdr
+import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
+import com.android.testutils.DevSdkIgnoreRunner
+import com.android.testutils.visibleOnHandlerThread
+import java.net.InetSocketAddress
+import java.util.function.Consumer
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.mockito.ArgumentCaptor
+import org.mockito.InOrder
+import org.mockito.Mockito.any
+import org.mockito.Mockito.anyLong
+import org.mockito.Mockito.doReturn
+import org.mockito.Mockito.eq
+import org.mockito.Mockito.inOrder
+import org.mockito.Mockito.mock
+import org.mockito.Mockito.never
+import org.mockito.Mockito.verify
+
+private const val TEST_UID = 1234
+private const val TEST_NETID = 789
+private const val TEST_SOCKET_COOKIE = 12321L
+
+// TODO: Use OsConstants.SO_MARK once this API is available
+private const val SO_MARK = 36
+
+private val TEST_SRC_ADDRESS = InetAddresses.parseNumericAddress("2001:db8:1:2::2")
+private val TEST_SRC_SOCKET_ADDRESS = InetSocketAddress(
+        TEST_SRC_ADDRESS,
+        1234
+)
+private val TEST_DST_SOCKET_ADDRESS = InetSocketAddress(
+        InetAddresses.parseNumericAddress("2001:db8:1:2::3"),
+        443
+)
+private val TEST_LP = LinkProperties().apply {
+    interfaceName = TEST_IFACE
+    addLinkAddress(LinkAddress(TEST_SRC_ADDRESS, 64))
+}
+private val TEST_NETWORK = Network(TEST_NETID)
+private val TEST_PAYLOAD = byteArrayOf(0, 1, 2, 3, 4, 5)
+
+@RunWith(DevSdkIgnoreRunner::class)
+@IgnoreUpTo(Build.VERSION_CODES.R)
+class QuicConnectionCloserTest {
+    private val pfd = mock(ParcelFileDescriptor::class.java)
+    private val skDestroyListener = mock(SkDestroyListener::class.java)
+    private val handler by lazy { Handler(Looper.getMainLooper()) }
+
+    private val mDeps = mock(QuicConnectionCloser.Dependencies::class.java).also {
+        doReturn(TEST_NETID).`when`(it).getsockoptInt(any(), eq(SOL_SOCKET), eq(SO_MARK))
+        doReturn(TEST_SOCKET_COOKIE).`when`(it).getSocketCookie(any())
+        doReturn(TEST_SRC_SOCKET_ADDRESS).`when`(it).getsockname(any())
+        doReturn(TEST_DST_SOCKET_ADDRESS).`when`(it).getpeername(any())
+        doReturn(skDestroyListener).`when`(it).makeSkDestroyListener(any(), any())
+    }
+
+    private val nai = mock(NetworkAgentInfo::class.java).also {
+        it.linkProperties = TEST_LP
+        doReturn(TEST_NETWORK).`when`(it).network()
+    }
+
+    private val networkForNetId = SparseArray<NetworkAgentInfo>().apply {
+        put(TEST_NETID, nai)
+    }
+
+    private val mQuicConnectionCloser = QuicConnectionCloser(networkForNetId, handler, mDeps)
+
+    private fun InOrder.expectDestroyUdpSocket() = verify(mDeps).destroyUdpSocket(
+            TEST_SRC_SOCKET_ADDRESS,
+            TEST_DST_SOCKET_ADDRESS,
+            TEST_SOCKET_COOKIE
+    )
+
+    private fun InOrder.assertNoDestroyUdpSocket() = verify(mDeps, never()).destroyUdpSocket(
+            any(),
+            any(),
+            anyLong()
+    )
+
+    private fun InOrder.expectSendQuicConnectionClosePayload() =
+            verify(mDeps).sendQuicConnectionClosePayload(
+                    TEST_NETWORK,
+                    TEST_SRC_SOCKET_ADDRESS,
+                    TEST_DST_SOCKET_ADDRESS,
+                    TEST_PAYLOAD
+            )
+
+    private fun InOrder.assertNoSendQuicConnectionClosePayload() =
+            verify(mDeps, never()).sendQuicConnectionClosePayload(
+                    any(),
+                    any(),
+                    any(),
+                    any()
+            )
+
+    @Test
+    fun testCloseQuicConnectionByUids() {
+        mQuicConnectionCloser.registerQuicConnectionClosePayload(TEST_UID, pfd, TEST_PAYLOAD)
+        visibleOnHandlerThread(handler) {
+            mQuicConnectionCloser.closeQuicConnectionByUids(setOf(TEST_UID))
+        }
+
+        val inOrder = inOrder(mDeps)
+        inOrder.expectDestroyUdpSocket()
+        inOrder.expectSendQuicConnectionClosePayload()
+    }
+
+    @Test
+    fun testCloseQuicConnectionByUids_unregisterQuicConnectionCloseInfo() {
+        mQuicConnectionCloser.registerQuicConnectionClosePayload(TEST_UID, pfd, TEST_PAYLOAD)
+        mQuicConnectionCloser.unregisterQuicConnectionClosePayload(pfd)
+        visibleOnHandlerThread(handler) {
+            mQuicConnectionCloser.closeQuicConnectionByUids(setOf(TEST_UID))
+        }
+
+        val inOrder = inOrder(mDeps)
+        inOrder.assertNoDestroyUdpSocket()
+        inOrder.assertNoSendQuicConnectionClosePayload()
+    }
+
+    @Test
+    fun testCloseQuicConnectionByUids_networkDisconnected() {
+        mQuicConnectionCloser.registerQuicConnectionClosePayload(TEST_UID, pfd, TEST_PAYLOAD)
+        // closeQuicConnectionByUids determines that the network is disconnected by
+        // checking if it's absent from the networkForNetId set.
+        synchronized (networkForNetId) {
+            networkForNetId.clear()
+        }
+        visibleOnHandlerThread(handler) {
+            mQuicConnectionCloser.closeQuicConnectionByUids(setOf(TEST_UID))
+        }
+
+        val inOrder = inOrder(mDeps)
+        inOrder.assertNoDestroyUdpSocket()
+        inOrder.assertNoSendQuicConnectionClosePayload()
+    }
+
+    @Test
+    fun testCloseQuicConnectionByUids_networkAddressChange() {
+        mQuicConnectionCloser.registerQuicConnectionClosePayload(TEST_UID, pfd, TEST_PAYLOAD)
+        // Update address to different address from TEST_SRC_SOCKET_ADDRESS
+        nai.linkProperties = LinkProperties().apply {
+            interfaceName = TEST_IFACE
+            addLinkAddress(LinkAddress(InetAddresses.parseNumericAddress("2001:db8:1:3::2"), 64))
+        }
+        visibleOnHandlerThread(handler) {
+            mQuicConnectionCloser.closeQuicConnectionByUids(setOf(TEST_UID))
+        }
+
+        val inOrder = inOrder(mDeps)
+        inOrder.assertNoDestroyUdpSocket()
+        inOrder.assertNoSendQuicConnectionClosePayload()
+    }
+
+    private fun getSkDestroyListenerCallback(): Consumer<InetDiagMessage> {
+        val captor = ArgumentCaptor.forClass(Consumer::class.java)
+                as ArgumentCaptor<Consumer<InetDiagMessage>>
+        verify(mDeps).makeSkDestroyListener(captor.capture(), any())
+        return captor.value
+    }
+
+    @Test
+    fun testHandleUdpSocketDestroy() {
+        mQuicConnectionCloser.registerQuicConnectionClosePayload(TEST_UID, pfd, TEST_PAYLOAD)
+
+        val inetDiagMessage = InetDiagMessage(StructNlMsgHdr())
+        inetDiagMessage.inetDiagMsg.id = StructInetDiagSockId(
+                TEST_SRC_SOCKET_ADDRESS,
+                TEST_DST_SOCKET_ADDRESS,
+                0 /* ifindex */,
+                TEST_SOCKET_COOKIE
+        )
+        getSkDestroyListenerCallback().accept(inetDiagMessage)
+
+        val inOrder = inOrder(mDeps)
+        // DestroyUdpSocket is not called since the socket is already closed
+        inOrder.assertNoDestroyUdpSocket()
+        inOrder.expectSendQuicConnectionClosePayload()
+    }
+
+    @Test
+    fun testHandleUdpSocketDestroy_unregisterBeforeSocketClose() {
+        mQuicConnectionCloser.registerQuicConnectionClosePayload(TEST_UID, pfd, TEST_PAYLOAD)
+        mQuicConnectionCloser.unregisterQuicConnectionClosePayload(pfd)
+
+        val inetDiagMessage = InetDiagMessage(StructNlMsgHdr())
+        inetDiagMessage.inetDiagMsg.id = StructInetDiagSockId(
+                TEST_SRC_SOCKET_ADDRESS,
+                TEST_DST_SOCKET_ADDRESS,
+                0 /* ifindex */,
+                TEST_SOCKET_COOKIE
+        )
+        getSkDestroyListenerCallback().accept(inetDiagMessage)
+
+        val inOrder = inOrder(mDeps)
+        inOrder.assertNoDestroyUdpSocket()
+        inOrder.assertNoSendQuicConnectionClosePayload()
+    }
+}
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSDestroySocketTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSDestroySocketTest.kt
index bc5be7865c..56d934bf51 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSDestroySocketTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSDestroySocketTest.kt
@@ -155,7 +155,6 @@ class CSDestroySocketTest : CSTest() {
     @Test
     fun testReplaceFirewallChain() {
         val netdEventListener = getRegisteredNetdUnsolicitedEventListener()
-        val inOrder = inOrder(destroySocketsWrapper)
 
         val cellAgent = Agent(nc = cellNc(), lp = cellLp())
         cellAgent.connect()
@@ -193,8 +192,8 @@ class CSDestroySocketTest : CSTest() {
                 .`when`(bpfNetMaps).getUidNetworkingBlockedReasons(TEST_UID2)
         cm.replaceFirewallChain(FIREWALL_CHAIN_BACKGROUND, intArrayOf(TEST_UID2))
         waitForIdle()
-        inOrder.verify(destroySocketsWrapper, never())
-                .destroyLiveTcpSocketsByOwnerUids(setOf(TEST_UID))
+        verify(destroySocketsWrapper, never()).destroyLiveTcpSocketsByOwnerUids(setOf(TEST_UID))
+        verify(quicConnectionCloser, never()).closeQuicConnectionByUids(setOf(TEST_UID))
 
         netdEventListener.onInterfaceClassActivityChanged(
                 true, // isActive
@@ -203,8 +202,8 @@ class CSDestroySocketTest : CSTest() {
                 TEST_UID
         )
         waitForIdle()
-        inOrder.verify(destroySocketsWrapper)
-                .destroyLiveTcpSocketsByOwnerUids(setOf(TEST_UID))
+        verify(destroySocketsWrapper).destroyLiveTcpSocketsByOwnerUids(setOf(TEST_UID))
+        verify(quicConnectionCloser).closeQuicConnectionByUids(setOf(TEST_UID))
 
         cellAgent.disconnect()
     }
@@ -277,8 +276,10 @@ class CSDestroySocketTest : CSTest() {
 
         if (expectDestroySockets) {
             verify(destroySocketsWrapper).destroyLiveTcpSocketsByOwnerUids(setOf(TEST_UID))
+            verify(quicConnectionCloser).closeQuicConnectionByUids(setOf(TEST_UID))
         } else {
             verify(destroySocketsWrapper, never()).destroyLiveTcpSocketsByOwnerUids(setOf(TEST_UID))
+            verify(quicConnectionCloser, never()).closeQuicConnectionByUids(setOf(TEST_UID))
         }
     }
 
diff --git a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
index 5c55483ee9..d7ecfd6159 100644
--- a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
@@ -58,6 +58,7 @@ import android.permission.PermissionManager.PermissionResult
 import android.telephony.SubscriptionManager
 import android.telephony.TelephonyManager
 import android.testing.TestableContext
+import android.util.SparseArray
 import androidx.test.platform.app.InstrumentationRegistry
 import com.android.internal.app.IBatteryStats
 import com.android.internal.util.test.BroadcastInterceptingContext
@@ -72,9 +73,11 @@ import com.android.server.connectivity.InterfaceTracker
 import com.android.server.connectivity.MulticastRoutingCoordinatorService
 import com.android.server.connectivity.MultinetworkPolicyTracker
 import com.android.server.connectivity.MultinetworkPolicyTrackerTestDependencies
+import com.android.server.connectivity.NetworkAgentInfo
 import com.android.server.connectivity.NetworkRequestStateStatsMetrics
 import com.android.server.connectivity.PermissionMonitor
 import com.android.server.connectivity.ProxyTracker
+import com.android.server.connectivity.QuicConnectionCloser
 import com.android.server.connectivity.SatelliteAccessController
 import com.android.testutils.visibleOnHandlerThread
 import com.android.testutils.waitForIdle
@@ -171,6 +174,7 @@ open class CSTest {
         it[ConnectivityFlags.USE_DECLARED_METHODS_FOR_CALLBACKS] = true
         it[ConnectivityFlags.QUEUE_CALLBACKS_FOR_FROZEN_APPS] = true
         it[ConnectivityFlags.QUEUE_NETWORK_AGENT_EVENTS_IN_SYSTEM_SERVER] = true
+        it[ConnectivityFlags.CLOSE_QUIC_CONNECTION] = true
     }
     fun setFeatureEnabled(flag: String, enabled: Boolean) = enabledFeatures.set(flag, enabled)
 
@@ -219,6 +223,7 @@ open class CSTest {
 
     val multicastRoutingCoordinatorService = mock<MulticastRoutingCoordinatorService>()
     val satelliteAccessController = mock<SatelliteAccessController>()
+    val quicConnectionCloser = mock<QuicConnectionCloser>()
     val destroySocketsWrapper = mock<DestroySocketsWrapper>()
 
     val deps = CSDeps()
@@ -412,6 +417,11 @@ open class CSTest {
         }
 
         override fun makeL2capNetworkProvider(context: Context) = null
+
+        override fun makeQuicConnectionCloser(
+                networkForNetId: SparseArray<NetworkAgentInfo>,
+                handler: Handler
+        ): QuicConnectionCloser = quicConnectionCloser
     }
 
     inner class PermDeps : PermissionMonitor.Dependencies() {

From 4d4563d62a02f5fee4b5806c88f8c9e644d9f064 Mon Sep 17 00:00:00 2001
From: Motomu Utsumi <motomuman@google.com>
Date: Wed, 26 Mar 2025 14:57:01 -0700
Subject: [PATCH 022/377] Revert "Revert "Remove unnecessary ifindex arg from
 destroyUdpSo..."

Revert submission 3561690-revert-3538339-SNUWWZJNJZ

Reason for revert: NewAPI error will be fixed by separate CL

Reverted changes: /q/submissionid:3561690-revert-3538339-SNUWWZJNJZ

Change-Id: I2ae43c61c9ba0e0db3202a46e63756a3ea5a6512
---
 .../com/android/server/connectivity/QuicConnectionCloser.java | 2 +-
 .../com/android/net/module/util/netlink/InetDiagMessage.java  | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/service/src/com/android/server/connectivity/QuicConnectionCloser.java b/service/src/com/android/server/connectivity/QuicConnectionCloser.java
index ce5d61c92b..c064cf3a5b 100644
--- a/service/src/com/android/server/connectivity/QuicConnectionCloser.java
+++ b/service/src/com/android/server/connectivity/QuicConnectionCloser.java
@@ -139,7 +139,7 @@ public class QuicConnectionCloser {
         public void destroyUdpSocket(final InetSocketAddress src, final InetSocketAddress dst,
                 final long cookie)
                 throws SocketException, InterruptedIOException, ErrnoException {
-            InetDiagMessage.destroyUdpSocket(src, dst, 0 /* ifindex */, cookie);
+            InetDiagMessage.destroyUdpSocket(src, dst, cookie);
         }
 
         /**
diff --git a/staticlibs/device/com/android/net/module/util/netlink/InetDiagMessage.java b/staticlibs/device/com/android/net/module/util/netlink/InetDiagMessage.java
index c9a89ec1dd..f776f4755f 100644
--- a/staticlibs/device/com/android/net/module/util/netlink/InetDiagMessage.java
+++ b/staticlibs/device/com/android/net/module/util/netlink/InetDiagMessage.java
@@ -491,7 +491,7 @@ public class InetDiagMessage extends NetlinkMessage {
      * Close the udp socket which can be uniquely identified with the cookie and other information.
      */
     public static void destroyUdpSocket(final InetSocketAddress src, final InetSocketAddress dst,
-            final int ifIndex, final long cookie)
+            final long cookie)
             throws ErrnoException, SocketException, InterruptedIOException {
         FileDescriptor fd = null;
 
@@ -502,7 +502,7 @@ public class InetDiagMessage extends NetlinkMessage {
             final StructInetDiagSockId id = new StructInetDiagSockId(
                     src,
                     dst,
-                    ifIndex,
+                    0 /* ifIndex */,
                     cookie
             );
             sendNetlinkDestroyRequest(fd, IPPROTO_UDP, id, (short) family, 0 /* state */);

From 8775fc7cf6e1e472327ba9a5ef711c35f7d044c8 Mon Sep 17 00:00:00 2001
From: Motomu Utsumi <motomuman@google.com>
Date: Thu, 27 Mar 2025 12:21:31 +0900
Subject: [PATCH 023/377] Add TargetApi annotation to ConnectivityService and
 QuicConnectionCloser

Test: TH
Change-Id: I5339b986d04462710ff9e9469050741f35ca4448
---
 service/src/com/android/server/ConnectivityService.java        | 1 +
 .../com/android/server/connectivity/QuicConnectionCloser.java  | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index 7f317930a4..c870edc94f 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -438,6 +438,7 @@ import java.util.function.Predicate;
 /**
  * @hide
  */
+@TargetApi(Build.VERSION_CODES.S)
 public class ConnectivityService extends IConnectivityManager.Stub {
     private static final String TAG = ConnectivityService.class.getSimpleName();
 
diff --git a/service/src/com/android/server/connectivity/QuicConnectionCloser.java b/service/src/com/android/server/connectivity/QuicConnectionCloser.java
index c064cf3a5b..c582d60f4f 100644
--- a/service/src/com/android/server/connectivity/QuicConnectionCloser.java
+++ b/service/src/com/android/server/connectivity/QuicConnectionCloser.java
@@ -21,8 +21,10 @@ import static android.system.OsConstants.SOL_SOCKET;
 import static android.system.OsConstants.SO_SNDTIMEO;
 
 import android.annotation.NonNull;
+import android.annotation.TargetApi;
 import android.net.Network;
 import android.net.NetworkUtils;
+import android.os.Build;
 import android.os.Handler;
 import android.os.ParcelFileDescriptor;
 import android.system.ErrnoException;
@@ -53,6 +55,7 @@ import java.util.Map;
 import java.util.Set;
 import java.util.function.Consumer;
 
+@TargetApi(Build.VERSION_CODES.S)
 public class QuicConnectionCloser {
     private static final String TAG = QuicConnectionCloser.class.getSimpleName();
 

From 65ce25496bb6c035d7743ded88201a607815fb0f Mon Sep 17 00:00:00 2001
From: Sarup Dalwani <sarup@google.com>
Date: Wed, 26 Mar 2025 21:50:17 -0700
Subject: [PATCH 024/377] Changing from EnabledAfter to Disabled for
 RESTRICT_LOCAL_NETWORK

The adb app compat command to enable fails for platform being old. Making this flag as disabled by default and overridable.

Bug: 405186661
Test: atest ConnectivityCoverageTests
Flag: EXEMPT bugfix
Change-Id: Ia1242803ed9b02290a5b66c4d1e224c87450d370
---
 .../android/net/connectivity/ConnectivityCompatChanges.java    | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/framework/src/android/net/connectivity/ConnectivityCompatChanges.java b/framework/src/android/net/connectivity/ConnectivityCompatChanges.java
index acf8e85812..27d605acf9 100644
--- a/framework/src/android/net/connectivity/ConnectivityCompatChanges.java
+++ b/framework/src/android/net/connectivity/ConnectivityCompatChanges.java
@@ -16,6 +16,7 @@
 package android.net.connectivity;
 
 import android.compat.annotation.ChangeId;
+import android.compat.annotation.Disabled;
 import android.compat.annotation.EnabledAfter;
 import android.compat.annotation.EnabledSince;
 import android.os.Build;
@@ -145,7 +146,7 @@ public final class ConnectivityCompatChanges {
      * @hide
      */
     @ChangeId
-    @EnabledAfter(targetSdkVersion = 36)
+    @Disabled
     public static final long RESTRICT_LOCAL_NETWORK = 365139289L;
 
     /**

From 3dc5357c0b6eedc174746b2f65f40eacb54e6a6c Mon Sep 17 00:00:00 2001
From: Paul Hu <paulhu@google.com>
Date: Tue, 18 Mar 2025 06:21:59 +0000
Subject: [PATCH 025/377] Move responseMatchesOptions() to MdnsUtils

Move utility method responseMatchesOptions() to MdnsUtils, where
it can be used by other mDNS classes.

Bug: 387910548
Test: atest ConnectivityCoverageTests NsdManagerTest
Change-Id: Idecd5e7d4c2c4dcf108c42e07a7befd97b68b5a7
---
 .../mdns/MdnsServiceTypeClient.java           |  38 +++---
 .../connectivity/mdns/util/MdnsUtils.java     |  32 ++++++
 .../connectivity/mdns/util/MdnsUtilsTest.kt   | 108 ++++++++++++++++++
 3 files changed, 155 insertions(+), 23 deletions(-)

diff --git a/service-t/src/com/android/server/connectivity/mdns/MdnsServiceTypeClient.java b/service-t/src/com/android/server/connectivity/mdns/MdnsServiceTypeClient.java
index 95f4fffa7a..4b25e82275 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MdnsServiceTypeClient.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MdnsServiceTypeClient.java
@@ -23,6 +23,7 @@ import static com.android.server.connectivity.mdns.MdnsServiceCache.findMatchedR
 import static com.android.server.connectivity.mdns.MdnsQueryScheduler.ScheduledQueryTaskArgs;
 import static com.android.server.connectivity.mdns.util.MdnsUtils.Clock;
 import static com.android.server.connectivity.mdns.util.MdnsUtils.buildMdnsServiceInfoFromResponse;
+import static com.android.server.connectivity.mdns.util.MdnsUtils.responseMatchesInstanceNameAndSubtypes;
 
 import android.annotation.NonNull;
 import android.annotation.Nullable;
@@ -363,7 +364,10 @@ public class MdnsServiceTypeClient {
         listeners.put(listener, listenerInfo);
         if (existingInfo == null) {
             for (MdnsResponse existingResponse : serviceCache.getCachedServices(cacheKey)) {
-                if (!responseMatchesOptions(existingResponse, searchOptions)) continue;
+                if (!responseMatchesInstanceNameAndSubtypes(existingResponse,
+                        searchOptions.getResolveInstanceName(), searchOptions.getSubtypes())) {
+                    continue;
+                }
                 final MdnsServiceInfo info = buildMdnsServiceInfoFromResponse(
                         existingResponse, serviceTypeLabels, clock.elapsedRealtime());
                 listener.onServiceNameDiscovered(info, true /* isServiceFromCache */);
@@ -460,26 +464,6 @@ public class MdnsServiceTypeClient {
         ++currentSessionId;
     }
 
-    private boolean responseMatchesOptions(@NonNull MdnsResponse response,
-            @NonNull MdnsSearchOptions options) {
-        final boolean matchesInstanceName = options.getResolveInstanceName() == null
-                // DNS is case-insensitive, so ignore case in the comparison
-                || DnsUtils.equalsIgnoreDnsCase(options.getResolveInstanceName(),
-                response.getServiceInstanceName());
-
-        // If discovery is requiring some subtypes, the response must have one that matches a
-        // requested one.
-        final List<String> responseSubtypes = response.getSubtypes() == null
-                ? Collections.emptyList() : response.getSubtypes();
-        final boolean matchesSubtype = options.getSubtypes().size() == 0
-                || CollectionUtils.any(options.getSubtypes(), requiredSub ->
-                CollectionUtils.any(responseSubtypes, actualSub ->
-                        DnsUtils.equalsIgnoreDnsCase(
-                                MdnsConstants.SUBTYPE_PREFIX + requiredSub, actualSub)));
-
-        return matchesInstanceName && matchesSubtype;
-    }
-
     /**
      * Unregisters {@code listener} from receiving discovery event of mDNS service instances.
      *
@@ -577,7 +561,11 @@ public class MdnsServiceTypeClient {
     private void notifyRemovedServiceToListeners(@NonNull MdnsResponse response,
             @NonNull String message) {
         for (int i = 0; i < listeners.size(); i++) {
-            if (!responseMatchesOptions(response, listeners.valueAt(i).searchOptions)) continue;
+            if (!responseMatchesInstanceNameAndSubtypes(response,
+                    listeners.valueAt(i).searchOptions.getResolveInstanceName(),
+                    listeners.valueAt(i).searchOptions.getSubtypes())) {
+                continue;
+            }
             final MdnsServiceBrowserListener listener = listeners.keyAt(i);
             if (response.getServiceInstanceName() != null) {
                 listeners.valueAt(i).unsetServiceDiscovered(response.getServiceInstanceName());
@@ -634,7 +622,11 @@ public class MdnsServiceTypeClient {
             // subtype), service lost callbacks should also be sent; this is not done today as
             // only expiration of SRV records is used, not PTR records used for subtypes, so
             // services never lose PTR record subtypes.
-            if (!responseMatchesOptions(response, listeners.valueAt(i).searchOptions)) continue;
+            if (!responseMatchesInstanceNameAndSubtypes(response,
+                    listeners.valueAt(i).searchOptions.getResolveInstanceName(),
+                    listeners.valueAt(i).searchOptions.getSubtypes())) {
+                continue;
+            }
             final MdnsServiceBrowserListener listener = listeners.keyAt(i);
             final ListenerInfo listenerInfo = listeners.valueAt(i);
             final boolean newServiceFound = listenerInfo.setServiceDiscovered(serviceInstanceName);
diff --git a/service-t/src/com/android/server/connectivity/mdns/util/MdnsUtils.java b/service-t/src/com/android/server/connectivity/mdns/util/MdnsUtils.java
index 282ca9ab5d..996e8a5af9 100644
--- a/service-t/src/com/android/server/connectivity/mdns/util/MdnsUtils.java
+++ b/service-t/src/com/android/server/connectivity/mdns/util/MdnsUtils.java
@@ -29,6 +29,7 @@ import android.util.ArraySet;
 import android.util.Pair;
 
 import com.android.net.module.util.CollectionUtils;
+import com.android.net.module.util.DnsUtils;
 import com.android.server.connectivity.mdns.MdnsConstants;
 import com.android.server.connectivity.mdns.MdnsInetAddressRecord;
 import com.android.server.connectivity.mdns.MdnsPacket;
@@ -51,6 +52,7 @@ import java.nio.charset.StandardCharsets;
 import java.time.Instant;
 import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.Collection;
 import java.util.Collections;
 import java.util.HashSet;
 import java.util.List;
@@ -364,4 +366,34 @@ public class MdnsUtils {
                 response.getNetwork(),
                 now.plusMillis(response.getMinRemainingTtl(elapsedRealtimeMillis)));
     }
+
+    /**
+     * Checks if an MDNS response matches a given instance name and a collection of subtypes.
+     *
+     * <p>This method performs a case-insensitive comparison of the instance name and subtypes,
+     * respecting DNS conventions.
+     *
+     * @param response     The MDNS response to check.
+     * @param instanceName The instance name to match, or null to ignore instance name matching.
+     * @param subtypes     The collection of subtypes to match.
+     * @return {@code true} if the response matches the instance name and at least one of the
+     * specified subtypes (if any), {@code false} otherwise.
+     */
+    public static boolean responseMatchesInstanceNameAndSubtypes(@NonNull MdnsResponse response,
+            @Nullable String instanceName, @NonNull Collection<String> subtypes) {
+        final boolean matchesInstanceName = instanceName == null
+                // DNS is case-insensitive, so ignore case in the comparison
+                || DnsUtils.equalsIgnoreDnsCase(instanceName, response.getServiceInstanceName());
+
+        // If discovery is requiring some subtypes, the response must have one that matches a
+        // requested one.
+        final List<String> responseSubtypes = response.getSubtypes() == null
+                ? Collections.emptyList() : response.getSubtypes();
+        final boolean matchesSubtype = subtypes.size() == 0
+                || CollectionUtils.any(subtypes, requiredSub ->
+                CollectionUtils.any(responseSubtypes, actualSub ->
+                        DnsUtils.equalsIgnoreDnsCase(
+                                MdnsConstants.SUBTYPE_PREFIX + requiredSub, actualSub)));
+        return matchesInstanceName && matchesSubtype;
+    }
 }
\ No newline at end of file
diff --git a/tests/unit/java/com/android/server/connectivity/mdns/util/MdnsUtilsTest.kt b/tests/unit/java/com/android/server/connectivity/mdns/util/MdnsUtilsTest.kt
index 2253913ed9..0e4bd47858 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/util/MdnsUtilsTest.kt
+++ b/tests/unit/java/com/android/server/connectivity/mdns/util/MdnsUtilsTest.kt
@@ -18,6 +18,7 @@ package com.android.server.connectivity.mdns.util
 
 import android.net.InetAddresses
 import android.os.Build
+import com.android.net.module.util.CollectionUtils
 import com.android.server.connectivity.mdns.MdnsConstants
 import com.android.server.connectivity.mdns.MdnsConstants.FLAG_TRUNCATED
 import com.android.server.connectivity.mdns.MdnsConstants.IPV4_SOCKET_ADDR
@@ -32,6 +33,7 @@ import com.android.server.connectivity.mdns.MdnsServiceInfo
 import com.android.server.connectivity.mdns.MdnsServiceRecord
 import com.android.server.connectivity.mdns.MdnsTextRecord
 import com.android.server.connectivity.mdns.util.MdnsUtils.createQueryDatagramPackets
+import com.android.server.connectivity.mdns.util.MdnsUtils.responseMatchesInstanceNameAndSubtypes
 import com.android.server.connectivity.mdns.util.MdnsUtils.truncateServiceName
 import com.android.testutils.DevSdkIgnoreRule
 import com.android.testutils.DevSdkIgnoreRunner
@@ -228,4 +230,110 @@ class MdnsUtilsTest {
         assertEquals(null, serviceInfo.network)
         assertEquals(mapOf("somedifferent" to "entry"), serviceInfo.attributes)
     }
+
+    private fun createResponse(
+            serviceInstanceName: String,
+            serviceType: String,
+            subType: String? = null
+    ): MdnsResponse {
+        val serviceTypeArray = if (subType != null) {
+            MdnsUtils.constructFullSubtype(
+                serviceType.split(".").toTypedArray(),
+                "_$subType"
+            )
+        } else {
+            serviceType.split(".").toTypedArray()
+        }
+        val serviceNameArray = CollectionUtils.prependArray(
+                String::class.java,
+                serviceTypeArray,
+                serviceInstanceName
+        )
+        val response =
+            MdnsResponse(0 /* now */, serviceNameArray, 99 /* interfaceIndex */, null /* network */)
+        response.addPointerRecord(MdnsPointerRecord(
+                serviceTypeArray,
+                120000L /* receiptTimeMillis */,
+                false /* cacheFlush */,
+                0L /* ttlTime */,
+                serviceNameArray
+        ))
+        return response
+    }
+
+    @Test
+    fun testResponseMatchesInstanceNameAndSubtypes() {
+        val serviceInstanceName = "MyTestService"
+        val serviceType = "_testservice._tcp.local"
+        val subType = "subtype"
+        val response = createResponse(serviceInstanceName, serviceType)
+        val responseWithSubType = createResponse(serviceInstanceName, serviceType, subType)
+
+        // No instance name and subtypes
+        assertTrue(responseMatchesInstanceNameAndSubtypes(
+                response,
+                null /* instanceName */,
+                emptyList() /* subTypes */
+        ))
+        assertTrue(responseMatchesInstanceNameAndSubtypes(
+                responseWithSubType,
+                null /* instanceName */,
+                emptyList() /* subTypes */
+        ))
+        // Has instance name but no subtypes
+        assertTrue(responseMatchesInstanceNameAndSubtypes(
+                response,
+                serviceInstanceName,
+                emptyList() /* subTypes */
+        ))
+        assertTrue(responseMatchesInstanceNameAndSubtypes(
+                responseWithSubType,
+                serviceInstanceName,
+                emptyList() /* subTypes */
+        ))
+        // Has subtypes but no instance name
+        assertFalse(responseMatchesInstanceNameAndSubtypes(
+                response,
+                null /* instanceName */,
+                listOf(subType)
+        ))
+        assertTrue(responseMatchesInstanceNameAndSubtypes(
+                responseWithSubType,
+                null /* instanceName */,
+                listOf(subType)
+        ))
+        // Has both instance name and subtypes
+        assertFalse(responseMatchesInstanceNameAndSubtypes(
+                response,
+                serviceInstanceName,
+                listOf(subType)
+        ))
+        assertTrue(responseMatchesInstanceNameAndSubtypes(
+                responseWithSubType,
+                serviceInstanceName,
+                listOf(subType)
+        ))
+        // Has other instance name
+        assertFalse(responseMatchesInstanceNameAndSubtypes(
+                response,
+                "OtherTestService",
+                emptyList() /* subTypes */
+        ))
+        assertFalse(responseMatchesInstanceNameAndSubtypes(
+                responseWithSubType,
+                "OtherTestService",
+                emptyList() /* subTypes */
+        ))
+        // Has other subtypes
+        assertFalse(responseMatchesInstanceNameAndSubtypes(
+                response,
+                null /* instanceName */,
+                listOf("othersubtype")
+        ))
+        assertFalse(responseMatchesInstanceNameAndSubtypes(
+                responseWithSubType,
+                null /* instanceName */,
+                listOf("othersubtype")
+        ))
+    }
 }

From f9ef31d4ea54a1c9e60f793d176259ca00a2e566 Mon Sep 17 00:00:00 2001
From: Chalard Jean <jchalard@google.com>
Date: Mon, 17 Mar 2025 14:23:54 +0900
Subject: [PATCH 026/377] Pretty print AutodestructReference

Test: manual
Flag: EXEMPT logging-only change
Change-Id: I9eebe7e02704f92fe01b7c6abfec991aed8edc0b
---
 .../android/server/connectivity/AutodestructReference.java   | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/service/src/com/android/server/connectivity/AutodestructReference.java b/service/src/com/android/server/connectivity/AutodestructReference.java
index 009a43e582..bb1abba237 100644
--- a/service/src/com/android/server/connectivity/AutodestructReference.java
+++ b/service/src/com/android/server/connectivity/AutodestructReference.java
@@ -39,4 +39,9 @@ public class AutodestructReference<T> {
         if (null == obj) throw new NullPointerException("Already autodestructed");
         return obj;
     }
+
+    @Override
+    public String toString() {
+        return "Autodestruct<" + mHeld.getAcquire() + ">";
+    }
 }

From f7e102081d578454ed9eea8616927fbf5100a6ce Mon Sep 17 00:00:00 2001
From: Chalard Jean <jchalard@google.com>
Date: Fri, 28 Mar 2025 18:09:13 +0900
Subject: [PATCH 027/377] Make NetworkAgent#sendNetworkInfo public again

Changing this method to private broke OEM code that would link
directly against the non-public methods of the module. This
should not be allowed, and we have changes in the works to
disallow this, but in the mean time we can't afford to break
devices in the field.

Test: will have to see how it behaves in the lab on relevant devices
Flag: EXEMPT bugfix
Bug: 406489362
Change-Id: Ie6c1ebb04e49317fdda34ff3dd522cd9d4677556
---
 framework/src/android/net/NetworkAgent.java | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/framework/src/android/net/NetworkAgent.java b/framework/src/android/net/NetworkAgent.java
index 95b45ce481..d5a1ef3e13 100644
--- a/framework/src/android/net/NetworkAgent.java
+++ b/framework/src/android/net/NetworkAgent.java
@@ -1236,7 +1236,11 @@ public abstract class NetworkAgent {
      * @hide TODO: expose something better.
      */
     @UnsupportedAppUsage(maxTargetSdk = Build.VERSION_CODES.P, trackingBug = 115609023)
-    private void sendNetworkInfo(final NetworkInfo networkInfo) {
+    // Note : this should be private, but is still called by some OEM network agents
+    // linking against the full module. They should not do this, and it should be
+    // forbidden, but as long as there are such devices this can't be made private
+    // on pain of breaking them.
+    public void sendNetworkInfo(final NetworkInfo networkInfo) {
         final NetworkInfo ni = new NetworkInfo(networkInfo);
         send(reg -> reg.sendNetworkInfo(ni));
     }

From 0bf58dac22519c5b7321eb620377062f77e86715 Mon Sep 17 00:00:00 2001
From: Bessie Jiang <bessiej@google.com>
Date: Thu, 27 Mar 2025 18:34:39 +0000
Subject: [PATCH 028/377] Log when an IOException when reading the public key,
 content or metadata file for CT signature verification

Flag: com.android.net.ct.flags.certificate_transparency_service
Bug: 378626065
Test: atest NetworkSecurityUnitTests
Change-Id: I2df5933f4cb39b82620f8bdd391ca800dfcf8ede
---
 .../ct/CertificateTransparencyDownloader.java |  9 +----
 .../net/ct/CertificateTransparencyLogger.java |  1 +
 .../ct/CertificateTransparencyLoggerImpl.java |  3 ++
 .../server/net/ct/LogListUpdateStatus.java    |  8 +++-
 .../server/net/ct/SignatureVerifier.java      | 12 +++++-
 ...CertificateTransparencyDownloaderTest.java | 39 +++++++++++++++++++
 6 files changed, 60 insertions(+), 12 deletions(-)

diff --git a/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyDownloader.java b/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyDownloader.java
index a477cc8559..e608417fcc 100644
--- a/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyDownloader.java
+++ b/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyDownloader.java
@@ -150,14 +150,7 @@ class CertificateTransparencyDownloader extends BroadcastReceiver {
             return;
         }
 
-        LogListUpdateStatus updateStatus;
-        try {
-            updateStatus = mSignatureVerifier.setPublicKeyFrom(publicKeyUri);
-        } catch (IOException e) {
-            Log.e(TAG, "Error setting the public Key", e);
-            return;
-        }
-
+        LogListUpdateStatus updateStatus = mSignatureVerifier.setPublicKeyFrom(publicKeyUri);
         if (!updateStatus.isPublicKeySet()) {
             mLogger.logCTLogListUpdateStateChangedEvent(updateStatus);
             return;
diff --git a/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyLogger.java b/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyLogger.java
index 8d13e452b5..b9c6d33533 100644
--- a/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyLogger.java
+++ b/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyLogger.java
@@ -43,6 +43,7 @@ public interface CertificateTransparencyLogger {
         SIGNATURE_NOT_FOUND,
         SIGNATURE_VERIFICATION_FAILED,
         SUCCESS,
+        UNABLE_TO_READ_FILE,
         VERSION_ALREADY_EXISTS
     }
 }
\ No newline at end of file
diff --git a/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyLoggerImpl.java b/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyLoggerImpl.java
index 12cdef32a2..b551d870d1 100644
--- a/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyLoggerImpl.java
+++ b/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyLoggerImpl.java
@@ -29,6 +29,7 @@ import static com.android.server.net.ct.CertificateTransparencyStatsLog.CERTIFIC
 import static com.android.server.net.ct.CertificateTransparencyStatsLog.CERTIFICATE_TRANSPARENCY_LOG_LIST_UPDATE_STATE_CHANGED__UPDATE_STATUS__FAILURE_SIGNATURE_NOT_FOUND;
 import static com.android.server.net.ct.CertificateTransparencyStatsLog.CERTIFICATE_TRANSPARENCY_LOG_LIST_UPDATE_STATE_CHANGED__UPDATE_STATUS__FAILURE_SIGNATURE_VERIFICATION;
 import static com.android.server.net.ct.CertificateTransparencyStatsLog.CERTIFICATE_TRANSPARENCY_LOG_LIST_UPDATE_STATE_CHANGED__UPDATE_STATUS__FAILURE_TOO_MANY_REDIRECTS;
+import static com.android.server.net.ct.CertificateTransparencyStatsLog.CERTIFICATE_TRANSPARENCY_LOG_LIST_UPDATE_STATE_CHANGED__UPDATE_STATUS__FAILURE_UNABLE_TO_READ_FILE;
 import static com.android.server.net.ct.CertificateTransparencyStatsLog.CERTIFICATE_TRANSPARENCY_LOG_LIST_UPDATE_STATE_CHANGED__UPDATE_STATUS__FAILURE_UNKNOWN;
 import static com.android.server.net.ct.CertificateTransparencyStatsLog.CERTIFICATE_TRANSPARENCY_LOG_LIST_UPDATE_STATE_CHANGED__UPDATE_STATUS__FAILURE_VERSION_ALREADY_EXISTS;
 import static com.android.server.net.ct.CertificateTransparencyStatsLog.CERTIFICATE_TRANSPARENCY_LOG_LIST_UPDATE_STATE_CHANGED__UPDATE_STATUS__PENDING_WAITING_FOR_WIFI;
@@ -149,6 +150,8 @@ class CertificateTransparencyLoggerImpl implements CertificateTransparencyLogger
                 return CERTIFICATE_TRANSPARENCY_LOG_LIST_UPDATE_STATE_CHANGED__UPDATE_STATUS__FAILURE_SIGNATURE_VERIFICATION;
             case SUCCESS:
                 return CERTIFICATE_TRANSPARENCY_LOG_LIST_UPDATE_STATE_CHANGED__UPDATE_STATUS__SUCCESS;
+            case UNABLE_TO_READ_FILE:
+                return CERTIFICATE_TRANSPARENCY_LOG_LIST_UPDATE_STATE_CHANGED__UPDATE_STATUS__FAILURE_UNABLE_TO_READ_FILE;
             case VERSION_ALREADY_EXISTS:
                 return CERTIFICATE_TRANSPARENCY_LOG_LIST_UPDATE_STATE_CHANGED__UPDATE_STATUS__FAILURE_VERSION_ALREADY_EXISTS;
             case UNKNOWN_STATE:
diff --git a/networksecurity/service/src/com/android/server/net/ct/LogListUpdateStatus.java b/networksecurity/service/src/com/android/server/net/ct/LogListUpdateStatus.java
index df32e42b69..8b27529b45 100644
--- a/networksecurity/service/src/com/android/server/net/ct/LogListUpdateStatus.java
+++ b/networksecurity/service/src/com/android/server/net/ct/LogListUpdateStatus.java
@@ -22,6 +22,7 @@ import static com.android.server.net.ct.CertificateTransparencyLogger.CTLogListU
 import static com.android.server.net.ct.CertificateTransparencyLogger.CTLogListUpdateState.SIGNATURE_NOT_FOUND;
 import static com.android.server.net.ct.CertificateTransparencyLogger.CTLogListUpdateState.SIGNATURE_VERIFICATION_FAILED;
 import static com.android.server.net.ct.CertificateTransparencyLogger.CTLogListUpdateState.SUCCESS;
+import static com.android.server.net.ct.CertificateTransparencyLogger.CTLogListUpdateState.UNABLE_TO_READ_FILE;
 
 import com.android.server.net.ct.CertificateTransparencyLogger.CTLogListUpdateState;
 
@@ -45,7 +46,9 @@ public abstract class LogListUpdateStatus {
 
     boolean isPublicKeySet() {
         // Check that none of the public key setting failures have been set as the state
-        return state() != PUBLIC_KEY_INVALID && state() != PUBLIC_KEY_NOT_ALLOWED;
+        return state() != PUBLIC_KEY_INVALID
+                && state() != PUBLIC_KEY_NOT_ALLOWED
+                && state() != UNABLE_TO_READ_FILE;
     }
 
     boolean isSignatureVerified() {
@@ -53,7 +56,8 @@ public abstract class LogListUpdateStatus {
         return state() != PUBLIC_KEY_NOT_FOUND
                 && state() != SIGNATURE_INVALID
                 && state() != SIGNATURE_NOT_FOUND
-                && state() != SIGNATURE_VERIFICATION_FAILED;
+                && state() != SIGNATURE_VERIFICATION_FAILED
+                && state() != UNABLE_TO_READ_FILE;
     }
 
     boolean hasSignature() {
diff --git a/networksecurity/service/src/com/android/server/net/ct/SignatureVerifier.java b/networksecurity/service/src/com/android/server/net/ct/SignatureVerifier.java
index 22953f42b4..42bba035fb 100644
--- a/networksecurity/service/src/com/android/server/net/ct/SignatureVerifier.java
+++ b/networksecurity/service/src/com/android/server/net/ct/SignatureVerifier.java
@@ -21,6 +21,7 @@ import static com.android.server.net.ct.CertificateTransparencyLogger.CTLogListU
 import static com.android.server.net.ct.CertificateTransparencyLogger.CTLogListUpdateState.SIGNATURE_INVALID;
 import static com.android.server.net.ct.CertificateTransparencyLogger.CTLogListUpdateState.SIGNATURE_NOT_FOUND;
 import static com.android.server.net.ct.CertificateTransparencyLogger.CTLogListUpdateState.SIGNATURE_VERIFICATION_FAILED;
+import static com.android.server.net.ct.CertificateTransparencyLogger.CTLogListUpdateState.UNABLE_TO_READ_FILE;
 
 import android.annotation.NonNull;
 import android.annotation.RequiresApi;
@@ -86,9 +87,12 @@ public class SignatureVerifier {
         mPublicKey = Optional.empty();
     }
 
-    LogListUpdateStatus setPublicKeyFrom(Uri file) throws IOException {
+    LogListUpdateStatus setPublicKeyFrom(Uri file) {
         try (InputStream fileStream = mContext.getContentResolver().openInputStream(file)) {
             return setPublicKey(new String(fileStream.readAllBytes()));
+        } catch (IOException e) {
+            Log.e(TAG, "Could not read the public key file", e);
+            return LogListUpdateStatus.builder().setState(UNABLE_TO_READ_FILE).build();
         }
     }
 
@@ -153,7 +157,11 @@ public class SignatureVerifier {
             Log.e(TAG, "Key invalid for log list verification", e);
             statusBuilder.setState(SIGNATURE_INVALID);
             return statusBuilder.build();
-        } catch (IOException | GeneralSecurityException e) {
+        } catch (IOException e) {
+            Log.e(TAG, "Could not read log list file", e);
+            statusBuilder.setState(UNABLE_TO_READ_FILE);
+            return statusBuilder.build();
+        } catch (GeneralSecurityException e) {
             Log.e(TAG, "Could not verify new log list", e);
             statusBuilder.setState(SIGNATURE_VERIFICATION_FAILED);
             return statusBuilder.build();
diff --git a/networksecurity/tests/unit/src/com/android/server/net/ct/CertificateTransparencyDownloaderTest.java b/networksecurity/tests/unit/src/com/android/server/net/ct/CertificateTransparencyDownloaderTest.java
index f5e3b7d685..0983f8b801 100644
--- a/networksecurity/tests/unit/src/com/android/server/net/ct/CertificateTransparencyDownloaderTest.java
+++ b/networksecurity/tests/unit/src/com/android/server/net/ct/CertificateTransparencyDownloaderTest.java
@@ -182,6 +182,24 @@ public class CertificateTransparencyDownloaderTest {
         assertThat(mCertificateTransparencyDownloader.hasMetadataDownloadId()).isFalse();
     }
 
+    @Test
+    public void testDownloader_publicKeyDownloadSuccess_publicKeyFileNotRead_logsFailure()
+            throws Exception {
+        mCertificateTransparencyDownloader.startPublicKeyDownload();
+
+        File publicKeyFile = writePublicKeyToFile(mPublicKey);
+        // Set the public key file to not be readable to simulate an IOException being thrown
+        publicKeyFile.setReadable(false);
+        mCertificateTransparencyDownloader.onReceive(
+                mContext, makePublicKeyDownloadCompleteIntent(publicKeyFile));
+
+        verify(mLogger, times(1))
+                .logCTLogListUpdateStateChangedEvent(
+                        LogListUpdateStatus.builder()
+                                .setState(CTLogListUpdateState.UNABLE_TO_READ_FILE)
+                                .build());
+    }
+
     @Test
     public void
             testDownloader_publicKeyDownloadSuccess_publicKeyNotAllowed_logsFailure()
@@ -400,6 +418,27 @@ public class CertificateTransparencyDownloaderTest {
                 .isEqualTo(CTLogListUpdateState.PUBLIC_KEY_NOT_FOUND);
     }
 
+    @Test
+    public void testDownloader_contentDownloadSuccess_signatureFileNotRead_logsSingleFailure()
+            throws Exception {
+        File logListFile = makeLogListFile("456");
+        File metadataFile = sign(logListFile);
+        mSignatureVerifier.setPublicKey(mPublicKey);
+        mCertificateTransparencyDownloader.startMetadataDownload();
+
+        mCertificateTransparencyDownloader.onReceive(
+                mContext, makeMetadataDownloadCompleteIntent(mCompatVersion, metadataFile));
+        // Set the log list file to not be readable to simulate an IOException being thrown
+        logListFile.setReadable(false);
+        mCertificateTransparencyDownloader.onReceive(
+                mContext, makeContentDownloadCompleteIntent(mCompatVersion, logListFile));
+
+        verify(mLogger, times(1))
+                .logCTLogListUpdateStateChangedEvent(mUpdateStatusCaptor.capture());
+        assertThat(mUpdateStatusCaptor.getValue().state())
+                .isEqualTo(CTLogListUpdateState.UNABLE_TO_READ_FILE);
+    }
+
     @Test
     public void testDownloader_contentDownloadSuccess_wrongSignatureAlgo_logsSingleFailure()
             throws Exception {

From ed305860416047491a5fd293a5157b65c2694491 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Tue, 25 Mar 2025 12:02:03 -0700
Subject: [PATCH 029/377] Rename variables to prevent line break

Test: TH
Change-Id: Ib5a13081cc7133c209e116fca785b88fc559221c
---
 .../android/server/ethernet/EthernetTracker.java    | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/service-t/src/com/android/server/ethernet/EthernetTracker.java b/service-t/src/com/android/server/ethernet/EthernetTracker.java
index e01a5c9a18..d616d8d834 100644
--- a/service-t/src/com/android/server/ethernet/EthernetTracker.java
+++ b/service-t/src/com/android/server/ethernet/EthernetTracker.java
@@ -1031,18 +1031,17 @@ public class EthernetTracker {
                     .build();
         }
 
-        EthernetConfigParser(String configString, boolean isAtLeastB) {
+        EthernetConfigParser(String configString, boolean bplus) {
             Objects.requireNonNull(configString, "EthernetConfigParser requires non-null config");
-            final String[] tokens = configString.split(";", /* limit of tokens */ 4);
-            mIface = tokens[0];
+            final String[] t = configString.split(";", /* limit of tokens */ 4);
+            mIface = t[0];
 
-            final NetworkCapabilities nc =
-                    parseCapabilities(tokens.length > 1 ? tokens[1] : null, isAtLeastB);
-            final int transportType = parseTransportType(tokens.length > 3 ? tokens[3] : null);
+            final NetworkCapabilities nc = parseCapabilities(t.length > 1 ? t[1] : null, bplus);
+            final int transportType = parseTransportType(t.length > 3 ? t[3] : null);
             nc.addTransportType(transportType);
             mCaps = nc;
 
-            mIpConfig = parseStaticIpConfiguration(tokens.length > 2 ? tokens[2] : null);
+            mIpConfig = parseStaticIpConfiguration(t.length > 2 ? t[2] : null);
         }
     }
 }

From 4b2ed85ddbf9accdcb47ed9620d319553a28e127 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Tue, 25 Mar 2025 12:12:57 -0700
Subject: [PATCH 030/377] Add missing final classifier

Test: TH
Change-Id: I94286ebea155275dc4138fe837c307fc27daa930
---
 .../src/com/android/server/ethernet/EthernetTracker.java | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/service-t/src/com/android/server/ethernet/EthernetTracker.java b/service-t/src/com/android/server/ethernet/EthernetTracker.java
index d616d8d834..f804471f42 100644
--- a/service-t/src/com/android/server/ethernet/EthernetTracker.java
+++ b/service-t/src/com/android/server/ethernet/EthernetTracker.java
@@ -993,15 +993,14 @@ public class EthernetTracker {
             for (String keyValueAsString : staticIpConfig.trim().split(" ")) {
                 if (TextUtils.isEmpty(keyValueAsString)) continue;
 
-                String[] pair = keyValueAsString.split("=");
+                final String[] pair = keyValueAsString.split("=");
                 if (pair.length != 2) {
                     throw new IllegalArgumentException("Unexpected token: " + keyValueAsString
                             + " in " + staticIpConfig);
                 }
 
-                String key = pair[0];
-                String value = pair[1];
-
+                final String key = pair[0];
+                final String value = pair[1];
                 switch (key) {
                     case "ip":
                         staticIpConfigBuilder.setIpAddress(new LinkAddress(value));
@@ -1020,7 +1019,7 @@ public class EthernetTracker {
                         staticIpConfigBuilder.setDnsServers(dnsAddresses);
                         break;
                     }
-                    default : {
+                    default: {
                         throw new IllegalArgumentException("Unexpected key: " + key
                                 + " in " + staticIpConfig);
                     }

From bd9376982eb94cd84e0780620a3a109a55994d79 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Tue, 25 Mar 2025 14:23:52 -0700
Subject: [PATCH 031/377] Add generic createTestInterface to
 AutoCloseTestInterfaceRule

Test: TH
Change-Id: Ib0519f99417c94f3ae77ab1d56a81fe1fd167c0c
---
 .../com/android/testutils/AutoCloseTestInterfaceRule.kt  | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/AutoCloseTestInterfaceRule.kt b/staticlibs/testutils/devicetests/com/android/testutils/AutoCloseTestInterfaceRule.kt
index 89de0b3d7a..2b625f6573 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/AutoCloseTestInterfaceRule.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/AutoCloseTestInterfaceRule.kt
@@ -20,6 +20,7 @@ import android.Manifest.permission.MANAGE_TEST_NETWORKS
 import android.content.Context
 import android.net.TestNetworkInterface
 import android.net.TestNetworkManager
+import android.net.TestNetworkManager.TestInterfaceRequest
 import org.junit.rules.TestRule
 import org.junit.runner.Description
 import org.junit.runners.model.Statement
@@ -40,6 +41,14 @@ class AutoCloseTestInterfaceRule(
         }
     }
 
+    fun createTestInterface(req: TestInterfaceRequest): TestNetworkInterface {
+        return runAsShell(MANAGE_TEST_NETWORKS) {
+            tnm.createTestInterface(req)
+        }.also {
+            ifaces.add(it)
+        }
+    }
+
     private fun closeAllInterfaces() {
         // TODO: wait on RTM_DELLINK before proceeding.
         for (iface in ifaces) {

From f23f6ae45be4844cd4e4d77439a2645c4b3e61cc Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Tue, 25 Mar 2025 15:00:23 -0700
Subject: [PATCH 032/377] Move EthernetTestInterface to testutils

To make it usable for integration tests not in CTS.

Test: TH
Change-Id: If243997f086c442d4f0ef8f3c77760fada769448
---
 .../com/android/testutils}/EthernetTestInterface.kt        | 7 ++-----
 .../android/net/cts/NsdManagerDownstreamTetheringTest.kt   | 2 +-
 2 files changed, 3 insertions(+), 6 deletions(-)
 rename {tests/cts/net/util/java/android/net/cts/util => staticlibs/testutils/devicetests/com/android/testutils}/EthernetTestInterface.kt (94%)

diff --git a/tests/cts/net/util/java/android/net/cts/util/EthernetTestInterface.kt b/staticlibs/testutils/devicetests/com/android/testutils/EthernetTestInterface.kt
similarity index 94%
rename from tests/cts/net/util/java/android/net/cts/util/EthernetTestInterface.kt
rename to staticlibs/testutils/devicetests/com/android/testutils/EthernetTestInterface.kt
index 20cfa1d3f0..2dc51a3b3d 100644
--- a/tests/cts/net/util/java/android/net/cts/util/EthernetTestInterface.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/EthernetTestInterface.kt
@@ -14,7 +14,7 @@
  * limitations under the License.
  */
 
-package android.net.cts.util
+package com.android.testutils
 
 import android.Manifest.permission.NETWORK_SETTINGS
 import android.content.Context
@@ -24,13 +24,10 @@ import android.net.EthernetManager.STATE_ABSENT
 import android.net.EthernetManager.STATE_LINK_UP
 import android.net.IpConfiguration
 import android.net.TestNetworkInterface
-import android.net.cts.util.EthernetTestInterface.EthernetStateListener.CallbackEntry.InterfaceStateChanged
 import android.os.Handler
 import android.util.Log
 import com.android.net.module.util.ArrayTrackRecord
-import com.android.testutils.PollPacketReader
-import com.android.testutils.runAsShell
-import com.android.testutils.waitForIdle
+import com.android.testutils.EthernetTestInterface.EthernetStateListener.CallbackEntry.InterfaceStateChanged
 import java.net.NetworkInterface
 import kotlin.concurrent.Volatile
 import kotlin.test.assertNotNull
diff --git a/tests/cts/net/src/android/net/cts/NsdManagerDownstreamTetheringTest.kt b/tests/cts/net/src/android/net/cts/NsdManagerDownstreamTetheringTest.kt
index 19738994c7..19a40f9502 100644
--- a/tests/cts/net/src/android/net/cts/NsdManagerDownstreamTetheringTest.kt
+++ b/tests/cts/net/src/android/net/cts/NsdManagerDownstreamTetheringTest.kt
@@ -20,7 +20,6 @@ import android.net.LinkAddress
 import android.net.TetheringManager.CONNECTIVITY_SCOPE_LOCAL
 import android.net.TetheringManager.TETHERING_ETHERNET
 import android.net.TetheringManager.TetheringRequest
-import android.net.cts.util.EthernetTestInterface
 import android.net.nsd.NsdManager
 import android.os.Build
 import android.os.Handler
@@ -31,6 +30,7 @@ import com.android.testutils.AutoCloseTestInterfaceRule
 import com.android.testutils.ConnectivityModuleTest
 import com.android.testutils.DevSdkIgnoreRule
 import com.android.testutils.DevSdkIgnoreRunner
+import com.android.testutils.EthernetTestInterface
 import com.android.testutils.NsdDiscoveryRecord
 import com.android.testutils.pollForQuery
 import com.android.testutils.tryTest

From 2f870dbc33235f561ee0221370f7b0163fc51c3b Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Fri, 28 Mar 2025 10:04:34 -0700
Subject: [PATCH 033/377] Add rustfmt to p/m/C

Test: try to upload .rs
Change-Id: I8ccea161da10db8505e1f0aa5fb22f6c6952373e
---
 PREUPLOAD.cfg | 2 ++
 rustfmt.toml  | 1 +
 2 files changed, 3 insertions(+)
 create mode 120000 rustfmt.toml

diff --git a/PREUPLOAD.cfg b/PREUPLOAD.cfg
index c301397593..cbe321c5f9 100644
--- a/PREUPLOAD.cfg
+++ b/PREUPLOAD.cfg
@@ -1,9 +1,11 @@
 [Builtin Hooks]
 bpfmt = true
 clang_format = true
+rustfmt = true
 
 [Builtin Hooks Options]
 clang_format = --commit ${PREUPLOAD_COMMIT} --style file --extensions c,h,cc,cpp,hpp
+rustfmt = --config-path=rustfmt.toml
 
 [Hook Scripts]
 checkstyle_hook = ${REPO_ROOT}/prebuilts/checkstyle/checkstyle.py --sha ${PREUPLOAD_COMMIT}
diff --git a/rustfmt.toml b/rustfmt.toml
new file mode 120000
index 0000000000..475ba8fde7
--- /dev/null
+++ b/rustfmt.toml
@@ -0,0 +1 @@
+../../../build/soong/scripts/rustfmt.toml
\ No newline at end of file

From 121a4f90ba022612bbc372c65889431e28d6e2ab Mon Sep 17 00:00:00 2001
From: Junyu Lai <junyulai@google.com>
Date: Sun, 30 Mar 2025 23:33:14 -0700
Subject: [PATCH 034/377] Revert "Enable
 TETHER_FORCE_RANDOM_PREFIX_BASE_SELECTION by default on 25Q2+"

This reverts commit 44f2eb6e42f759f5247c919781f25e591e87c1c3.

Reason for revert: Networking mainline release council review feedback at b/406955982

Flag: EXEMPT bugfix
Test: TH
Bug: 406955982
Change-Id: I89bc8f5863c3acb72b5c4af5aadc40d34f2380ce
---
 .../tethering/TetheringConfiguration.java          |  3 +++
 .../tethering/PrivateAddressCoordinatorTest.java   | 14 ++++++--------
 .../net/module/util/PrivateAddressCoordinator.java | 14 ++++----------
 3 files changed, 13 insertions(+), 18 deletions(-)

diff --git a/Tethering/src/com/android/networkstack/tethering/TetheringConfiguration.java b/Tethering/src/com/android/networkstack/tethering/TetheringConfiguration.java
index e2609e7d2f..7c61b9c442 100644
--- a/Tethering/src/com/android/networkstack/tethering/TetheringConfiguration.java
+++ b/Tethering/src/com/android/networkstack/tethering/TetheringConfiguration.java
@@ -131,6 +131,9 @@ public class TetheringConfiguration {
     public static final String TETHER_ENABLE_WEAR_TETHERING =
             "tether_enable_wear_tethering";
 
+    public static final String TETHER_FORCE_RANDOM_PREFIX_BASE_SELECTION =
+            "tether_force_random_prefix_base_selection";
+
     public static final String TETHER_ENABLE_SYNC_SM = "tether_enable_sync_sm";
 
     /**
diff --git a/Tethering/tests/unit/src/com/android/networkstack/tethering/PrivateAddressCoordinatorTest.java b/Tethering/tests/unit/src/com/android/networkstack/tethering/PrivateAddressCoordinatorTest.java
index ada88fbb65..f9e3a6a237 100644
--- a/Tethering/tests/unit/src/com/android/networkstack/tethering/PrivateAddressCoordinatorTest.java
+++ b/Tethering/tests/unit/src/com/android/networkstack/tethering/PrivateAddressCoordinatorTest.java
@@ -26,6 +26,7 @@ import static android.net.TetheringManager.TETHERING_WIFI;
 import static android.net.TetheringManager.TETHERING_WIFI_P2P;
 import static android.net.ip.IpServer.CMD_NOTIFY_PREFIX_CONFLICT;
 
+import static com.android.net.module.util.PrivateAddressCoordinator.TETHER_FORCE_RANDOM_PREFIX_BASE_SELECTION;
 import static com.android.networkstack.tethering.util.PrefixUtils.asIpPrefix;
 
 import static org.junit.Assert.assertEquals;
@@ -50,7 +51,6 @@ import android.net.LinkProperties;
 import android.net.Network;
 import android.net.NetworkCapabilities;
 import android.net.ip.IpServer;
-import android.os.Build;
 import android.os.IBinder;
 
 import androidx.test.filters.SmallTest;
@@ -58,10 +58,8 @@ import androidx.test.runner.AndroidJUnit4;
 
 import com.android.net.module.util.IIpv4PrefixRequest;
 import com.android.net.module.util.PrivateAddressCoordinator;
-import com.android.testutils.DevSdkIgnoreRule;
 
 import org.junit.Before;
-import org.junit.Rule;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.mockito.Mock;
@@ -73,9 +71,6 @@ import java.util.Arrays;
 @RunWith(AndroidJUnit4.class)
 @SmallTest
 public final class PrivateAddressCoordinatorTest {
-    @Rule
-    public final DevSdkIgnoreRule mIgnoreRule = new DevSdkIgnoreRule();
-
     private static final String TEST_IFNAME = "test0";
 
     @Mock private IpServer mHotspotIpServer;
@@ -236,9 +231,11 @@ public final class PrivateAddressCoordinatorTest {
         assertEquals(usbAddress, newUsbAddress);
 
         final UpstreamNetworkState wifiUpstream = buildUpstreamNetworkState(mWifiNetwork,
-                hotspotAddress, null, makeNetworkCapabilities(TRANSPORT_WIFI));
+                new LinkAddress("192.168.88.23/16"), null,
+                makeNetworkCapabilities(TRANSPORT_WIFI));
         updateUpstreamPrefix(wifiUpstream);
         verify(mHotspotIpServer).sendMessage(IpServer.CMD_NOTIFY_PREFIX_CONFLICT);
+        verify(mUsbIpServer).sendMessage(IpServer.CMD_NOTIFY_PREFIX_CONFLICT);
     }
 
     private UpstreamNetworkState buildUpstreamNetworkState(final Network network,
@@ -326,9 +323,10 @@ public final class PrivateAddressCoordinatorTest {
         assertFalse(localHotspotPrefix.containsPrefix(hotspotPrefix));
     }
 
-    @DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.VANILLA_ICE_CREAM)
     @Test
     public void testStartedPrefixRange() throws Exception {
+        when(mDeps.isFeatureEnabled(TETHER_FORCE_RANDOM_PREFIX_BASE_SELECTION)).thenReturn(true);
+
         startedPrefixBaseTest("192.168.0.0/16", 0);
 
         startedPrefixBaseTest("192.168.0.0/16", 1);
diff --git a/staticlibs/device/com/android/net/module/util/PrivateAddressCoordinator.java b/staticlibs/device/com/android/net/module/util/PrivateAddressCoordinator.java
index 2ce5b86b01..bb955853ee 100644
--- a/staticlibs/device/com/android/net/module/util/PrivateAddressCoordinator.java
+++ b/staticlibs/device/com/android/net/module/util/PrivateAddressCoordinator.java
@@ -33,14 +33,12 @@ import android.net.LinkAddress;
 import android.net.LinkProperties;
 import android.net.Network;
 import android.net.NetworkCapabilities;
-import android.os.Build;
 import android.os.RemoteException;
 import android.util.ArrayMap;
 
 import androidx.annotation.Nullable;
 
 import com.android.internal.annotations.VisibleForTesting;
-import com.android.modules.utils.build.SdkLevel;
 
 import java.io.PrintWriter;
 import java.net.Inet4Address;
@@ -69,6 +67,9 @@ public class PrivateAddressCoordinator {
     // WARNING: Keep in sync with chooseDownstreamAddress
     public static final int PREFIX_LENGTH = 24;
 
+    public static final String TETHER_FORCE_RANDOM_PREFIX_BASE_SELECTION =
+            "tether_force_random_prefix_base_selection";
+
     // Upstream monitor would be stopped when tethering is down. When tethering restart, downstream
     // address may be requested before coordinator get current upstream notification. To ensure
     // coordinator do not select conflict downstream prefix, mUpstreamPrefixMap would not be cleared
@@ -257,15 +258,8 @@ public class PrivateAddressCoordinator {
         return null;
     }
 
-    // TODO: Remove this method when SdkLevel.isAtLeastB() is fixed, aosp is at sdk level 36 or use
-    //  NetworkStackUtils.isAtLeast25Q2 when it is moved to a static lib.
-    public static boolean isAtLeast25Q2() {
-        return SdkLevel.isAtLeastB()  || (SdkLevel.isAtLeastV()
-                && "Baklava".equals(Build.VERSION.CODENAME));
-    }
-
     private int getRandomPrefixIndex() {
-        if (!isAtLeast25Q2()) return 0;
+        if (!mDeps.isFeatureEnabled(TETHER_FORCE_RANDOM_PREFIX_BASE_SELECTION)) return 0;
 
         final int random = getRandomInt() & 0xffffff;
         // This is to select the starting prefix range (/8, /12, or /16) instead of the actual

From fad2c52a74f91fc5491576a1d29ce5f31bce69a4 Mon Sep 17 00:00:00 2001
From: Paul Hu <paulhu@google.com>
Date: Sun, 30 Mar 2025 14:59:34 +0000
Subject: [PATCH 035/377] Pass the query result from EnqueueMdnsQueryCallable

Allow EnqueueMdnsQueryCallable to pass all results of sent
queries, including the queried base type, subtypes, and resolved
services, to accurately reflect the actual situation for the sent
query.

Bug: 387910548
Test: atest ConnectivityCoverageTests
Flag: EXEMPT legacy flag nsd_optimized_expired_service_removal
Change-Id: Ia821812bd024824ffe8f8b1348b3542e47f6158b
---
 .../mdns/EnqueueMdnsQueryCallable.java        | 36 ++++++++-------
 .../mdns/MdnsServiceTypeClient.java           | 45 +++++++++++++------
 2 files changed, 52 insertions(+), 29 deletions(-)

diff --git a/service-t/src/com/android/server/connectivity/mdns/EnqueueMdnsQueryCallable.java b/service-t/src/com/android/server/connectivity/mdns/EnqueueMdnsQueryCallable.java
index 81ba53081e..856e2054d9 100644
--- a/service-t/src/com/android/server/connectivity/mdns/EnqueueMdnsQueryCallable.java
+++ b/service-t/src/com/android/server/connectivity/mdns/EnqueueMdnsQueryCallable.java
@@ -16,8 +16,6 @@
 
 package com.android.server.connectivity.mdns;
 
-import static com.android.server.connectivity.mdns.MdnsServiceTypeClient.INVALID_TRANSACTION_ID;
-
 import android.annotation.NonNull;
 import android.os.Build;
 import android.text.TextUtils;
@@ -26,6 +24,7 @@ import android.util.Pair;
 import com.android.net.module.util.CollectionUtils;
 import com.android.net.module.util.DnsUtils;
 import com.android.net.module.util.SharedLog;
+import com.android.server.connectivity.mdns.MdnsServiceTypeClient.QuerySentResult;
 import com.android.server.connectivity.mdns.util.MdnsUtils;
 
 import java.io.IOException;
@@ -44,7 +43,7 @@ import java.util.concurrent.Callable;
  * and the list of the subtypes in the query as a {@link Pair}. If a query is failed to build, or if
  * it can not be enqueued, then call to {@link #call()} returns {@code null}.
  */
-public class EnqueueMdnsQueryCallable implements Callable<Pair<Integer, List<String>>> {
+public class EnqueueMdnsQueryCallable implements Callable<QuerySentResult> {
 
     private static final String TAG = "MdnsQueryCallable";
     private static final List<Integer> castShellEmulatorMdnsPorts;
@@ -68,8 +67,6 @@ public class EnqueueMdnsQueryCallable implements Callable<Pair<Integer, List<Str
     private final String[] serviceTypeLabels;
     @NonNull
     private final List<String> subtypes;
-    private final boolean expectUnicastResponse;
-    private final int transactionId;
     @NonNull
     private final SocketKey socketKey;
     private final boolean sendDiscoveryQueries;
@@ -86,13 +83,13 @@ public class EnqueueMdnsQueryCallable implements Callable<Pair<Integer, List<Str
     @NonNull
     private final List<MdnsResponse> existingServices;
     private final boolean isQueryWithKnownAnswer;
+    private final MdnsQueryScheduler.ScheduledQueryTaskArgs taskArgs;
 
     EnqueueMdnsQueryCallable(
             @NonNull MdnsSocketClientBase requestSender,
             @NonNull String serviceType,
             @NonNull Collection<String> subtypes,
-            boolean expectUnicastResponse,
-            int transactionId,
+            MdnsQueryScheduler.ScheduledQueryTaskArgs taskArgs,
             @NonNull SocketKey socketKey,
             boolean onlyUseIpv6OnIpv6OnlyNetworks,
             boolean sendDiscoveryQueries,
@@ -105,8 +102,7 @@ public class EnqueueMdnsQueryCallable implements Callable<Pair<Integer, List<Str
         weakRequestSender = new WeakReference<>(requestSender);
         serviceTypeLabels = TextUtils.split(serviceType, "\\.");
         this.subtypes = new ArrayList<>(subtypes);
-        this.expectUnicastResponse = expectUnicastResponse;
-        this.transactionId = transactionId;
+        this.taskArgs = taskArgs;
         this.socketKey = socketKey;
         this.onlyUseIpv6OnIpv6OnlyNetworks = onlyUseIpv6OnIpv6OnlyNetworks;
         this.sendDiscoveryQueries = sendDiscoveryQueries;
@@ -126,18 +122,23 @@ public class EnqueueMdnsQueryCallable implements Callable<Pair<Integer, List<Str
     // Incompatible return type for override of Callable#call().
     @SuppressWarnings("nullness:override.return.invalid")
     @Override
-    public Pair<Integer, List<String>> call() {
+    public QuerySentResult call() {
         try {
             MdnsSocketClientBase requestSender = weakRequestSender.get();
             if (requestSender == null) {
-                return Pair.create(INVALID_TRANSACTION_ID, new ArrayList<>());
+                return QuerySentResult.createFailedQueryResult(taskArgs);
             }
 
             final List<MdnsRecord> questions = new ArrayList<>();
+            final boolean expectUnicastResponse = taskArgs.config.expectUnicastResponse;
+            final int transactionId = taskArgs.config.getTransactionId();
+            final List<MdnsResponse> resolvedServices = new ArrayList<>();
+            boolean queriedBaseType = false;
 
             if (sendDiscoveryQueries) {
                 // Base service type
                 questions.add(new MdnsPointerRecord(serviceTypeLabels, expectUnicastResponse));
+                queriedBaseType = true;
                 for (String subtype : subtypes) {
                     final String[] labels = MdnsUtils.constructFullSubtype(serviceTypeLabels,
                             MdnsConstants.SUBTYPE_PREFIX + subtype);
@@ -154,6 +155,7 @@ public class EnqueueMdnsQueryCallable implements Callable<Pair<Integer, List<Str
                         response.getTextRecord(), now);
                 boolean renewSrv = !response.hasServiceRecord() || MdnsUtils.isRecordRenewalNeeded(
                         response.getServiceRecord(), now);
+                final int questionsBeforeAdding = questions.size();
                 if (renewSrv && renewTxt) {
                     questions.add(new MdnsAnyRecord(serviceName, expectUnicastResponse));
                 } else {
@@ -176,11 +178,14 @@ public class EnqueueMdnsQueryCallable implements Callable<Pair<Integer, List<Str
                                 host, MdnsRecord.TYPE_AAAA, expectUnicastResponse));
                     }
                 }
+                if (questions.size() > questionsBeforeAdding) {
+                    resolvedServices.add(response);
+                }
             }
 
             if (questions.size() == 0) {
                 // No query to send
-                return Pair.create(INVALID_TRANSACTION_ID, new ArrayList<>());
+                return QuerySentResult.createFailedQueryResult(taskArgs);
             }
 
             // Put the existing ptr records into known-answer section.
@@ -217,11 +222,12 @@ public class EnqueueMdnsQueryCallable implements Callable<Pair<Integer, List<Str
             for (Integer emulatorPort : castShellEmulatorMdnsPorts) {
                 sendPacketToIpv4AndIpv6(requestSender, emulatorPort, queryPacket);
             }
-            return Pair.create(transactionId, subtypes);
+            return new QuerySentResult(
+                    transactionId, subtypes, taskArgs, queriedBaseType, resolvedServices);
         } catch (Exception e) {
             sharedLog.e(String.format("Failed to create mDNS packet for subtype: %s.",
                     TextUtils.join(",", subtypes)), e);
-            return Pair.create(INVALID_TRANSACTION_ID, new ArrayList<>());
+            return QuerySentResult.createFailedQueryResult(taskArgs);
         }
     }
 
@@ -229,7 +235,7 @@ public class EnqueueMdnsQueryCallable implements Callable<Pair<Integer, List<Str
             MdnsPacket mdnsPacket) throws IOException {
         final List<DatagramPacket> packets = dependencies.getDatagramPacketsFromMdnsPacket(
                 packetCreationBuffer, mdnsPacket, address, isQueryWithKnownAnswer);
-        if (expectUnicastResponse) {
+        if (taskArgs.config.expectUnicastResponse) {
             // MdnsMultinetworkSocketClient is only available on T+
             if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU
                     && requestSender instanceof MdnsMultinetworkSocketClient) {
diff --git a/service-t/src/com/android/server/connectivity/mdns/MdnsServiceTypeClient.java b/service-t/src/com/android/server/connectivity/mdns/MdnsServiceTypeClient.java
index 4b25e82275..d5761d0a31 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MdnsServiceTypeClient.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MdnsServiceTypeClient.java
@@ -158,7 +158,7 @@ public class MdnsServiceTypeClient {
                     break;
                 }
                 case EVENT_QUERY_RESULT: {
-                    final QuerySentArguments sentResult = (QuerySentArguments) msg.obj;
+                    final QuerySentResult sentResult = (QuerySentResult) msg.obj;
                     // If a task is cancelled while the Executor is running it, EVENT_QUERY_RESULT
                     // will still be sent when it ends. So use session ID to check if this task
                     // should continue to schedule more.
@@ -169,7 +169,7 @@ public class MdnsServiceTypeClient {
                     if ((sentResult.transactionId != INVALID_TRANSACTION_ID)) {
                         for (int i = 0; i < listeners.size(); i++) {
                             listeners.keyAt(i).onDiscoveryQuerySent(
-                                    sentResult.subTypes, sentResult.transactionId);
+                                    sentResult.queriedSubtypes, sentResult.transactionId);
                         }
                     }
 
@@ -716,16 +716,36 @@ public class MdnsServiceTypeClient {
         }
     }
 
-    private static class QuerySentArguments {
+    public static class QuerySentResult {
         private final int transactionId;
-        private final List<String> subTypes = new ArrayList<>();
+        private final List<String> queriedSubtypes = new ArrayList<>();
         private final ScheduledQueryTaskArgs taskArgs;
+        private final boolean queriedBaseType;
+        private final Collection<MdnsResponse> resolvedServices = new ArrayList<>();
 
-        QuerySentArguments(int transactionId, @NonNull List<String> subTypes,
-                @NonNull ScheduledQueryTaskArgs taskArgs) {
+        QuerySentResult(int transactionId, @NonNull List<String> subTypes,
+                @NonNull ScheduledQueryTaskArgs taskArgs, boolean queriedBaseType,
+                @NonNull Collection<MdnsResponse> resolvedServices) {
             this.transactionId = transactionId;
-            this.subTypes.addAll(subTypes);
+            this.queriedSubtypes.addAll(subTypes);
             this.taskArgs = taskArgs;
+            this.queriedBaseType = queriedBaseType;
+            this.resolvedServices.addAll(resolvedServices);
+        }
+
+
+        /**
+         * Creates a QuerySentResult instance representing a failed query attempt.
+         *
+         * This factory method is used when the query packet could not be sent successfully.
+         *
+         * @param taskArgs The arguments of the task that attempted the query.
+         * @return A QuerySentResult configured to indicate failure.
+         */
+        public static QuerySentResult createFailedQueryResult(
+                @NonNull ScheduledQueryTaskArgs taskArgs) {
+            return new QuerySentResult(INVALID_TRANSACTION_ID, new ArrayList<>(), taskArgs,
+                    false /* queriedBaseType */, Collections.emptyList() /* resolvedServices */);
         }
     }
 
@@ -755,15 +775,14 @@ public class MdnsServiceTypeClient {
 
         @Override
         public void run() {
-            Pair<Integer, List<String>> result;
+            QuerySentResult result;
             try {
                 result =
                         new EnqueueMdnsQueryCallable(
                                 socketClient,
                                 serviceType,
                                 subtypes,
-                                taskArgs.config.expectUnicastResponse,
-                                taskArgs.config.getTransactionId(),
+                                taskArgs,
                                 socketKey,
                                 onlyUseIpv6OnIpv6OnlyNetworks,
                                 sendDiscoveryQueries,
@@ -777,11 +796,9 @@ public class MdnsServiceTypeClient {
             } catch (RuntimeException e) {
                 sharedLog.e(String.format("Failed to run EnqueueMdnsQueryCallable for subtype: %s",
                         TextUtils.join(",", subtypes)), e);
-                result = Pair.create(INVALID_TRANSACTION_ID, new ArrayList<>());
+                result = QuerySentResult.createFailedQueryResult(taskArgs);
             }
-            dependencies.sendMessage(
-                    handler, handler.obtainMessage(EVENT_QUERY_RESULT,
-                            new QuerySentArguments(result.first, result.second, taskArgs)));
+            dependencies.sendMessage(handler, handler.obtainMessage(EVENT_QUERY_RESULT, result));
         }
     }
 

From db75d68801c5583698e53f404565122b09c4e5df Mon Sep 17 00:00:00 2001
From: Junyu Lai <junyulai@google.com>
Date: Mon, 31 Mar 2025 14:44:06 +0800
Subject: [PATCH 036/377] Enable TETHER_FORCE_RANDOM_PREFIX_BASE_SELECTION by
 default

Since the feature was fully rolled out via experiment without
regression, this commit replaced with a
kill switch.

Flag: EXEMPT refactor
Test: atest ConnectivityCoverageTests:PrivateAddressCoordinatorTest
Fix: 312647670
Fix: 406955982
Change-Id: I18adcca45fa5f698adc80cea044d8006de097977
---
 .../tethering/PrivateAddressCoordinatorTest.java      |  3 ++-
 .../android/networkstack/tethering/TetheringTest.java |  4 ++--
 .../net/module/util/PrivateAddressCoordinator.java    | 11 ++++++-----
 3 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/Tethering/tests/unit/src/com/android/networkstack/tethering/PrivateAddressCoordinatorTest.java b/Tethering/tests/unit/src/com/android/networkstack/tethering/PrivateAddressCoordinatorTest.java
index f9e3a6a237..15653692cd 100644
--- a/Tethering/tests/unit/src/com/android/networkstack/tethering/PrivateAddressCoordinatorTest.java
+++ b/Tethering/tests/unit/src/com/android/networkstack/tethering/PrivateAddressCoordinatorTest.java
@@ -325,7 +325,8 @@ public final class PrivateAddressCoordinatorTest {
 
     @Test
     public void testStartedPrefixRange() throws Exception {
-        when(mDeps.isFeatureEnabled(TETHER_FORCE_RANDOM_PREFIX_BASE_SELECTION)).thenReturn(true);
+        when(mDeps.isFeatureNotChickenedOut(TETHER_FORCE_RANDOM_PREFIX_BASE_SELECTION))
+                .thenReturn(true);
 
         startedPrefixBaseTest("192.168.0.0/16", 0);
 
diff --git a/Tethering/tests/unit/src/com/android/networkstack/tethering/TetheringTest.java b/Tethering/tests/unit/src/com/android/networkstack/tethering/TetheringTest.java
index bbe15b461f..160f28ccb7 100644
--- a/Tethering/tests/unit/src/com/android/networkstack/tethering/TetheringTest.java
+++ b/Tethering/tests/unit/src/com/android/networkstack/tethering/TetheringTest.java
@@ -538,8 +538,8 @@ public class TetheringTest {
         public RoutingCoordinatorManager getRoutingCoordinator(
                 final Context context, SharedLog log) {
             ConnectivityManager cm = context.getSystemService(ConnectivityManager.class);
-            when(mPrivateAddressCoordinatorDependencies.isFeatureEnabled(anyString()))
-                    .thenReturn(false);
+            when(mPrivateAddressCoordinatorDependencies.isFeatureNotChickenedOut(anyString()))
+                    .thenReturn(true);
             RoutingCoordinatorService service = new RoutingCoordinatorService(
                     getINetd(context, log),
                             cm::getAllNetworks,
diff --git a/staticlibs/device/com/android/net/module/util/PrivateAddressCoordinator.java b/staticlibs/device/com/android/net/module/util/PrivateAddressCoordinator.java
index bb955853ee..e21d27127e 100644
--- a/staticlibs/device/com/android/net/module/util/PrivateAddressCoordinator.java
+++ b/staticlibs/device/com/android/net/module/util/PrivateAddressCoordinator.java
@@ -34,6 +34,7 @@ import android.net.LinkProperties;
 import android.net.Network;
 import android.net.NetworkCapabilities;
 import android.os.RemoteException;
+import android.provider.DeviceConfig;
 import android.util.ArrayMap;
 
 import androidx.annotation.Nullable;
@@ -98,14 +99,14 @@ public class PrivateAddressCoordinator {
         }
 
         /**
-         * Check whether or not one specific experimental feature is enabled according to {@link
-         * DeviceConfigUtils}.
+         * Check whether one specific experimental feature in Tethering module
+         * from {@link DeviceConfig} is not disabled.
          *
          * @param featureName The feature's name to look up.
          * @return true if this feature is enabled, or false if disabled.
          */
-        public boolean isFeatureEnabled(String featureName) {
-            return DeviceConfigUtils.isTetheringFeatureEnabled(mContext, featureName);
+        public boolean isFeatureNotChickenedOut(String featureName) {
+            return DeviceConfigUtils.isTetheringFeatureNotChickenedOut(mContext, featureName);
         }
     }
 
@@ -259,7 +260,7 @@ public class PrivateAddressCoordinator {
     }
 
     private int getRandomPrefixIndex() {
-        if (!mDeps.isFeatureEnabled(TETHER_FORCE_RANDOM_PREFIX_BASE_SELECTION)) return 0;
+        if (!mDeps.isFeatureNotChickenedOut(TETHER_FORCE_RANDOM_PREFIX_BASE_SELECTION)) return 0;
 
         final int random = getRandomInt() & 0xffffff;
         // This is to select the starting prefix range (/8, /12, or /16) instead of the actual

From b0ce1a53099ec20c9f792cc13b11596550a80ece Mon Sep 17 00:00:00 2001
From: Android Network Security <noreply@google.com>
Date: Sat, 29 Mar 2025 17:08:13 +0000
Subject: [PATCH 037/377] Automated log_list.json generation version 51.57

Bug: N/A
Test: N/A
Flag: NONE automatic key rotation
PiperOrigin-RevId: 741845525
Change-Id: I4fe20e2288e9a99f4ade358d24302fd9b26b6660
---
 .../res/raw/ct_public_keys.pem                     | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/service/ServiceConnectivityResources/res/raw/ct_public_keys.pem b/service/ServiceConnectivityResources/res/raw/ct_public_keys.pem
index 8a5ebbfa46..40eac2c0d0 100644
--- a/service/ServiceConnectivityResources/res/raw/ct_public_keys.pem
+++ b/service/ServiceConnectivityResources/res/raw/ct_public_keys.pem
@@ -41,6 +41,20 @@ clFF7Y1FiI259IPhTKiOIfARJ4BL4Sn8D9c9vpxDYPFl5bCJbspmFpwfzTMDnGVS
 /IlY6Putpv2/lD1B7aQGt1sCAwEAAQ==
 -----END PUBLIC KEY-----
 -----BEGIN PUBLIC KEY-----
+MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAps78mZHoVEvY3VlBZ1b8
+X8Fo9k6wtpu+hUqccXGiYnCYQYKd82fMfmfn8B2pSo9kHo2KEQDAqoCITGkgwMio
+cQ4zWS7+catfv+0rqs6S1qxoz0RI/RIhd1ka16Xab2+756FVZLI+KqBqW3Ir7SAJ
+hClV2yU+IvwPFIXJHWCy0eS3KMFMiCK8ReTjwX8+HXtBdBbzg4WM2+NGuupTvlwj
+mGg31yxBvF3Vc6+3MnpEOL5xa9h8pDpXWBvvIXv6gYpq1S7+GB7HGIm2ndIdZOFl
+twl4DuBnMuRYy3WqQlkzXxNMRW1+fZjnCBWBNMhzCfhtNImn2sNXzTCoT1aHsulA
+avi4/5V2g+8IyP3sRAiyJz3CEkHzruXRxQN7zqtZJqU0+BRf7KYTOvkR5b/uwY3V
+D1i6ct02eEJBsEpC4TPB+BXlC0Lp6nOK8scfGoYbQ49E7ti3azBpk7xoVz9SLYYM
+bSCdx4c3VSprE/BW9kTLheZmclHIneFalIRRuT5LRVlrJchR3PhlmLv/q4RnsUFn
+HIjf3M7UqF9LyY+lO3CI2Zd35qqYfFdazZveHzCNq24FFWfgWGJqWmLTBV7rQebM
+rp3dbI3EbrlhKzVUHTrHLQ7QAVsbAibcPgGfCjGXrIWsLaX63Kfmb6how6YQ9lWY
+tb2vW00woqD2sMPCiGrqjOkCAwEAAQ==
+-----END PUBLIC KEY-----
+-----BEGIN PUBLIC KEY-----
 MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAwMPNecDhLDamK9Rs8W5V
 c0LWZPbk9FNP+budBoFMX46dWyJ75O5e8xY9UhJSBFl8+Itm/rWO/h2zZ6qE3Cq8
 1LYbOg+x+rLnYOcAvD2O7EU73A3RD/vqoUDDVK3cwKMq3ry7CYu+NJW7TRIKV7Ct

From adf3bd7e025bd2bb9555e86428f0103716f1c326 Mon Sep 17 00:00:00 2001
From: mtk80963 <yintang.gu@mediatek.com>
Date: Mon, 31 Mar 2025 07:23:31 -0700
Subject: [PATCH 038/377] Fix for b/404408218 that was not merged in time for
 the AOSP read-only migration. Add validity checks on DataStore file

Add process to perform validity checks on DataStore to avoid
system_server crashes by corrupted DataStore file.

Flag: EXEMPT bugfix
Test: Manual
(cherry picked from https://android-review.googlesource.com/q/commit:e7deb2a847a87ed79747ab7a736a62072f79cde1)
Fix for b/404408218 that was not merged in time for the AOSP read-only migration.
(cherry picked from https://android-review.googlesource.com/q/commit:cbae03b06b1be8b877ac5ef13632969b9564b29d)
Merged-In: I13c6ccc8bb5c2c9b212273350374b22892c67adc
Change-Id: I13c6ccc8bb5c2c9b212273350374b22892c67adc
---
 .../com/android/server/net/ct/DataStore.java  | 37 ++++++++++++++++++-
 1 file changed, 36 insertions(+), 1 deletion(-)

diff --git a/networksecurity/service/src/com/android/server/net/ct/DataStore.java b/networksecurity/service/src/com/android/server/net/ct/DataStore.java
index 1f99efa8e4..bd17199cdb 100644
--- a/networksecurity/service/src/com/android/server/net/ct/DataStore.java
+++ b/networksecurity/service/src/com/android/server/net/ct/DataStore.java
@@ -25,12 +25,15 @@ import java.io.InputStream;
 import java.io.OutputStream;
 import java.util.Optional;
 import java.util.Properties;
+import java.util.Set;
 
 /** Class to persist data needed by CT. */
 class DataStore extends Properties {
 
     private static final String TAG = "CertificateTransparency";
 
+    private static final long MAX_FILE_SIZE = 20 * 1024; // 20KB
+    private static final int MAX_KEY_SIZE = 50;
     private final File mPropertyFile;
 
     DataStore(File file) {
@@ -42,17 +45,49 @@ class DataStore extends Properties {
         if (!mPropertyFile.exists()) {
             return;
         }
+
+        if (!validatePropertyFile()) {
+            Log.e(TAG, "Invalid property file, not load it!");
+            delete();
+            return;
+        }
+
         try (InputStream in = new FileInputStream(mPropertyFile)) {
             load(in);
+            if (!validateProperties()) {
+                Log.e(TAG, "Invalid property store, clear it!");
+                delete();
+                return;
+            }
         } catch (IOException | IllegalArgumentException e) {
             Log.e(TAG, "Error loading property store", e);
             delete();
         }
     }
 
+    private boolean validateProperties() {
+        Set<String> keys = stringPropertyNames();
+        for (String key : keys) {
+            if (key.length() > MAX_KEY_SIZE) {
+                Log.e(TAG, "Unexpected Property: " + key);
+                return false;
+            }
+        }
+        return true;
+    }
+
+    private boolean validatePropertyFile() {
+        if (mPropertyFile.length() > MAX_FILE_SIZE) {
+            Log.e(TAG, "Property file size exceeds " + MAX_FILE_SIZE + "!");
+            return false;
+        }
+        return true;
+    }
+
     void store() {
-        try (OutputStream out = new FileOutputStream(mPropertyFile)) {
+        try (FileOutputStream out = new FileOutputStream(mPropertyFile)) {
             store(out, "");
+            out.getFD().sync();
         } catch (IOException e) {
             Log.e(TAG, "Error storing property store", e);
         }

From 97e205cf0cb7471a3d5fd35ebf20241e64928b77 Mon Sep 17 00:00:00 2001
From: Quang Anh Luong <qal@google.com>
Date: Mon, 31 Mar 2025 17:36:49 -0700
Subject: [PATCH 039/377] Add hostapd callstack to TetheringManagerTest dump

TetheringManagerTest may fail on T devices in rare cases due to hostapd
hanging. Log the hostapd callstack upon failure in #testStopAllTethering
so we can analyze it the next time the failure happens.

Flag: EXEMPT test-only change

Bug: 299687365
Test: atest TetheringManagerTest
Change-Id: I59ce9dc98be7eb3689dae4863078360534edc802
---
 tests/cts/tethering/AndroidTestTemplate.xml        |  6 ++++++
 .../tethering/cts/TetheringManagerTest.java        | 14 ++++++++++++++
 2 files changed, 20 insertions(+)

diff --git a/tests/cts/tethering/AndroidTestTemplate.xml b/tests/cts/tethering/AndroidTestTemplate.xml
index dd5b23e3a2..0f2e72caca 100644
--- a/tests/cts/tethering/AndroidTestTemplate.xml
+++ b/tests/cts/tethering/AndroidTestTemplate.xml
@@ -30,7 +30,13 @@
     </target_preparer>
     <test class="com.android.tradefed.testtype.AndroidJUnitTest" >
         <option name="package" value="android.tethering.cts" />
+        <option name="device-listeners" value="com.android.testutils.ConnectivityDiagnosticsCollector" />
     </test>
+    <metrics_collector class="com.android.tradefed.device.metric.FilePullerLogCollector">
+        <!-- Pattern matching the fileKey used by ConnectivityDiagnosticsCollector when calling addFileMetric -->
+        <option name="pull-pattern-keys" value="com.android.testutils.ConnectivityDiagnosticsCollector.*"/>
+        <option name="collect-on-run-ended-only" value="true" />
+    </metrics_collector>
 
     <object type="module_controller" class="com.android.tradefed.testtype.suite.module.MainlineTestModuleController">
         <option name="mainline-module-package-name" value="com.google.android.tethering" />
diff --git a/tests/cts/tethering/src/android/tethering/cts/TetheringManagerTest.java b/tests/cts/tethering/src/android/tethering/cts/TetheringManagerTest.java
index 92d58e6133..d9a0ef0748 100644
--- a/tests/cts/tethering/src/android/tethering/cts/TetheringManagerTest.java
+++ b/tests/cts/tethering/src/android/tethering/cts/TetheringManagerTest.java
@@ -75,6 +75,7 @@ import android.net.cts.util.CtsTetheringUtils.TestTetheringEventCallback;
 import android.net.wifi.SoftApConfiguration;
 import android.net.wifi.WifiManager;
 import android.net.wifi.WifiSsid;
+import android.os.Build;
 import android.os.Bundle;
 import android.os.PersistableBundle;
 import android.os.ResultReceiver;
@@ -87,6 +88,7 @@ import androidx.test.InstrumentationRegistry;
 import androidx.test.runner.AndroidJUnit4;
 
 import com.android.modules.utils.build.SdkLevel;
+import com.android.testutils.ConnectivityDiagnosticsCollector;
 import com.android.testutils.ParcelUtils;
 import com.android.testutils.com.android.testutils.CarrierConfigRule;
 
@@ -477,6 +479,18 @@ public class TetheringManagerTest {
 
             mCtsTetheringUtils.stopAllTethering();
             tetherEventCallback.expectNoTetheringActive();
+        } catch (Throwable e) {
+            if (Build.VERSION.SDK_INT == Build.VERSION_CODES.TIRAMISU) {
+                // This test fails on T devices in rare cases due to hostapd hanging. Log the
+                // hostapd callstack to help analyze the failure the next time it happens.
+                final ConnectivityDiagnosticsCollector collector =
+                        ConnectivityDiagnosticsCollector.getInstance();
+                if (collector != null) {
+                    collector.collectCommandOutput(
+                            "getprop init.svc_debug_pid.hostapd | xargs debuggerd -b", "sh", e);
+                }
+            }
+            throw e;
         } finally {
             mCtsTetheringUtils.unregisterTetheringEventCallback(tetherEventCallback);
         }

From 315cf7110c7fb1e87b9ed3f03cd218aac7823bcd Mon Sep 17 00:00:00 2001
From: Xiao Ma <xiaom@google.com>
Date: Mon, 31 Mar 2025 15:24:05 +0900
Subject: [PATCH 040/377] De-duplicate the keepScore func in the CS unit test.

Flag: EXEMPT test-only change
Bug: 368416967
Test: atest CSSatelliteNetworkTest
Test: atest CSCaptivePortalAppTest
Test: atest CSLocalAgentTests
Change-Id: I0739f4524e5dd5ec0d5f3c170c82120ca30e8730
---
 .../CSCaptivePortalAppTest.kt                 |  8 ----
 .../connectivityservice/CSLocalAgentTests.kt  |  7 ----
 .../CSSatelliteNetworkTest.kt                 | 40 ++++++++++---------
 .../server/connectivityservice/base/CSTest.kt |  7 ++++
 4 files changed, 29 insertions(+), 33 deletions(-)

diff --git a/tests/unit/java/com/android/server/connectivityservice/CSCaptivePortalAppTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSCaptivePortalAppTest.kt
index 0bad60daa7..ae544d5ee1 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSCaptivePortalAppTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSCaptivePortalAppTest.kt
@@ -35,8 +35,6 @@ import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_SUSPENDED
 import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_VCN_MANAGED
 import android.net.NetworkCapabilities.TRANSPORT_WIFI
 import android.net.NetworkRequest
-import android.net.NetworkScore
-import android.net.NetworkScore.KEEP_CONNECTED_FOR_TEST
 import android.net.NetworkStack
 import android.net.RouteInfo
 import android.os.Build
@@ -52,12 +50,6 @@ import org.mockito.ArgumentMatchers.anyInt
 import org.mockito.Mockito.never
 import org.mockito.Mockito.verify
 
-// This allows keeping all the networks connected without having to file individual requests
-// for them.
-private fun keepScore() = FromS(
-        NetworkScore.Builder().setKeepConnectedReason(KEEP_CONNECTED_FOR_TEST).build()
-)
-
 private fun nc(transport: Int, vararg caps: Int) = NetworkCapabilities.Builder().apply {
     addTransportType(transport)
     caps.forEach {
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSLocalAgentTests.kt b/tests/unit/java/com/android/server/connectivityservice/CSLocalAgentTests.kt
index 9468d548d4..5a7eda8459 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSLocalAgentTests.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSLocalAgentTests.kt
@@ -35,7 +35,6 @@ import android.net.NetworkCapabilities.TRANSPORT_THREAD
 import android.net.NetworkCapabilities.TRANSPORT_WIFI
 import android.net.NetworkRequest
 import android.net.NetworkScore
-import android.net.NetworkScore.KEEP_CONNECTED_FOR_TEST
 import android.net.NetworkScore.KEEP_CONNECTED_LOCAL_NETWORK
 import android.net.RouteInfo
 import android.net.connectivity.ConnectivityCompatChanges.ENABLE_MATCH_LOCAL_NETWORK
@@ -79,12 +78,6 @@ private fun lp(iface: String) = LinkProperties().apply {
     addRoute(RouteInfo(IpPrefix("0.0.0.0/0"), null, null))
 }
 
-// This allows keeping all the networks connected without having to file individual requests
-// for them.
-private fun keepScore() = FromS(
-        NetworkScore.Builder().setKeepConnectedReason(KEEP_CONNECTED_FOR_TEST).build()
-)
-
 @DevSdkIgnoreRunner.MonitorThreadLeak
 @RunWith(DevSdkIgnoreRunner::class)
 @DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.TIRAMISU)
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSSatelliteNetworkTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSSatelliteNetworkTest.kt
index 58420c0db2..a6181d9caf 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSSatelliteNetworkTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSSatelliteNetworkTest.kt
@@ -16,8 +16,8 @@
 
 package com.android.server
 
-import android.net.IpPrefix
 import android.net.INetd
+import android.net.IpPrefix
 import android.net.LinkAddress
 import android.net.LinkProperties
 import android.net.NativeNetworkConfig
@@ -29,9 +29,7 @@ import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_RESTRICTED
 import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_ROAMING
 import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_SUSPENDED
 import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_VCN_MANAGED
-import android.net.NetworkScore
 import android.net.NetworkCapabilities.TRANSPORT_SATELLITE
-import android.net.NetworkScore.KEEP_CONNECTED_FOR_TEST
 import android.net.RouteInfo
 import android.net.UidRange
 import android.net.UidRangeParcel
@@ -47,6 +45,8 @@ import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
 import com.android.testutils.DevSdkIgnoreRunner
 import com.android.testutils.TestableNetworkCallback
 import com.android.testutils.visibleOnHandlerThread
+import kotlin.test.assertEquals
+import kotlin.test.assertTrue
 import org.junit.Assert
 import org.junit.Rule
 import org.junit.Test
@@ -55,8 +55,6 @@ import org.mockito.ArgumentMatchers.any
 import org.mockito.Mockito.inOrder
 import org.mockito.Mockito.never
 import org.mockito.Mockito.verify
-import kotlin.test.assertEquals
-import kotlin.test.assertTrue
 
 private const val SECONDARY_USER = 10
 private val SECONDARY_USER_HANDLE = UserHandle(SECONDARY_USER)
@@ -100,7 +98,8 @@ class CSSatelliteNetworkTest : CSTest() {
         val satelliteNetId = satelliteAgent.network.netId
         val permission = if (restricted) {INetd.PERMISSION_SYSTEM} else {INetd.PERMISSION_NONE}
         netdInOrder.verify(netd).networkCreate(
-            nativeNetworkConfigPhysical(satelliteNetId, permission))
+            nativeNetworkConfigPhysical(satelliteNetId, permission)
+        )
 
         val uid1 = PRIMARY_USER_HANDLE.getUid(TEST_PACKAGE_UID)
         val uid2 = PRIMARY_USER_HANDLE.getUid(TEST_PACKAGE_UID2)
@@ -115,7 +114,8 @@ class CSSatelliteNetworkTest : CSTest() {
         var uids = mutableSetOf(uid1, uid2, uid3)
         val uidRanges1 = toUidRangeStableParcels(uidRangesForUids(uids))
         val config1 = NativeUidRangeConfig(
-            satelliteNetId, uidRanges1,
+            satelliteNetId,
+            uidRanges1,
             PREFERENCE_ORDER_SATELLITE_FALLBACK
         )
         updateSatelliteNetworkFallbackUids(uids)
@@ -126,7 +126,8 @@ class CSSatelliteNetworkTest : CSTest() {
         uids = mutableSetOf(uid1)
         val uidRanges2: Array<UidRangeParcel?> = toUidRangeStableParcels(uidRangesForUids(uids))
         val config2 = NativeUidRangeConfig(
-            satelliteNetId, uidRanges2,
+            satelliteNetId,
+            uidRanges2,
             PREFERENCE_ORDER_SATELLITE_FALLBACK
         )
         updateSatelliteNetworkFallbackUids(uids)
@@ -164,7 +165,8 @@ class CSSatelliteNetworkTest : CSTest() {
     }
 
     private fun doTestUnregisterAfterReplacementSatisfier(destroyBeforeRequest: Boolean = false,
-                                                          destroyAfterRequest: Boolean = false) {
+                                                          destroyAfterRequest: Boolean = false
+    ) {
         val satelliteAgent = createSatelliteAgent("satellite0")
         satelliteAgent.connect()
 
@@ -241,11 +243,19 @@ class CSSatelliteNetworkTest : CSTest() {
     }
 
     private fun nativeNetworkConfigPhysical(netId: Int, permission: Int) =
-        NativeNetworkConfig(netId, NativeNetworkType.PHYSICAL, permission,
-            false /* secure */, VpnManager.TYPE_VPN_NONE, false /* excludeLocalRoutes */)
+        NativeNetworkConfig(
+            netId,
+            NativeNetworkType.PHYSICAL,
+            permission,
+            false /* secure */,
+            VpnManager.TYPE_VPN_NONE,
+            false /* excludeLocalRoutes */
+        )
 
     private fun createSatelliteAgent(name: String, restricted: Boolean = true): CSAgentWrapper {
-        return Agent(score = keepScore(), lp = lp(name),
+        return Agent(
+            score = keepScore(),
+            lp = lp(name),
             nc = satelliteNc(restricted)
         )
     }
@@ -289,10 +299,4 @@ class CSSatelliteNetworkTest : CSTest() {
         addLinkAddress(LinkAddress(LOCAL_IPV4_ADDRESS, 32))
         addRoute(RouteInfo(IpPrefix("0.0.0.0/0"), null, null))
     }
-
-    // This allows keeping all the networks connected without having to file individual requests
-    // for them.
-    private fun keepScore() = FromS(
-        NetworkScore.Builder().setKeepConnectedReason(KEEP_CONNECTED_FOR_TEST).build()
-    )
 }
diff --git a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
index 0fe61eca44..f57522018c 100644
--- a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
@@ -44,6 +44,7 @@ import android.net.NetworkCapabilities.TRANSPORT_WIFI
 import android.net.NetworkPolicyManager
 import android.net.NetworkProvider
 import android.net.NetworkScore
+import android.net.NetworkScore.KEEP_CONNECTED_FOR_TEST
 import android.net.PacProxyManager
 import android.net.connectivity.ConnectivityCompatChanges.ENABLE_MATCH_LOCAL_NETWORK
 import android.net.networkstack.NetworkStackClientBase
@@ -585,4 +586,10 @@ open class CSTest {
                 .build()
         return Agent(nc = nc, lp = lp)
     }
+
+    // This allows keeping all the networks connected without having to file individual requests
+    // for them.
+    fun keepScore() = FromS(
+        NetworkScore.Builder().setKeepConnectedReason(KEEP_CONNECTED_FOR_TEST).build()
+    )
 }

From ce737da8af4ec10977127d29f460539c9b7ad034 Mon Sep 17 00:00:00 2001
From: Remi NGUYEN VAN <reminv@google.com>
Date: Tue, 1 Apr 2025 17:33:33 +0900
Subject: [PATCH 041/377] Clean up allowMultipleSrvRecordsPerHost

This is hardcoded to true, and there is no use-case for setting it to
false.

Test: atest
Flag: EXEMPT refactor
Change-Id: I1c1b8f8ac4015adfa9900012c576312b5193433a
---
 .../server/connectivity/mdns/MdnsConfigs.java |  4 -
 .../mdns/MdnsResponseDecoder.java             | 79 ++++++-------------
 .../mdns/MdnsResponseDecoderTests.java        | 20 -----
 3 files changed, 22 insertions(+), 81 deletions(-)

diff --git a/service-t/src/com/android/server/connectivity/mdns/MdnsConfigs.java b/service-t/src/com/android/server/connectivity/mdns/MdnsConfigs.java
index d4aeacf29c..bf049c9419 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MdnsConfigs.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MdnsConfigs.java
@@ -89,8 +89,4 @@ public class MdnsConfigs {
     public static boolean allowNetworkInterfaceIndexPropagation() {
         return true;
     }
-
-    public static boolean allowMultipleSrvRecordsPerHost() {
-        return true;
-    }
 }
\ No newline at end of file
diff --git a/service-t/src/com/android/server/connectivity/mdns/MdnsResponseDecoder.java b/service-t/src/com/android/server/connectivity/mdns/MdnsResponseDecoder.java
index 52e76ada3e..0e9c804e42 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MdnsResponseDecoder.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MdnsResponseDecoder.java
@@ -35,8 +35,6 @@ import java.util.Set;
 public class MdnsResponseDecoder {
     public static final int SUCCESS = 0;
     private static final String TAG = "MdnsResponseDecoder";
-    private final boolean allowMultipleSrvRecordsPerHost =
-            MdnsConfigs.allowMultipleSrvRecordsPerHost();
     @Nullable private final String[] serviceType;
     private final MdnsUtils.Clock clock;
 
@@ -217,39 +215,20 @@ public class MdnsResponseDecoder {
             if (record instanceof MdnsInetAddressRecord) {
                 MdnsInetAddressRecord inetRecord = (MdnsInetAddressRecord) record;
                 inetRecords.add(inetRecord);
-                if (allowMultipleSrvRecordsPerHost) {
-                    List<MdnsResponse> matchingResponses =
-                            findResponsesWithHostName(responses, inetRecord.getName());
-                    for (MdnsResponse response : matchingResponses) {
-                        // Per RFC6762 10.2, clear all address records if the cache-flush bit set.
-                        // This bit, the cache-flush bit, tells neighboring hosts
-                        // that this is not a shared record type.  Instead of merging this new
-                        // record additively into the cache in addition to any previous records with
-                        // the same name, rrtype, and rrclass.
-                        // TODO: All old records with that name, rrtype, and rrclass that were
-                        //       received more than one second ago are declared invalid, and marked
-                        //       to expire from the cache in one second.
-                        if (inetRecord.getCacheFlush()) {
-                            response.clearInet4AddressRecords();
-                            response.clearInet6AddressRecords();
-                        }
-                    }
-                } else {
-                    MdnsResponse response =
-                            findResponseWithHostName(responses, inetRecord.getName());
-                    if (response != null) {
-                        // Per RFC6762 10.2, clear all address records if the cache-flush bit set.
-                        // This bit, the cache-flush bit, tells neighboring hosts
-                        // that this is not a shared record type.  Instead of merging this new
-                        // record additively into the cache in addition to any previous records with
-                        // the same name, rrtype, and rrclass.
-                        // TODO: All old records with that name, rrtype, and rrclass that were
-                        //       received more than one second ago are declared invalid, and marked
-                        //       to expire from the cache in one second.
-                        if (inetRecord.getCacheFlush()) {
-                            response.clearInet4AddressRecords();
-                            response.clearInet6AddressRecords();
-                        }
+                List<MdnsResponse> matchingResponses =
+                        findResponsesWithHostName(responses, inetRecord.getName());
+                for (MdnsResponse response : matchingResponses) {
+                    // Per RFC6762 10.2, clear all address records if the cache-flush bit set.
+                    // This bit, the cache-flush bit, tells neighboring hosts
+                    // that this is not a shared record type.  Instead of merging this new
+                    // record additively into the cache in addition to any previous records with
+                    // the same name, rrtype, and rrclass.
+                    // TODO: All old records with that name, rrtype, and rrclass that were
+                    //       received more than one second ago are declared invalid, and marked
+                    //       to expire from the cache in one second.
+                    if (inetRecord.getCacheFlush()) {
+                        response.clearInet4AddressRecords();
+                        response.clearInet6AddressRecords();
                     }
                 }
             }
@@ -257,28 +236,14 @@ public class MdnsResponseDecoder {
 
         // Loop 3-2: Assign addresses, which reference the host name in the SRV record.
         for (MdnsInetAddressRecord inetRecord : inetRecords) {
-            if (allowMultipleSrvRecordsPerHost) {
-                List<MdnsResponse> matchingResponses =
-                        findResponsesWithHostName(responses, inetRecord.getName());
-                for (MdnsResponse response : matchingResponses) {
-                    if (assignInetRecord(response, inetRecord)) {
-                        final MdnsResponse originalResponse = augmentedToOriginal.get(response);
-                        if (originalResponse == null
-                                || !originalResponse.hasIdenticalRecord(inetRecord)) {
-                            modified.add(response);
-                        }
-                    }
-                }
-            } else {
-                MdnsResponse response =
-                        findResponseWithHostName(responses, inetRecord.getName());
-                if (response != null) {
-                    if (assignInetRecord(response, inetRecord)) {
-                        final MdnsResponse originalResponse = augmentedToOriginal.get(response);
-                        if (originalResponse == null
-                                || !originalResponse.hasIdenticalRecord(inetRecord)) {
-                            modified.add(response);
-                        }
+            List<MdnsResponse> matchingResponses =
+                    findResponsesWithHostName(responses, inetRecord.getName());
+            for (MdnsResponse response : matchingResponses) {
+                if (assignInetRecord(response, inetRecord)) {
+                    final MdnsResponse originalResponse = augmentedToOriginal.get(response);
+                    if (originalResponse == null
+                            || !originalResponse.hasIdenticalRecord(inetRecord)) {
+                        modified.add(response);
                     }
                 }
             }
diff --git a/tests/unit/java/com/android/server/connectivity/mdns/MdnsResponseDecoderTests.java b/tests/unit/java/com/android/server/connectivity/mdns/MdnsResponseDecoderTests.java
index a22e8c6b0c..e257871e5c 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/MdnsResponseDecoderTests.java
+++ b/tests/unit/java/com/android/server/connectivity/mdns/MdnsResponseDecoderTests.java
@@ -41,7 +41,6 @@ import com.android.testutils.DevSdkIgnoreRule;
 import com.android.testutils.DevSdkIgnoreRunner;
 
 import org.junit.Before;
-import org.junit.Ignore;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 
@@ -356,7 +355,6 @@ public class MdnsResponseDecoderTests {
     @Test
     public void decode_singleHostname_multipleSrvRecords_flagEnabled_multipleCompleteResponses()
             throws Exception {
-        //MdnsScannerConfigsFlagsImpl.allowMultipleSrvRecordsPerHost.override(true);
         MdnsResponseDecoder decoder = new MdnsResponseDecoder(mClock, MATTER_SERVICE_TYPE);
         assertNotNull(matterDuplicateHostname);
 
@@ -381,24 +379,6 @@ public class MdnsResponseDecoderTests {
                         parseNumericAddress("2605:a601:a846:5700:3e61:5ff:fe0c:89f8"))));
     }
 
-    @Test
-    @Ignore("MdnsConfigs is not configurable currently.")
-    public void decode_singleHostname_multipleSrvRecords_flagDisabled_singleCompleteResponse()
-            throws Exception {
-        //MdnsScannerConfigsFlagsImpl.allowMultipleSrvRecordsPerHost.override(false);
-        MdnsResponseDecoder decoder = new MdnsResponseDecoder(mClock, MATTER_SERVICE_TYPE);
-        assertNotNull(matterDuplicateHostname);
-
-        responses = decode(decoder, matterDuplicateHostname);
-
-        // This should emit only two records:
-        assertEquals(2, responses.size());
-
-        // But only the first is complete:
-        assertTrue(responses.valueAt(0).isComplete());
-        assertFalse(responses.valueAt(1).isComplete());
-    }
-
     @Test
     public void testDecodeWithIpv4AddressChange() throws IOException {
         MdnsResponse response = makeMdnsResponse(0, DATAIN_SERVICE_NAME_1, List.of(

From 6c6128081f8a9aaa66b922ffbdcb8186d6593192 Mon Sep 17 00:00:00 2001
From: Junyu Lai <junyulai@google.com>
Date: Tue, 25 Mar 2025 18:08:19 +0800
Subject: [PATCH 042/377] Support Wifi P2P Group Owner local network agent

Flag: EXEMPT Flagged by DeviceCongfig wifip2pgo_local_network_agent
Test: atest ConnectivityCoverageTests:android.net.ip.IpServerTest \
      --update-device
Test: atest TetheringIntegrationTests:android.net.EthernetTetheringTest \
      --update-device
Bug: 406172997
Change-Id: I709082c05b576c17fd2823e687d63028b9b8a309
---
 Tethering/src/android/net/ip/IpServer.java    | 13 +++---
 .../tethering/TetheringConfiguration.java     |  7 +++
 .../android/net/EthernetTetheringTest.java    | 44 +++++++++++++++----
 .../unit/src/android/net/ip/IpServerTest.java | 14 ++++++
 4 files changed, 65 insertions(+), 13 deletions(-)

diff --git a/Tethering/src/android/net/ip/IpServer.java b/Tethering/src/android/net/ip/IpServer.java
index a651b1b198..baaaef5092 100644
--- a/Tethering/src/android/net/ip/IpServer.java
+++ b/Tethering/src/android/net/ip/IpServer.java
@@ -43,6 +43,7 @@ import static com.android.net.module.util.Inet4AddressUtils.intToInet4AddressHTH
 import static com.android.net.module.util.NetworkStackConstants.RFC7421_PREFIX_LENGTH;
 import static com.android.networkstack.tethering.TetheringConfiguration.TETHERING_LOCAL_NETWORK_AGENT;
 import static com.android.networkstack.tethering.TetheringConfiguration.USE_SYNC_SM;
+import static com.android.networkstack.tethering.TetheringConfiguration.WIFIP2PGO_LOCAL_NETWORK_AGENT;
 import static com.android.networkstack.tethering.util.PrefixUtils.asIpPrefix;
 import static com.android.networkstack.tethering.util.TetheringMessageBase.BASE_IPSERVER;
 import static com.android.networkstack.tethering.util.TetheringUtils.getTransportTypeForTetherableType;
@@ -334,7 +335,8 @@ public class IpServer extends StateMachineShim {
     private final Handler mHandler;
     private final Context mContext;
 
-    private final boolean mSupportLocalAgent;
+    private final boolean mSupportTetheringLocalAgent;
+    private final boolean mSupportWifiP2pGroupOwnerLocalAgent;
 
     // This will be null if the TetheredState is not entered or feature not supported.
     // This will be only accessed from the IpServer handler thread.
@@ -380,8 +382,10 @@ public class IpServer extends StateMachineShim {
         mServingMode = STATE_AVAILABLE;
 
         // Tethering network agent is supported on V+, and will be rolled out gradually.
-        mSupportLocalAgent = SdkLevel.isAtLeastV()
+        mSupportTetheringLocalAgent = SdkLevel.isAtLeastV()
                 && mDeps.isFeatureEnabled(mContext, TETHERING_LOCAL_NETWORK_AGENT);
+        mSupportWifiP2pGroupOwnerLocalAgent = mSupportTetheringLocalAgent
+                && mDeps.isFeatureEnabled(mContext, WIFIP2PGO_LOCAL_NETWORK_AGENT);
 
         mInitialState = new InitialState();
         mLocalHotspotState = new LocalHotspotState();
@@ -1162,9 +1166,8 @@ public class IpServer extends StateMachineShim {
 
         @SuppressLint("NewApi")
         private void startServingInterface() {
-            // TODO: Enable Network Agent for Wifi P2P Group Owner mode when Network Agent
-            //  for Group Client mode is supported.
-            if (mSupportLocalAgent && getScope() == CONNECTIVITY_SCOPE_GLOBAL) {
+            if (mSupportTetheringLocalAgent && (mSupportWifiP2pGroupOwnerLocalAgent
+                    || getScope() != CONNECTIVITY_SCOPE_LOCAL)) {
                 try {
                     mTetheringAgent = mDeps.makeNetworkAgent(mContext, Looper.myLooper(), TAG,
                             mInterfaceType, mLinkProperties);
diff --git a/Tethering/src/com/android/networkstack/tethering/TetheringConfiguration.java b/Tethering/src/com/android/networkstack/tethering/TetheringConfiguration.java
index e2609e7d2f..bac2a7dead 100644
--- a/Tethering/src/com/android/networkstack/tethering/TetheringConfiguration.java
+++ b/Tethering/src/com/android/networkstack/tethering/TetheringConfiguration.java
@@ -154,6 +154,13 @@ public class TetheringConfiguration {
      */
     public static final String TETHERING_LOCAL_NETWORK_AGENT = "tethering_local_network_agent";
 
+    /**
+     * A feature flag to control whether the Wifi P2P Group Owner local network agent
+     * should be enabled. Disabled by default. This depends on TETHERING_LOCAL_AGENT
+     * and will not be enabled if that flag is off.
+     */
+    public static final String WIFIP2PGO_LOCAL_NETWORK_AGENT = "wifip2pgo_local_network_agent";
+
     public final String[] tetherableUsbRegexs;
     public final String[] tetherableWifiRegexs;
     public final String[] tetherableWigigRegexs;
diff --git a/Tethering/tests/integration/src/android/net/EthernetTetheringTest.java b/Tethering/tests/integration/src/android/net/EthernetTetheringTest.java
index d47f4b3294..a2bf3a6c99 100644
--- a/Tethering/tests/integration/src/android/net/EthernetTetheringTest.java
+++ b/Tethering/tests/integration/src/android/net/EthernetTetheringTest.java
@@ -219,6 +219,7 @@ public class EthernetTetheringTest extends EthernetTetheringTestBase {
 
     // Shamelessly copied from TetheringConfiguration.
     private static final String TETHERING_LOCAL_NETWORK_AGENT = "tethering_local_network_agent";
+    private static final String WIFIP2PGO_LOCAL_NETWORK_AGENT = "wifip2pgo_local_network_agent";
 
     @After
     public void tearDown() throws Exception {
@@ -1245,15 +1246,29 @@ public class EthernetTetheringTest extends EthernetTetheringTestBase {
         }
     }
 
+    private void assumeMatchNonThreadLocalNetworksEnabled() {
+        assumeTrue(runAsShell(READ_COMPAT_CHANGE_CONFIG, LOG_COMPAT_CHANGE,
+                () -> CompatChanges.isChangeEnabled(ENABLE_MATCH_NON_THREAD_LOCAL_NETWORKS)));
+    }
+
     @IgnoreUpTo(Build.VERSION_CODES.UPSIDE_DOWN_CAKE)
     @Test
-    public void testLocalAgent_networkCallbacks() throws Exception {
-        final boolean isMatchNonThreadLocalNetworksEnabled = runAsShell(
-                READ_COMPAT_CHANGE_CONFIG, LOG_COMPAT_CHANGE,
-                () -> CompatChanges.isChangeEnabled(ENABLE_MATCH_NON_THREAD_LOCAL_NETWORKS));
-        assumeTrue(isMatchNonThreadLocalNetworksEnabled);
-
+    public void testTetheringLocalAgent_networkCallbacks() throws Exception {
+        assumeMatchNonThreadLocalNetworksEnabled();
         mDeviceConfigRule.setConfig(NAMESPACE_TETHERING, TETHERING_LOCAL_NETWORK_AGENT, "1");
+        doTestLocalAgent_networkCallbacks(CONNECTIVITY_SCOPE_GLOBAL);
+    }
+
+    @IgnoreUpTo(Build.VERSION_CODES.UPSIDE_DOWN_CAKE)
+    @Test
+    public void testWifiP2pGroupOwnerLocalAgent_networkCallbacks() throws Exception {
+        assumeMatchNonThreadLocalNetworksEnabled();
+        mDeviceConfigRule.setConfig(NAMESPACE_TETHERING, TETHERING_LOCAL_NETWORK_AGENT, "1");
+        mDeviceConfigRule.setConfig(NAMESPACE_TETHERING, WIFIP2PGO_LOCAL_NETWORK_AGENT, "1");
+        doTestLocalAgent_networkCallbacks(CONNECTIVITY_SCOPE_LOCAL);
+    }
+
+    private void doTestLocalAgent_networkCallbacks(int scope) throws Exception {
         assumeFalse(isInterfaceForTetheringAvailable());
         setIncludeTestInterfaces(true);
 
@@ -1273,9 +1288,13 @@ public class EthernetTetheringTest extends EthernetTetheringTestBase {
                     downstreamIface.getInterfaceName(), iface);
 
             final TetheringRequest request = new TetheringRequest.Builder(TETHERING_ETHERNET)
-                    .setConnectivityScope(CONNECTIVITY_SCOPE_GLOBAL).build();
+                    .setConnectivityScope(scope).build();
             tetheringEventCallback = enableTethering(iface, request, null /* any upstream */);
-            tetheringEventCallback.awaitInterfaceTethered();
+            if (scope == CONNECTIVITY_SCOPE_GLOBAL) {
+                tetheringEventCallback.awaitInterfaceTethered();
+            } else {
+                tetheringEventCallback.awaitInterfaceLocalOnly();
+            }
 
             // Verify NetworkCallback works accordingly.
             final Network network = networkCallback.expect(CallbackEntry.AVAILABLE).getNetwork();
@@ -1284,6 +1303,15 @@ public class EthernetTetheringTest extends EthernetTetheringTestBase {
             assertEquals(network, capEvent.getNetwork());
             assertTrue(capEvent.getCaps().hasTransport(TRANSPORT_ETHERNET));
             assertTrue(capEvent.getCaps().hasCapability(NET_CAPABILITY_LOCAL_NETWORK));
+
+            // Verify details in the LinkPropertiesChanged event.
+            final CallbackEntry.LinkPropertiesChanged lpEvent =
+                    networkCallback.eventuallyExpect(CallbackEntry.LINK_PROPERTIES_CHANGED);
+            assertEquals(network, lpEvent.getNetwork());
+            assertEquals(iface, lpEvent.getLp().getInterfaceName());
+            assertTrue(lpEvent.getLp().hasIPv4Address());
+            // At least one Ipv4 route for the subnet is needed.
+            assertTrue(lpEvent.getLp().getRoutes().size() >= 1);
         } finally {
             stopEthernetTethering(tetheringEventCallback);
             maybeCloseTestInterface(downstreamIface);
diff --git a/Tethering/tests/unit/src/android/net/ip/IpServerTest.java b/Tethering/tests/unit/src/android/net/ip/IpServerTest.java
index dc90d686f0..89fa34c60c 100644
--- a/Tethering/tests/unit/src/android/net/ip/IpServerTest.java
+++ b/Tethering/tests/unit/src/android/net/ip/IpServerTest.java
@@ -41,6 +41,7 @@ import static com.android.modules.utils.build.SdkLevel.isAtLeastT;
 import static com.android.modules.utils.build.SdkLevel.isAtLeastV;
 import static com.android.net.module.util.Inet4AddressUtils.intToInet4AddressHTH;
 import static com.android.networkstack.tethering.TetheringConfiguration.TETHERING_LOCAL_NETWORK_AGENT;
+import static com.android.networkstack.tethering.TetheringConfiguration.WIFIP2PGO_LOCAL_NETWORK_AGENT;
 
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
@@ -1123,20 +1124,33 @@ public class IpServerTest {
 
     @IgnoreUpTo(Build.VERSION_CODES.UPSIDE_DOWN_CAKE)
     @SetFeatureFlagsRule.FeatureFlag(name = TETHERING_LOCAL_NETWORK_AGENT, enabled = false)
+    @SetFeatureFlagsRule.FeatureFlag(name = WIFIP2PGO_LOCAL_NETWORK_AGENT)
     @Test
     public void testTetheringNetworkAgent_tetheringAgentDisabled() throws Exception {
         doTestTetheringNetworkAgent(CONNECTIVITY_SCOPE_GLOBAL, false);
+        // Even if the flag is enabled, no wifip2p network agent if the tethering network
+        // agent feature is not supported.
+        doTestTetheringNetworkAgent(CONNECTIVITY_SCOPE_LOCAL, false);
     }
 
     // Verify Tethering Network Agent feature doesn't affect Wi-fi P2P Group Owner although
     // the code is mostly shared.
     @IgnoreUpTo(Build.VERSION_CODES.UPSIDE_DOWN_CAKE)
     @SetFeatureFlagsRule.FeatureFlag(name = TETHERING_LOCAL_NETWORK_AGENT)
+    @SetFeatureFlagsRule.FeatureFlag(name = WIFIP2PGO_LOCAL_NETWORK_AGENT, enabled = false)
     @Test
     public void testTetheringNetworkAgent_p2pGroupOwnerAgentDisabled() throws Exception {
         doTestTetheringNetworkAgent(CONNECTIVITY_SCOPE_LOCAL, false);
     }
 
+    @IgnoreUpTo(Build.VERSION_CODES.UPSIDE_DOWN_CAKE)
+    @SetFeatureFlagsRule.FeatureFlag(name = TETHERING_LOCAL_NETWORK_AGENT)
+    @SetFeatureFlagsRule.FeatureFlag(name = WIFIP2PGO_LOCAL_NETWORK_AGENT)
+    @Test
+    public void testTetheringNetworkAgent_p2pGroupOwnerAgentEnabled() throws Exception {
+        doTestTetheringNetworkAgent(CONNECTIVITY_SCOPE_LOCAL, true);
+    }
+
     private void doTestTetheringNetworkAgent(int scope, boolean expectAgentEnabled)
             throws Exception {
         initStateMachine(TETHERING_USB);

From c3af22facad93a2d85559b7e1afa9dd49786d384 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Fri, 28 Mar 2025 19:50:46 -0700
Subject: [PATCH 043/377] Introduce generic packet builder utilities for use in
 tests

This change introduces a set of generic packet builder utility classes
that can be used in tests. The API surface aims to be similar to scapy
with a focus on ease of use.

Test: TH
Flag: EXEMPT mainline
Bug: 1
Change-Id: I9c751cece7bbad6bc38953cb52e9ab42393bab89
---
 .../android/testutils/PacketBuilderUtils.kt   | 216 ++++++++++++++++++
 1 file changed, 216 insertions(+)
 create mode 100644 staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
new file mode 100644
index 0000000000..688c49eba5
--- /dev/null
+++ b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
@@ -0,0 +1,216 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.testutils
+
+import android.net.IpPrefix
+import android.net.MacAddress
+import java.io.ByteArrayOutputStream
+import java.net.Inet6Address
+import java.net.InetAddress
+import java.nio.ByteBuffer
+import java.util.EnumSet
+
+interface Packet {
+    fun toByteArray(): ByteArray
+}
+
+interface L3Packet : Packet {
+    val etherType: Short
+}
+
+interface L4Packet : Packet {
+    val proto: Byte
+    val size: Short
+}
+
+private interface Flags {
+    val value: Int
+}
+
+private fun <E> EnumSet<E>.toByte(): Byte where E : Enum<E>, E : Flags {
+    val result = this.fold(0) { result, next -> result or next.value }
+    return result.toByte()
+}
+
+private inline fun <reified E> enumSetOfFlags(str: String): EnumSet<E>
+        where E : Enum<E>, E : Flags {
+    val result = EnumSet.noneOf(E::class.java)
+    for (char in str) {
+        result.add(enumValueOf<E>(char.uppercase()))
+    }
+    return result
+}
+
+/**
+ * Class that facilitates the creation of RA packets.
+ *
+ * Default argument values reflect the rfc4861 defaults where applicable.
+ */
+class RaPkt(
+    private val routerLft: Short,
+    private val reachableTime: Int,
+    private val retransTimer: Int,
+    private val flags: EnumSet<RaFlags>,
+) : L4Packet {
+    constructor(
+        routerLft: Short = 1800,
+        reachableTime: Int = 0,
+        retransTimer: Int = 0,
+        flags: String = "",
+    ) : this(routerLft, reachableTime, retransTimer, enumSetOfFlags<RaFlags>(flags))
+
+    enum class RaFlags(override val value: Int) : Flags {
+        M(0x80),
+        O(0x40),
+    }
+
+    override val proto: Byte = 58
+    override val size: Short
+      get() = outputStream.size().toShort()
+    private val outputStream = ByteArrayOutputStream()
+
+    init {
+        val raHeader = ByteBuffer.allocate(16)
+        raHeader.put(134.toByte()) // Type = 134 (Router Advertisement)
+        raHeader.put(0) // Code = 0
+        raHeader.putShort(0) // Checksum = 0 (ignored)
+        raHeader.put(255.toByte()) // Cur Hop Limit
+        raHeader.put(flags.toByte())
+        raHeader.putShort(routerLft)
+        raHeader.putInt(reachableTime)
+        raHeader.putInt(retransTimer)
+        raHeader.flip()
+        outputStream.write(raHeader.array())
+    }
+
+    enum class PioFlags(override val value: Int) : Flags {
+        L(0x80),
+        A(0x40),
+        R(0x20),
+        P(0x10),
+    }
+
+    fun addPioOption(
+            prefix: IpPrefix,
+            validLft: Int,
+            preferredLft: Int,
+            flags: EnumSet<PioFlags>,
+    ) {
+        if (!prefix.isIPv6()) throw IllegalArgumentException("Invalid prefix")
+        val pio = ByteBuffer.allocate(32)
+        pio.put(3) // Type = 3
+        pio.put(4) // Length = 4 (*8)
+        pio.put(prefix.getPrefixLength().toByte()) // Prefix Length
+        pio.put(flags.toByte()) // Flags
+        pio.putInt(validLft) // Valid Lifetime
+        pio.putInt(preferredLft) // Preferred Lifetime
+        pio.putInt(0) // Reserved2
+        pio.put(prefix.getRawAddress())
+        pio.flip()
+        outputStream.write(pio.array())
+    }
+
+    fun addPioOption(
+            prefix: String,
+            validLft: Int = 2592000,
+            preferredLft: Int = 604800,
+            flags: String = "L",
+    ) {
+        addPioOption(IpPrefix(prefix), validLft, preferredLft, enumSetOfFlags<PioFlags>(flags))
+    }
+
+    override fun toByteArray() = outputStream.toByteArray()
+}
+
+/** Class that facilitates the creation of IPv6 packets. */
+class Ip6Pkt(
+        private val src: Inet6Address,
+        private val dst: Inet6Address,
+        private val payload: L4Packet,
+) : L3Packet {
+    constructor(src: String, dst: String, payload: L4Packet) : this(
+            InetAddress.getByName(src) as Inet6Address,
+            InetAddress.getByName(dst) as Inet6Address,
+            payload,
+    ) {}
+
+    override val etherType = 0x86dd.toShort()
+
+    private val tc = 0
+    private val flowlabel = 0
+    private val hlim = 255.toByte()
+
+    private val bytes: ByteArray
+
+    init {
+        val ipv6Header = ByteBuffer.allocate(40)
+        ipv6Header.putInt((6 shl 28) or (tc shl 20) or flowlabel)
+        ipv6Header.putShort(payload.size)
+        ipv6Header.put(payload.proto)
+        ipv6Header.put(hlim)
+        ipv6Header.put(src.getAddress())
+        ipv6Header.put(dst.getAddress())
+        ipv6Header.flip()
+
+        val outputStream = ByteArrayOutputStream()
+        outputStream.write(ipv6Header.array())
+        outputStream.write(payload.toByteArray())
+        bytes = outputStream.toByteArray()
+    }
+
+    override fun toByteArray() = bytes
+}
+
+/**
+ * Class that facilitates the creation of ethernet packets.
+ *
+ * Example code:
+ *
+ * <pre>
+ * {@code
+ * val ra = RaPkt(routerLft = 50, reachableTime = 100, flags = "O")
+ * ra.addPioOption(prefix = "2001:db8::1/64", flags = "LA")
+ * val ipv6 = Ip6Pkt(src = "fe80::1", dst = "fe80::2", payload = ra)
+ * val ether = EtherPkt(src = "1:2:3:4:5:6", dst = "1:1:1:1:1:1", payload = ipv6)
+ * }
+ * </pre>
+ **/
+class EtherPkt(
+        dst: MacAddress,
+        src: MacAddress,
+        payload: L3Packet,
+    ) : Packet {
+    constructor(dst: String, src: String, payload: L3Packet) :
+        this(MacAddress.fromString(dst), MacAddress.fromString(src), payload) {}
+
+    val bytes: ByteArray
+
+    init {
+        val ethernetHeader = ByteBuffer.allocate(14)
+        ethernetHeader.put(dst.toByteArray())
+        ethernetHeader.put(src.toByteArray())
+        ethernetHeader.putShort(payload.etherType)
+        ethernetHeader.flip()
+
+        val outputStream = ByteArrayOutputStream()
+        outputStream.write(ethernetHeader.array())
+        outputStream.write(payload.toByteArray())
+        bytes = outputStream.toByteArray()
+    }
+
+    override fun toByteArray() = bytes
+}

From 62154f61be79e135b61f7ea441ba21a1a692f116 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Tue, 1 Apr 2025 14:45:46 -0700
Subject: [PATCH 044/377] Remove unnecessary {}

Test: TH
Flag: EXEMPT mainline
Bug: 100
Change-Id: I4ca9f92ce6535cf6f07aa74a94ee58ced541e73f
---
 .../devicetests/com/android/testutils/PacketBuilderUtils.kt   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
index 688c49eba5..d40d3a142d 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
@@ -146,7 +146,7 @@ class Ip6Pkt(
             InetAddress.getByName(src) as Inet6Address,
             InetAddress.getByName(dst) as Inet6Address,
             payload,
-    ) {}
+    )
 
     override val etherType = 0x86dd.toShort()
 
@@ -195,7 +195,7 @@ class EtherPkt(
         payload: L3Packet,
     ) : Packet {
     constructor(dst: String, src: String, payload: L3Packet) :
-        this(MacAddress.fromString(dst), MacAddress.fromString(src), payload) {}
+        this(MacAddress.fromString(dst), MacAddress.fromString(src), payload)
 
     val bytes: ByteArray
 

From 6269bbdedbf0fda3e29298a55ae696a14d49fda8 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Tue, 1 Apr 2025 16:26:30 -0700
Subject: [PATCH 045/377] Add packet builder support for more RA options

Test: Built packet and parsed it in packetor
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I69d3451cbdd7f229f914ee5d0e4dd2c7a5178f0a
---
 .../android/testutils/PacketBuilderUtils.kt   | 60 +++++++++++++++++++
 1 file changed, 60 insertions(+)

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
index d40d3a142d..b6ef68bb0d 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
@@ -133,6 +133,66 @@ class RaPkt(
         addPioOption(IpPrefix(prefix), validLft, preferredLft, enumSetOfFlags<PioFlags>(flags))
     }
 
+    fun addRdnssOption(dns: List<Inet6Address>, lft: Int) {
+        val length = 1 + (dns.size * 2)
+        val rdnss = ByteBuffer.allocate(length * 8) // length is in units of 8 octets.
+        rdnss.put(25) // Type = 25
+        rdnss.put(length.toByte()) // Length = 1 + number of dns servers * 2 in units of 8 octets.
+        rdnss.putShort(0) // Reserved
+        rdnss.putInt(lft)
+        for (dnsServer in dns) {
+            rdnss.put(dnsServer.address)
+        }
+        rdnss.flip()
+        outputStream.write(rdnss.array())
+    }
+
+    fun addRdnssOption(dns: String, lft: Int = 1800) {
+        val dnsServers = dns.split(",").map { InetAddress.getByName(it) as Inet6Address }
+        addRdnssOption(dnsServers, lft)
+    }
+
+    fun addRioOption(prefix: IpPrefix, lft: Int) {
+        val rio = ByteBuffer.allocate(24)
+        rio.put(24) // Type = 24
+        rio.put(3) // Length = 3 -- TODO: support variable prefix length
+        rio.put(prefix.prefixLength.toByte())
+        // TODO: support setting pref
+        rio.put(0) // res (3 bits) | pref (2 bits) | res (3 bits)
+        rio.putInt(lft)
+        rio.put(prefix.rawAddress)
+        rio.flip()
+        outputStream.write(rio.array())
+    }
+
+    fun addRioOption(prefix: String, lft: Int = 1800) {
+        addRioOption(IpPrefix(prefix), lft)
+    }
+
+    fun addPref64Option(prefix: IpPrefix, lft: Int) {
+        val pref64 = ByteBuffer.allocate(16)
+        pref64.put(38) // Type = 38
+        pref64.put(2) // Length = 2 (*8)
+        val scaledLifetime = lft and 0xfff8
+        val plc = when (prefix.prefixLength) {
+            96 -> 0
+            64 -> 1
+            56 -> 2
+            48 -> 3
+            40 -> 4
+            32 -> 5
+            else -> throw IllegalArgumentException("Invalid pref64 prefix length")
+        }
+        pref64.putShort((scaledLifetime or plc).toShort()) // Scaled lft (13 bits) | plc (3 bits)
+        pref64.put(prefix.rawAddress, 0 /*offset*/, 12 /*length*/) // highest 96 bits of prefix.
+        pref64.flip()
+        outputStream.write(pref64.array())
+    }
+
+    fun addPref64Option(prefix: String, lft: Int = 1800) {
+        addPref64Option(IpPrefix(prefix), lft)
+    }
+
     override fun toByteArray() = outputStream.toByteArray()
 }
 

From bdc48fcc63af53e7975652d7633ef389e1326caa Mon Sep 17 00:00:00 2001
From: Remi NGUYEN VAN <reminv@google.com>
Date: Mon, 24 Mar 2025 15:46:30 +0900
Subject: [PATCH 046/377] Let MdnsSocket guess networks of incoming packets

When using MdnsSocketClient (unused in the platform, may be used as a
library), allow guessing the Network of incoming packets based on their
source address.

This is flawed as there may be races between LinkProperties updates,
interfaces going up/down, and packets being received, and the source
address can not always be mapped 1:1 to an interface prefix, but it
should improve the situation for legacy code that currently assumes the
Network is the last one that was used for sending, which is often wrong.

Test: atest
Flag: EXEMPT: dead code in Android repo
Change-Id: I885c741d3d40b1b128a06b6d7a7aff8e0551ffea
---
 ...ctivityMonitorWithConnectivityManager.java | 108 +++++++++++++++++-
 .../connectivity/mdns/MdnsFeatureFlags.java   |  17 +++
 .../connectivity/mdns/MdnsSocketClient.java   |  21 +++-
 .../MulticastNetworkInterfaceProvider.java    |  16 ++-
 .../mdns/NetworkInterfaceWrapper.java         |   6 +
 ...tyMonitorWithConnectivityManagerTests.java |  91 +++++++++++++--
 ...ulticastNetworkInterfaceProviderTests.java |   3 +-
 7 files changed, 242 insertions(+), 20 deletions(-)

diff --git a/service-t/src/com/android/server/connectivity/mdns/ConnectivityMonitorWithConnectivityManager.java b/service-t/src/com/android/server/connectivity/mdns/ConnectivityMonitorWithConnectivityManager.java
index 87aa0d2295..2724d2ec2b 100644
--- a/service-t/src/com/android/server/connectivity/mdns/ConnectivityMonitorWithConnectivityManager.java
+++ b/service-t/src/com/android/server/connectivity/mdns/ConnectivityMonitorWithConnectivityManager.java
@@ -16,17 +16,30 @@
 
 package com.android.server.connectivity.mdns;
 
+import android.annotation.NonNull;
 import android.annotation.Nullable;
 import android.annotation.TargetApi;
 import android.content.Context;
 import android.net.ConnectivityManager;
+import android.net.LinkProperties;
 import android.net.Network;
 import android.net.NetworkCapabilities;
 import android.net.NetworkRequest;
 import android.os.Build;
+import android.util.ArrayMap;
+import android.util.Pair;
 
+import androidx.annotation.GuardedBy;
+
+import com.android.net.module.util.CollectionUtils;
 import com.android.net.module.util.SharedLog;
 
+import java.net.Inet6Address;
+import java.net.InetAddress;
+import java.net.NetworkInterface;
+import java.util.List;
+import java.util.function.Predicate;
+
 /** Class for monitoring connectivity changes using {@link ConnectivityManager}. */
 public class ConnectivityMonitorWithConnectivityManager implements ConnectivityMonitor {
     private static final String TAG = "ConnMntrWConnMgr";
@@ -34,6 +47,8 @@ public class ConnectivityMonitorWithConnectivityManager implements ConnectivityM
     private final Listener listener;
     private final ConnectivityManager.NetworkCallback networkCallback;
     private final ConnectivityManager connectivityManager;
+    @GuardedBy("knownNetworks")
+    private final ArrayMap<Network, LinkProperties> knownNetworks = new ArrayMap<>();
     // TODO(b/71901993): Ideally we shouldn't need this flag. However we still don't have clues why
     // the receiver is unregistered twice yet.
     private boolean isCallbackRegistered = false;
@@ -51,15 +66,26 @@ public class ConnectivityMonitorWithConnectivityManager implements ConnectivityM
         networkCallback =
                 new ConnectivityManager.NetworkCallback() {
                     @Override
-                    public void onAvailable(Network network) {
-                        sharedLog.log("network available.");
-                        lastAvailableNetwork = network;
-                        notifyConnectivityChange();
+                    public void onLinkPropertiesChanged(
+                            @NonNull Network network,
+                            @NonNull LinkProperties linkProperties) {
+                        final boolean newNetwork;
+                        synchronized (knownNetworks) {
+                            newNetwork = knownNetworks.put(network, linkProperties) == null;
+                        }
+                        if (newNetwork) {
+                            sharedLog.log("network available: " + network);
+                            lastAvailableNetwork = network;
+                            notifyConnectivityChange();
+                        }
                     }
 
                     @Override
                     public void onLost(Network network) {
-                        sharedLog.log("network lost.");
+                        sharedLog.log("network lost: " + network);
+                        synchronized (knownNetworks) {
+                            knownNetworks.remove(network);
+                        }
                         notifyConnectivityChange();
                     }
 
@@ -105,6 +131,9 @@ public class ConnectivityMonitorWithConnectivityManager implements ConnectivityM
         }
 
         connectivityManager.unregisterNetworkCallback(networkCallback);
+        synchronized (knownNetworks) {
+            knownNetworks.clear();
+        }
         isCallbackRegistered = false;
     }
 
@@ -113,4 +142,73 @@ public class ConnectivityMonitorWithConnectivityManager implements ConnectivityM
     public Network getAvailableNetwork() {
         return lastAvailableNetwork;
     }
+
+    /**
+     * Try to guess which network a remote host may be in.
+     *
+     * <p>This is not a perfect guess as it depends on the timing of LinkProperties updates and
+     * interfaces going up/down. Also, it is possible that two interfaces have overlapping prefixes,
+     * in which case it is not possible to know which one is correct from just an address. This is
+     * intended as an incremental improvement for legacy code that cannot use MdnsSocketProvider,
+     * which uses per-Network sockets to avoid this problem.
+     *
+     * @param address The address of a remote host.
+     * @return The SocketKey with Network and interface if it could be determined, or null.
+     */
+    @Nullable
+    public SocketKey guessNetworkOfRemoteHost(@NonNull List<NetworkInterfaceWrapper> knownIfaces,
+            @NonNull InetAddress address) {
+        if (address.isLinkLocalAddress()) {
+            final int scopeId = ((Inet6Address) address).getScopeId();
+            for (NetworkInterfaceWrapper iface : knownIfaces) {
+                if (iface.getIndex() == scopeId) {
+                    return getSocketKeyForInterface(iface.getNetworkInterface());
+                }
+            }
+            return null;
+        }
+        // Find a matching network from the address.
+        final Pair<Network, LinkProperties> match = findMatchingNetwork(lp ->
+                // Do not consider stacked links (lp.getAllRoutes), as they are generally not
+                // compatible with MDNS, and this is consistent with MdnsSocketProvider.
+                // Note LinkProperties does not always contain routes for local subnets before P
+                // (change ID I35b614eebccfd22c4a5270f40256f9be1e25abfb), but on M+ Wi-Fi does add
+                // them from netlink/DHCP.
+                CollectionUtils.any(lp.getRoutes(), r -> r.matches(address)));
+        if (match == null) {
+            return null;
+        }
+        // Find a matching interface index for the network.
+        final NetworkInterfaceWrapper netIf = CollectionUtils.findFirst(knownIfaces, iface ->
+                iface.getName().equals(match.second.getInterfaceName()));
+        if (netIf == null) {
+            return null;
+        }
+        return new SocketKey(match.first, netIf.getIndex());
+    }
+
+    @Nullable
+    private SocketKey getSocketKeyForInterface(@Nullable NetworkInterface iface) {
+        if (iface == null) {
+            return null;
+        }
+        final Pair<Network, LinkProperties> match = findMatchingNetwork(
+                lp -> iface.getName().equals(lp.getInterfaceName()));
+        return match == null ? null : new SocketKey(match.first, iface.getIndex());
+    }
+
+    private Pair<Network, LinkProperties> findMatchingNetwork(
+            @NonNull Predicate<LinkProperties> predicate) {
+        synchronized (knownNetworks) {
+            for (int i = 0; i < knownNetworks.size(); i++) {
+                final LinkProperties lp = knownNetworks.valueAt(i);
+                // Do not consider stacked links (lp.getAllInterfaceNames), as they are generally
+                // not compatible with MDNS, and this is consistent with MdnsSocketProvider.
+                if (predicate.test(lp)) {
+                    return new Pair<>(knownNetworks.keyAt(i), knownNetworks.valueAt(i));
+                }
+            }
+        }
+        return null;
+    }
 }
\ No newline at end of file
diff --git a/service-t/src/com/android/server/connectivity/mdns/MdnsFeatureFlags.java b/service-t/src/com/android/server/connectivity/mdns/MdnsFeatureFlags.java
index 11a374d9c8..9ea6f5315f 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MdnsFeatureFlags.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MdnsFeatureFlags.java
@@ -139,6 +139,9 @@ public class MdnsFeatureFlags {
     // Flag to use shorter (16 characters + .local) hostnames
     public final boolean mIsShortHostnamesEnabled;
 
+    // Flag to enable guessing the Network of received packets in the legacy MdnsSocketClient.
+    public final boolean mIsSocketClientNetworkGuessingEnabled;
+
     @Nullable
     private final FlagOverrideProvider mOverrideProvider;
 
@@ -262,6 +265,7 @@ public class MdnsFeatureFlags {
             long cachedServicesRetentionTime,
             boolean isAccurateDelayCallbackEnabled,
             boolean isShortHostnamesEnabled,
+            boolean isSocketClientNetworkGuessingEnabled,
             @Nullable FlagOverrideProvider overrideProvider) {
         mIsMdnsOffloadFeatureEnabled = isOffloadFeatureEnabled;
         mIncludeInetAddressRecordsInProbing = includeInetAddressRecordsInProbing;
@@ -276,6 +280,7 @@ public class MdnsFeatureFlags {
         mCachedServicesRetentionTime = cachedServicesRetentionTime;
         mIsAccurateDelayCallbackEnabled = isAccurateDelayCallbackEnabled;
         mIsShortHostnamesEnabled = isShortHostnamesEnabled;
+        mIsSocketClientNetworkGuessingEnabled = isSocketClientNetworkGuessingEnabled;
         mOverrideProvider = overrideProvider;
     }
 
@@ -301,6 +306,7 @@ public class MdnsFeatureFlags {
         private long mCachedServicesRetentionTime;
         private boolean mIsAccurateDelayCallbackEnabled;
         private boolean mIsShortHostnamesEnabled;
+        private boolean mIsSocketClientNetworkGuessingEnabled;
         private FlagOverrideProvider mOverrideProvider;
 
         /**
@@ -320,6 +326,7 @@ public class MdnsFeatureFlags {
             mCachedServicesRetentionTime = DEFAULT_CACHED_SERVICES_RETENTION_TIME_MILLISECONDS;
             mIsAccurateDelayCallbackEnabled = false;
             mIsShortHostnamesEnabled = true; // Default enabled.
+            mIsSocketClientNetworkGuessingEnabled = false;
             mOverrideProvider = null;
         }
 
@@ -465,6 +472,15 @@ public class MdnsFeatureFlags {
             return this;
         }
 
+        /**
+         * Set whether MdnsSocketClient should try to guess the Network of received packets.
+         */
+        public Builder setIsSocketClientNetworkGuessingEnabled(
+                boolean isSocketClientNetworkGuessingEnabled) {
+            mIsSocketClientNetworkGuessingEnabled = isSocketClientNetworkGuessingEnabled;
+            return this;
+        }
+
         /**
          * Builds a {@link MdnsFeatureFlags} with the arguments supplied to this builder.
          */
@@ -482,6 +498,7 @@ public class MdnsFeatureFlags {
                     mCachedServicesRetentionTime,
                     mIsAccurateDelayCallbackEnabled,
                     mIsShortHostnamesEnabled,
+                    mIsSocketClientNetworkGuessingEnabled,
                     mOverrideProvider);
         }
     }
diff --git a/service-t/src/com/android/server/connectivity/mdns/MdnsSocketClient.java b/service-t/src/com/android/server/connectivity/mdns/MdnsSocketClient.java
index 17e5b312ca..0d727794ea 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MdnsSocketClient.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MdnsSocketClient.java
@@ -451,13 +451,26 @@ public class MdnsSocketClient implements MdnsSocketClientBase {
 
                 if (!shouldStopSocketLoop) {
                     String responseType = socket == multicastSocket ? MULTICAST_TYPE : UNICAST_TYPE;
+                    final SocketKey key = mdnsFeatureFlags.mIsSocketClientNetworkGuessingEnabled
+                            ? interfaceProvider.guessNetworkOfRemoteHost(packet.getAddress())
+                            : null;
+                    final int interfaceIndex;
+                    if (socket == null || !propagateInterfaceIndex) {
+                        interfaceIndex = MdnsSocket.INTERFACE_INDEX_UNSPECIFIED;
+                    } else if (mdnsFeatureFlags.mIsSocketClientNetworkGuessingEnabled) {
+                        interfaceIndex = key == null
+                                ? MdnsSocket.INTERFACE_INDEX_UNSPECIFIED
+                                : key.getInterfaceIndex();
+                    } else {
+                        // Note this is incorrect: getInterfaceIndex is the last interface that sent
+                        // a packet, not the one that received the packet.
+                        interfaceIndex = socket.getInterfaceIndex();
+                    }
                     processResponsePacket(
                             packet,
                             responseType,
-                            /* interfaceIndex= */ (socket == null || !propagateInterfaceIndex)
-                                    ? MdnsSocket.INTERFACE_INDEX_UNSPECIFIED
-                                    : socket.getInterfaceIndex(),
-                            /* network= */ socket.getNetwork());
+                            interfaceIndex,
+                            key == null ? null : key.getNetwork());
                 }
             } catch (IOException e) {
                 if (!shouldStopSocketLoop) {
diff --git a/service-t/src/com/android/server/connectivity/mdns/MulticastNetworkInterfaceProvider.java b/service-t/src/com/android/server/connectivity/mdns/MulticastNetworkInterfaceProvider.java
index da82e96541..f3f28e725b 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MulticastNetworkInterfaceProvider.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MulticastNetworkInterfaceProvider.java
@@ -21,12 +21,15 @@ import android.annotation.Nullable;
 import android.content.Context;
 import android.net.Network;
 
+import androidx.annotation.GuardedBy;
+
 import com.android.internal.annotations.VisibleForTesting;
 import com.android.net.module.util.SharedLog;
 
 import java.io.IOException;
 import java.net.Inet4Address;
 import java.net.Inet6Address;
+import java.net.InetAddress;
 import java.net.InterfaceAddress;
 import java.net.NetworkInterface;
 import java.net.SocketException;
@@ -44,10 +47,11 @@ public class MulticastNetworkInterfaceProvider {
     private final SharedLog sharedLog;
     private static final boolean PREFER_IPV6 = MdnsConfigs.preferIpv6();
 
+    @GuardedBy("this")
     private final List<NetworkInterfaceWrapper> multicastNetworkInterfaces = new ArrayList<>();
     // Only modifiable from tests.
     @VisibleForTesting
-    ConnectivityMonitor connectivityMonitor;
+    ConnectivityMonitorWithConnectivityManager connectivityMonitor;
     private volatile boolean connectivityChanged = true;
 
     @SuppressWarnings("nullness:methodref.receiver.bound")
@@ -91,6 +95,7 @@ public class MulticastNetworkInterfaceProvider {
         return new ArrayList<>(multicastNetworkInterfaces);
     }
 
+    @GuardedBy("this")
     private void updateMulticastNetworkInterfaces() {
         multicastNetworkInterfaces.clear();
         List<NetworkInterfaceWrapper> networkInterfaceWrappers = getNetworkInterfaces();
@@ -149,6 +154,15 @@ public class MulticastNetworkInterfaceProvider {
         return connectivityMonitor.getAvailableNetwork();
     }
 
+    /**
+     * @see ConnectivityMonitorWithConnectivityManager#guessNetworkOfRemoteHost(List, InetAddress)
+     */
+    @Nullable
+    public synchronized SocketKey guessNetworkOfRemoteHost(@NonNull InetAddress address) {
+        return connectivityMonitor.guessNetworkOfRemoteHost(
+                getMulticastNetworkInterfaces(), address);
+    }
+
     /*** Check whether given network interface can support mdns */
     private static boolean canScanOnInterface(@Nullable NetworkInterfaceWrapper networkInterface,
             @NonNull SharedLog sharedLog) {
diff --git a/service-t/src/com/android/server/connectivity/mdns/NetworkInterfaceWrapper.java b/service-t/src/com/android/server/connectivity/mdns/NetworkInterfaceWrapper.java
index 48c396e6af..105cc6b0a7 100644
--- a/service-t/src/com/android/server/connectivity/mdns/NetworkInterfaceWrapper.java
+++ b/service-t/src/com/android/server/connectivity/mdns/NetworkInterfaceWrapper.java
@@ -57,6 +57,12 @@ public class NetworkInterfaceWrapper {
         return networkInterface.getInterfaceAddresses();
     }
 
+    /** @see java.net.NetworkInterface#getName() */
+    public String getName() {
+        return networkInterface.getName();
+    }
+
+    /** @see java.net.NetworkInterface#getIndex() */
     public int getIndex() {
         return networkInterface.getIndex();
     }
diff --git a/tests/unit/java/com/android/server/connectivity/mdns/ConnectivityMonitorWithConnectivityManagerTests.java b/tests/unit/java/com/android/server/connectivity/mdns/ConnectivityMonitorWithConnectivityManagerTests.java
index bb59e0d4bf..997a111fd1 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/ConnectivityMonitorWithConnectivityManagerTests.java
+++ b/tests/unit/java/com/android/server/connectivity/mdns/ConnectivityMonitorWithConnectivityManagerTests.java
@@ -16,8 +16,12 @@
 
 package com.android.server.connectivity.mdns;
 
+import static android.net.InetAddresses.parseNumericAddress;
+import static android.net.RouteInfo.RTN_UNICAST;
+
 import static com.android.testutils.DevSdkIgnoreRuleKt.SC_V2;
 
+import static org.junit.Assert.assertEquals;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.Mockito.doReturn;
 import static org.mockito.Mockito.inOrder;
@@ -28,8 +32,11 @@ import static org.mockito.Mockito.verify;
 import android.content.Context;
 import android.net.ConnectivityManager;
 import android.net.ConnectivityManager.NetworkCallback;
+import android.net.IpPrefix;
+import android.net.LinkProperties;
 import android.net.Network;
 import android.net.NetworkRequest;
+import android.net.RouteInfo;
 
 import com.android.net.module.util.SharedLog;
 import com.android.testutils.DevSdkIgnoreRule;
@@ -43,6 +50,9 @@ import org.mockito.InOrder;
 import org.mockito.Mock;
 import org.mockito.MockitoAnnotations;
 
+import java.net.NetworkInterface;
+import java.util.List;
+
 /** Tests for {@link ConnectivityMonitor}. */
 @RunWith(DevSdkIgnoreRunner.class)
 @DevSdkIgnoreRule.IgnoreUpTo(SC_V2)
@@ -106,18 +116,11 @@ public class ConnectivityMonitorWithConnectivityManagerTests {
     @Test
     public void testIntentFired_shouldNotifyListener() {
         InOrder inOrder = inOrder(mockListener);
-        monitor.startWatchingConnectivityChanges();
-
-        final ArgumentCaptor<NetworkCallback> callbackCaptor =
-                ArgumentCaptor.forClass(NetworkCallback.class);
-        verify(mConnectivityManager, times(1)).registerNetworkCallback(
-                any(NetworkRequest.class), callbackCaptor.capture());
-
-        final NetworkCallback callback = callbackCaptor.getValue();
+        final NetworkCallback callback = setupCallback();
         final Network testNetwork = mock(Network.class);
 
         // Simulate network available.
-        callback.onAvailable(testNetwork);
+        callback.onLinkPropertiesChanged(testNetwork, new LinkProperties());
         inOrder.verify(mockListener).onConnectivityChanged();
 
         // Simulate network lost.
@@ -129,6 +132,76 @@ public class ConnectivityMonitorWithConnectivityManagerTests {
         inOrder.verify(mockListener).onConnectivityChanged();
     }
 
+    private NetworkCallback setupCallback() {
+        monitor.startWatchingConnectivityChanges();
+        final ArgumentCaptor<NetworkCallback> callbackCaptor =
+                ArgumentCaptor.forClass(NetworkCallback.class);
+        verify(mConnectivityManager, times(1)).registerNetworkCallback(
+                any(NetworkRequest.class), callbackCaptor.capture());
+
+        return callbackCaptor.getValue();
+    }
+
+    @Test
+    public void testGuessNetworkOfRemoteHost_ipv4Address() {
+        final NetworkCallback callback = setupCallback();
+
+        final Network testNetwork1 = mock(Network.class);
+        final Network testNetwork2 = mock(Network.class);
+        final int ifIndex1 = 1;
+        final NetworkInterfaceWrapper iface1 = getTestInterface("iface1", ifIndex1);
+        final NetworkInterfaceWrapper iface2 = getTestInterface("iface2", 2);
+
+        final LinkProperties lp1 = new LinkProperties();
+        lp1.setInterfaceName("iface1");
+        lp1.addRoute(new RouteInfo(
+                new IpPrefix("192.0.1.123/24"), null, lp1.getInterfaceName(), RTN_UNICAST));
+        final LinkProperties lp2 = new LinkProperties();
+        lp2.setInterfaceName("iface2");
+        lp2.addRoute(new RouteInfo(
+                new IpPrefix("192.0.2.123/24"), null, lp2.getInterfaceName(), RTN_UNICAST));
+
+        callback.onLinkPropertiesChanged(testNetwork1, lp1);
+        callback.onLinkPropertiesChanged(testNetwork2, lp2);
+
+        assertEquals(new SocketKey(testNetwork1, ifIndex1), monitor.guessNetworkOfRemoteHost(
+                List.of(iface1, iface2), parseNumericAddress("192.0.1.124")));
+    }
+
+    @Test
+    public void testGuessNetworkOfRemoteHost_linkLocalAddress() throws Exception {
+        final NetworkCallback callback = setupCallback();
+
+        final Network testNetwork1 = mock(Network.class);
+        final Network testNetwork2 = mock(Network.class);
+        final NetworkInterfaceWrapper loIface = new NetworkInterfaceWrapper(
+                NetworkInterface.getByName("lo"));
+        final NetworkInterfaceWrapper wrongIface = getTestInterface(
+                "wrongiface", loIface.getIndex() + 1);
+
+        final LinkProperties lp1 = new LinkProperties();
+        lp1.setInterfaceName("wrongiface");
+        lp1.addRoute(new RouteInfo(
+                new IpPrefix("fe80::123/64"), null, lp1.getInterfaceName(), RTN_UNICAST));
+        final LinkProperties lp2 = new LinkProperties();
+        // Use an interface that is known to exist so the link-local address scope can be parsed
+        lp2.setInterfaceName("lo");
+
+        callback.onLinkPropertiesChanged(testNetwork1, lp1);
+        callback.onLinkPropertiesChanged(testNetwork2, lp2);
+
+        assertEquals(new SocketKey(testNetwork2, loIface.getIndex()),
+                monitor.guessNetworkOfRemoteHost(List.of(wrongIface, loIface),
+                        parseNumericAddress("fe80::124%lo")));
+    }
+
+    private NetworkInterfaceWrapper getTestInterface(String name, int index) {
+        NetworkInterface iface = mock(NetworkInterface.class);
+        doReturn(name).when(iface).getName();
+        doReturn(index).when(iface).getIndex();
+        return new NetworkInterfaceWrapper(iface);
+    }
+
     private void verifyNetworkCallbackRegistered(int time) {
         verify(mConnectivityManager, times(time)).registerNetworkCallback(
                 any(NetworkRequest.class), any(NetworkCallback.class));
diff --git a/tests/unit/java/com/android/server/connectivity/mdns/MulticastNetworkInterfaceProviderTests.java b/tests/unit/java/com/android/server/connectivity/mdns/MulticastNetworkInterfaceProviderTests.java
index af233c9be9..d36ab6cb57 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/MulticastNetworkInterfaceProviderTests.java
+++ b/tests/unit/java/com/android/server/connectivity/mdns/MulticastNetworkInterfaceProviderTests.java
@@ -193,7 +193,8 @@ public class MulticastNetworkInterfaceProviderTests {
 
     @Test
     public void testStartWatchingConnectivityChanges() {
-        ConnectivityMonitor mockMonitor = mock(ConnectivityMonitor.class);
+        ConnectivityMonitorWithConnectivityManager mockMonitor =
+                mock(ConnectivityMonitorWithConnectivityManager.class);
         provider.connectivityMonitor = mockMonitor;
 
         InOrder inOrder = inOrder(mockMonitor);

From 9d5920edf9aa3c4ff4a6a1c6a87203bc4e664f6b Mon Sep 17 00:00:00 2001
From: Remi NGUYEN VAN <reminv@google.com>
Date: Wed, 2 Apr 2025 09:49:20 +0900
Subject: [PATCH 047/377] Clean up flags to not only flag APIs

Going forward flags will also be used instead of legacy flags for
flagging changes that do not involve new APIs. Clean up the build rules
to move them from FlaggedApi.bp to the main Android.bp (since there are
no branch differences anymore), and fix the comment.

Test: m
Flag: EXEMPT: refactor
Change-Id: I46ec52dfaf9dbef55364e2def30d97ab9bce55ed
---
 common/Android.bp    | 85 ++++++++++++++++++++++++++++++++++++--
 common/FlaggedApi.bp | 98 --------------------------------------------
 common/flags.aconfig |  5 ++-
 3 files changed, 84 insertions(+), 104 deletions(-)
 delete mode 100644 common/FlaggedApi.bp

diff --git a/common/Android.bp b/common/Android.bp
index 5fabf414e5..95d84cc879 100644
--- a/common/Android.bp
+++ b/common/Android.bp
@@ -20,11 +20,88 @@ package {
     default_applicable_licenses: ["Android-Apache-2.0"],
 }
 
-build = ["FlaggedApi.bp"]
+aconfig_declarations {
+    name: "com.android.net.flags-aconfig",
+    package: "com.android.net.flags",
+    exportable: true,
+    container: "com.android.tethering",
+    srcs: ["flags.aconfig"],
+    visibility: ["//packages/modules/Connectivity:__subpackages__"],
+}
 
-// This is a placeholder comment to avoid merge conflicts
-// as the above target may not exist
-// depending on the branch
+java_aconfig_library {
+    name: "com.android.net.flags-aconfig-java",
+    aconfig_declarations: "com.android.net.flags-aconfig",
+    defaults: ["framework-minus-apex-aconfig-java-defaults"],
+    min_sdk_version: "30",
+    apex_available: [
+        "com.android.tethering",
+    ],
+}
+
+java_aconfig_library {
+    name: "com.android.net.flags-aconfig-java-export",
+    aconfig_declarations: "com.android.net.flags-aconfig",
+    defaults: ["framework-minus-apex-aconfig-java-defaults"],
+    min_sdk_version: "30",
+    apex_available: [
+        "com.android.wifi",
+    ],
+    mode: "exported",
+}
+
+aconfig_declarations {
+    name: "com.android.net.thread.flags-aconfig",
+    package: "com.android.net.thread.flags",
+    container: "com.android.tethering",
+    srcs: ["thread_flags.aconfig"],
+    visibility: ["//packages/modules/Connectivity:__subpackages__"],
+}
+
+java_aconfig_library {
+    name: "com.android.net.thread.flags-aconfig-java",
+    aconfig_declarations: "com.android.net.thread.flags-aconfig",
+    defaults: ["framework-minus-apex-aconfig-java-defaults"],
+    min_sdk_version: "30",
+    apex_available: [
+        "com.android.tethering",
+    ],
+}
+
+aconfig_declarations {
+    name: "nearby_flags",
+    package: "com.android.nearby.flags",
+    container: "com.android.tethering",
+    srcs: ["nearby_flags.aconfig"],
+    visibility: ["//packages/modules/Connectivity:__subpackages__"],
+}
+
+java_aconfig_library {
+    name: "com.android.nearby.flags-aconfig-java",
+    aconfig_declarations: "nearby_flags",
+    defaults: ["framework-minus-apex-aconfig-java-defaults"],
+    min_sdk_version: "30",
+    apex_available: [
+        "com.android.tethering",
+    ],
+}
+
+aconfig_declarations {
+    name: "com.android.networksecurity.flags-aconfig",
+    package: "com.android.net.ct.flags",
+    container: "com.android.tethering",
+    srcs: ["networksecurity_flags.aconfig"],
+    visibility: ["//packages/modules/Connectivity:__subpackages__"],
+}
+
+java_aconfig_library {
+    name: "networksecurity_flags_java_lib",
+    aconfig_declarations: "com.android.networksecurity.flags-aconfig",
+    min_sdk_version: "30",
+    defaults: ["framework-minus-apex-aconfig-java-defaults"],
+    apex_available: ["com.android.tethering"],
+    visibility: ["//packages/modules/Connectivity:__subpackages__"],
+}
 
 // The library requires the final artifact to contain net-utils-device-common-struct-base.
 java_library {
diff --git a/common/FlaggedApi.bp b/common/FlaggedApi.bp
deleted file mode 100644
index f89ff9d22c..0000000000
--- a/common/FlaggedApi.bp
+++ /dev/null
@@ -1,98 +0,0 @@
-//
-// Copyright (C) 2024 The Android Open Source Project
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-
-aconfig_declarations {
-    name: "com.android.net.flags-aconfig",
-    package: "com.android.net.flags",
-    exportable: true,
-    container: "com.android.tethering",
-    srcs: ["flags.aconfig"],
-    visibility: ["//packages/modules/Connectivity:__subpackages__"],
-}
-
-java_aconfig_library {
-    name: "com.android.net.flags-aconfig-java",
-    aconfig_declarations: "com.android.net.flags-aconfig",
-    defaults: ["framework-minus-apex-aconfig-java-defaults"],
-    min_sdk_version: "30",
-    apex_available: [
-        "com.android.tethering",
-    ],
-}
-
-java_aconfig_library {
-    name: "com.android.net.flags-aconfig-java-export",
-    aconfig_declarations: "com.android.net.flags-aconfig",
-    defaults: ["framework-minus-apex-aconfig-java-defaults"],
-    min_sdk_version: "30",
-    apex_available: [
-        "com.android.wifi",
-    ],
-    mode: "exported",
-}
-
-aconfig_declarations {
-    name: "com.android.net.thread.flags-aconfig",
-    package: "com.android.net.thread.flags",
-    container: "com.android.tethering",
-    srcs: ["thread_flags.aconfig"],
-    visibility: ["//packages/modules/Connectivity:__subpackages__"],
-}
-
-java_aconfig_library {
-    name: "com.android.net.thread.flags-aconfig-java",
-    aconfig_declarations: "com.android.net.thread.flags-aconfig",
-    defaults: ["framework-minus-apex-aconfig-java-defaults"],
-    min_sdk_version: "30",
-    apex_available: [
-        "com.android.tethering",
-    ],
-}
-
-aconfig_declarations {
-    name: "nearby_flags",
-    package: "com.android.nearby.flags",
-    container: "com.android.tethering",
-    srcs: ["nearby_flags.aconfig"],
-    visibility: ["//packages/modules/Connectivity:__subpackages__"],
-}
-
-java_aconfig_library {
-    name: "com.android.nearby.flags-aconfig-java",
-    aconfig_declarations: "nearby_flags",
-    defaults: ["framework-minus-apex-aconfig-java-defaults"],
-    min_sdk_version: "30",
-    apex_available: [
-        "com.android.tethering",
-    ],
-}
-
-aconfig_declarations {
-    name: "com.android.networksecurity.flags-aconfig",
-    package: "com.android.net.ct.flags",
-    container: "com.android.tethering",
-    srcs: ["networksecurity_flags.aconfig"],
-    visibility: ["//packages/modules/Connectivity:__subpackages__"],
-}
-
-java_aconfig_library {
-    name: "networksecurity_flags_java_lib",
-    aconfig_declarations: "com.android.networksecurity.flags-aconfig",
-    min_sdk_version: "30",
-    defaults: ["framework-minus-apex-aconfig-java-defaults"],
-    apex_available: ["com.android.tethering"],
-    visibility: ["//packages/modules/Connectivity:__subpackages__"],
-}
diff --git a/common/flags.aconfig b/common/flags.aconfig
index 51b4fc009f..9589f216ad 100644
--- a/common/flags.aconfig
+++ b/common/flags.aconfig
@@ -1,8 +1,9 @@
 package: "com.android.net.flags"
 container: "com.android.tethering"
 
-# This file contains aconfig flags for FlaggedAPI annotations
-# Flags used from platform code must be in under frameworks
+# This file contains aconfig flags for toggling features entirely implemented within the tethering
+# module. Flags used from platform code must be in the android.net.platform.flags package in
+# frameworks/base.
 
 flag {
   name: "set_data_saver_via_cm"

From 35d2c6a7f37128b05bcc1ab1baa03ffd8db322fd Mon Sep 17 00:00:00 2001
From: Junyu Lai <junyulai@google.com>
Date: Tue, 1 Apr 2025 16:48:28 +0800
Subject: [PATCH 048/377] Add integration test for Wifi P2p Group Owner Network
 Agent

This exercise tests the flow from WifiP2pManager APIs to the
network callbacks fired by the ConnectivityService, on a
single device.

This change also makes utilities under
com.google.snippet.connectivity into a java library so they
can be reused by other modules.

Flag: TEST_ONLY
Test: m CtsTetheringTest && atest \
      CtsTetheringTest:android.tethering.cts.TetheringWifiP2pTest
Bug: 406172997
Change-Id: I32095316a5deadee7acba94c318fee666cd1303d
---
 tests/cts/multidevices/snippet/Android.bp     |  14 ++
 tests/cts/tethering/Android.bp                |   2 +
 tests/cts/tethering/AndroidManifest.xml       |   3 +
 .../tethering/cts/TetheringWifiP2pTest.kt     | 126 ++++++++++++++++++
 4 files changed, 145 insertions(+)
 create mode 100644 tests/cts/tethering/src/android/tethering/cts/TetheringWifiP2pTest.kt

diff --git a/tests/cts/multidevices/snippet/Android.bp b/tests/cts/multidevices/snippet/Android.bp
index c94087e2e6..9e1878331e 100644
--- a/tests/cts/multidevices/snippet/Android.bp
+++ b/tests/cts/multidevices/snippet/Android.bp
@@ -16,6 +16,20 @@ package {
     default_applicable_licenses: ["Android-Apache-2.0"],
 }
 
+java_library {
+    name: "ConnectivityWifiP2pMultiDevicesSnippetLib",
+    srcs: [
+        "Wifip2pMultiDevicesSnippet.kt",
+    ],
+    static_libs: [
+        "mobly-snippet-lib",
+        "cts-net-utils",
+    ],
+    visibility: [
+        "//packages/modules/Connectivity/tests/cts/tethering",
+    ],
+}
+
 android_test_helper_app {
     name: "connectivity_multi_devices_snippet",
     defaults: [
diff --git a/tests/cts/tethering/Android.bp b/tests/cts/tethering/Android.bp
index a1e0797490..38042851a3 100644
--- a/tests/cts/tethering/Android.bp
+++ b/tests/cts/tethering/Android.bp
@@ -30,9 +30,11 @@ java_defaults {
 
     srcs: [
         "src/**/*.java",
+        "src/**/*.kt",
     ],
 
     static_libs: [
+        "ConnectivityWifiP2pMultiDevicesSnippetLib",
         "TetheringCommonTests",
         "com.android.net.flags-aconfig-java",
         "compatibility-device-util-axt",
diff --git a/tests/cts/tethering/AndroidManifest.xml b/tests/cts/tethering/AndroidManifest.xml
index bad722bb0f..aede2d724e 100644
--- a/tests/cts/tethering/AndroidManifest.xml
+++ b/tests/cts/tethering/AndroidManifest.xml
@@ -20,6 +20,9 @@
 
     <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
     <uses-permission android:name="android.permission.ACCESS_WIFI_STATE" />
+    <uses-permission android:name="android.permission.CHANGE_WIFI_STATE" />
+    <uses-permission android:name="android.permission.NEARBY_WIFI_DEVICES"
+                     android:usesPermissionFlags="neverForLocation" />
 
     <application android:debuggable="true">
         <uses-library android:name="android.test.runner" />
diff --git a/tests/cts/tethering/src/android/tethering/cts/TetheringWifiP2pTest.kt b/tests/cts/tethering/src/android/tethering/cts/TetheringWifiP2pTest.kt
new file mode 100644
index 0000000000..e7e9fdd9f2
--- /dev/null
+++ b/tests/cts/tethering/src/android/tethering/cts/TetheringWifiP2pTest.kt
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.tethering.cts
+
+import android.Manifest.permission.LOG_COMPAT_CHANGE
+import android.Manifest.permission.READ_COMPAT_CHANGE_CONFIG
+import android.app.compat.CompatChanges
+import android.content.pm.PackageManager
+import android.net.NetworkCapabilities.NET_CAPABILITY_LOCAL_NETWORK
+import android.net.NetworkCapabilities.TRANSPORT_WIFI
+import android.net.NetworkRequest
+import android.net.connectivity.ConnectivityCompatChanges
+import android.os.Build
+import android.provider.DeviceConfig
+import android.text.TextUtils
+import androidx.test.platform.app.InstrumentationRegistry
+import com.android.testutils.AutoReleaseNetworkCallbackRule
+import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
+import com.android.testutils.DevSdkIgnoreRunner
+import com.android.testutils.DeviceConfigRule
+import com.android.testutils.RecorderCallback.CallbackEntry.Available
+import com.android.testutils.RecorderCallback.CallbackEntry.CapabilitiesChanged
+import com.android.testutils.RecorderCallback.CallbackEntry.LinkPropertiesChanged
+import com.android.testutils.TestableNetworkCallback
+import com.android.testutils.runAsShell
+import com.google.snippet.connectivity.Wifip2pMultiDevicesSnippet
+import java.util.Random
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Assume.assumeTrue
+import org.junit.Rule
+import org.junit.Test
+import org.junit.runner.RunWith
+
+@IgnoreUpTo(Build.VERSION_CODES.UPSIDE_DOWN_CAKE)
+@RunWith(DevSdkIgnoreRunner::class)
+class TetheringWifiP2pTest {
+    // For manipulating feature flag before and after testing.
+    @get:Rule
+    val deviceConfigRule = DeviceConfigRule()
+
+    @get:Rule
+    val networkCallbackRule = AutoReleaseNetworkCallbackRule()
+
+    companion object {
+        // Shamelessly copied from TetheringConfiguration.
+        private const val TETHERING_LOCAL_NETWORK_AGENT = "tethering_local_network_agent"
+        private const val WIFIP2PGO_LOCAL_NETWORK_AGENT = "wifip2pgo_local_network_agent"
+    }
+
+    private val context = InstrumentationRegistry.getInstrumentation().getTargetContext()
+    private val pm = context.packageManager!!
+
+    private fun assumeMatchNonThreadLocalNetworksEnabled() {
+        assumeTrue(runAsShell<Boolean>(READ_COMPAT_CHANGE_CONFIG, LOG_COMPAT_CHANGE) {
+            CompatChanges.isChangeEnabled(
+                    ConnectivityCompatChanges.ENABLE_MATCH_NON_THREAD_LOCAL_NETWORKS
+            )
+        })
+    }
+
+    private fun getRandomString(): String {
+        return "%09d".format(Random().nextInt(1_000_000_000))
+    }
+
+    @Test
+    fun testWifiP2pGoNetworkAgent_networkCallbacks() {
+        // Check preconditions.
+        assumeMatchNonThreadLocalNetworksEnabled()
+        assumeTrue(pm.hasSystemFeature(PackageManager.FEATURE_WIFI))
+        assumeTrue(pm.hasSystemFeature(PackageManager.FEATURE_WIFI_DIRECT))
+        deviceConfigRule.setConfig(
+            DeviceConfig.NAMESPACE_TETHERING,
+            TETHERING_LOCAL_NETWORK_AGENT,
+            "1"
+        )
+        deviceConfigRule.setConfig(
+            DeviceConfig.NAMESPACE_TETHERING,
+            WIFIP2PGO_LOCAL_NETWORK_AGENT,
+            "1"
+        )
+
+        val cb = TestableNetworkCallback()
+        val request = NetworkRequest.Builder().addCapability(NET_CAPABILITY_LOCAL_NETWORK)
+                .addTransportType(TRANSPORT_WIFI).build()
+        networkCallbackRule.registerNetworkCallback(request, cb)
+
+        val wifiP2pSnippet = Wifip2pMultiDevicesSnippet()
+        try {
+            wifiP2pSnippet.startWifiP2p()
+            wifiP2pSnippet.createGroup("DIRECT-" + getRandomString(), getRandomString())
+
+            val availableEvent = cb.expect<Available>()
+            // Verify Capabilities.
+            val capEvent = cb.eventuallyExpect<CapabilitiesChanged>()
+            assertEquals(availableEvent.network, capEvent.network)
+            assertTrue(capEvent.caps.hasCapability(NET_CAPABILITY_LOCAL_NETWORK))
+            assertTrue(capEvent.caps.hasTransport(TRANSPORT_WIFI))
+
+            // Verify LinkProperties.
+            val lpEvent = cb.eventuallyExpect<LinkPropertiesChanged>()
+            assertEquals(capEvent.network, lpEvent.network)
+            assertFalse(TextUtils.isEmpty(lpEvent.lp.interfaceName))
+            // At least 1 Ipv4 address and route.
+            assertTrue(lpEvent.lp.hasIPv4Address())
+            assertTrue(lpEvent.lp.routes.size >= 1)
+        } finally {
+            wifiP2pSnippet.stopWifiP2p()
+        }
+    }
+}

From 0394ebba3b9970f0c0b4624f14b0cdc695878064 Mon Sep 17 00:00:00 2001
From: Sandro Montanari <sandrom@google.com>
Date: Tue, 1 Apr 2025 15:23:04 +0000
Subject: [PATCH 049/377] Avoid storing download IDs in the ct.preferences file

We are trying to reduce the usage of the DataStore, as
it has caused the occasional headache in the past (see
for example ag/32804820).

This CL removes the storing download IDs on disk. Storing
the download IDs is unnecessary anyway, we schedule a new
download on a system_server or device reboot anyway.

Bug: 407940468
Test: atest NetworkSecurityUnitTests
Flag: com.android.net.ct.flags.certificate_transparency_service
Change-Id: I18bc752aa26978f877f669d343d5432f83a36ae4
---
 .../ct/CertificateTransparencyDownloader.java | 24 ++++++++-----------
 .../ct/CertificateTransparencyService.java    |  1 -
 ...CertificateTransparencyDownloaderTest.java |  5 ----
 3 files changed, 10 insertions(+), 20 deletions(-)

diff --git a/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyDownloader.java b/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyDownloader.java
index e608417fcc..e8e2a98937 100644
--- a/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyDownloader.java
+++ b/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyDownloader.java
@@ -33,6 +33,8 @@ import com.android.server.net.ct.DownloadHelper.DownloadStatus;
 import java.io.IOException;
 import java.io.InputStream;
 import java.util.Collection;
+import java.util.HashMap;
+import java.util.Map;
 import java.util.Optional;
 
 /** Helper class to download certificate transparency log files. */
@@ -42,22 +44,21 @@ class CertificateTransparencyDownloader extends BroadcastReceiver {
     private static final String TAG = "CertificateTransparencyDownloader";
 
     private final Context mContext;
-    private final DataStore mDataStore;
     private final DownloadHelper mDownloadHelper;
     private final SignatureVerifier mSignatureVerifier;
     private final CertificateTransparencyLogger mLogger;
     private final Collection<CompatibilityVersion> mCompatVersions;
 
+    private final Map<String, Long> mDownloadIds = new HashMap<>();
+
     CertificateTransparencyDownloader(
             Context context,
-            DataStore dataStore,
             DownloadHelper downloadHelper,
             SignatureVerifier signatureVerifier,
             CertificateTransparencyLogger logger,
             Collection<CompatibilityVersion> compatVersions) {
         mContext = context;
         mSignatureVerifier = signatureVerifier;
-        mDataStore = dataStore;
         mDownloadHelper = downloadHelper;
         mLogger = logger;
         mCompatVersions = compatVersions;
@@ -66,8 +67,7 @@ class CertificateTransparencyDownloader extends BroadcastReceiver {
     long startPublicKeyDownload() {
         long downloadId = download(Config.URL_PUBLIC_KEY);
         if (downloadId != -1) {
-            mDataStore.setPropertyLong(Config.PUBLIC_KEY_DOWNLOAD_ID, downloadId);
-            mDataStore.store();
+            mDownloadIds.put(Config.PUBLIC_KEY_DOWNLOAD_ID, downloadId);
         }
         return downloadId;
     }
@@ -75,8 +75,7 @@ class CertificateTransparencyDownloader extends BroadcastReceiver {
     private long startMetadataDownload(CompatibilityVersion compatVersion) {
         long downloadId = download(compatVersion.getMetadataUrl());
         if (downloadId != -1) {
-            mDataStore.setPropertyLong(compatVersion.getMetadataPropertyName(), downloadId);
-            mDataStore.store();
+            mDownloadIds.put(compatVersion.getMetadataPropertyName(), downloadId);
         }
         return downloadId;
     }
@@ -96,8 +95,7 @@ class CertificateTransparencyDownloader extends BroadcastReceiver {
     long startContentDownload(CompatibilityVersion compatVersion) {
         long downloadId = download(compatVersion.getContentUrl());
         if (downloadId != -1) {
-            mDataStore.setPropertyLong(compatVersion.getContentPropertyName(), downloadId);
-            mDataStore.store();
+            mDownloadIds.put(compatVersion.getContentPropertyName(), downloadId);
         }
         return downloadId;
     }
@@ -235,19 +233,17 @@ class CertificateTransparencyDownloader extends BroadcastReceiver {
 
     @VisibleForTesting
     long getPublicKeyDownloadId() {
-        return mDataStore.getPropertyLong(Config.PUBLIC_KEY_DOWNLOAD_ID, /* defaultValue= */ -1);
+        return mDownloadIds.getOrDefault(Config.PUBLIC_KEY_DOWNLOAD_ID, -1L);
     }
 
     @VisibleForTesting
     long getMetadataDownloadId(CompatibilityVersion compatVersion) {
-        return mDataStore.getPropertyLong(
-                compatVersion.getMetadataPropertyName(), /* defaultValue */ -1);
+        return mDownloadIds.getOrDefault(compatVersion.getMetadataPropertyName(), -1L);
     }
 
     @VisibleForTesting
     long getContentDownloadId(CompatibilityVersion compatVersion) {
-        return mDataStore.getPropertyLong(
-                compatVersion.getContentPropertyName(), /* defaultValue= */ -1);
+        return mDownloadIds.getOrDefault(compatVersion.getContentPropertyName(), -1L);
     }
 
     @VisibleForTesting
diff --git a/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyService.java b/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyService.java
index 5e530c74a6..e77996387d 100644
--- a/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyService.java
+++ b/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyService.java
@@ -71,7 +71,6 @@ public class CertificateTransparencyService extends ICertificateTransparencyMana
                         dataStore,
                         new CertificateTransparencyDownloader(
                                 context,
-                                dataStore,
                                 new DownloadHelper(context),
                                 signatureVerifier,
                                 new CertificateTransparencyLoggerImpl(dataStore),
diff --git a/networksecurity/tests/unit/src/com/android/server/net/ct/CertificateTransparencyDownloaderTest.java b/networksecurity/tests/unit/src/com/android/server/net/ct/CertificateTransparencyDownloaderTest.java
index 0983f8b801..17ea85adf3 100644
--- a/networksecurity/tests/unit/src/com/android/server/net/ct/CertificateTransparencyDownloaderTest.java
+++ b/networksecurity/tests/unit/src/com/android/server/net/ct/CertificateTransparencyDownloaderTest.java
@@ -76,7 +76,6 @@ public class CertificateTransparencyDownloaderTest {
     private PrivateKey mPrivateKey;
     private PublicKey mPublicKey;
     private Context mContext;
-    private DataStore mDataStore;
     private SignatureVerifier mSignatureVerifier;
     private CompatibilityVersion mCompatVersion;
     private CertificateTransparencyDownloader mCertificateTransparencyDownloader;
@@ -93,7 +92,6 @@ public class CertificateTransparencyDownloaderTest {
         mPublicKey = keyPair.getPublic();
 
         mContext = InstrumentationRegistry.getInstrumentation().getContext();
-        mDataStore = new DataStore(File.createTempFile("datastore-test", ".properties"));
         mSignatureVerifier = new SignatureVerifier(mContext);
 
         CompatibilityVersion.setRootDirectoryForTesting(mContext.getFilesDir());
@@ -105,7 +103,6 @@ public class CertificateTransparencyDownloaderTest {
         mCertificateTransparencyDownloader =
                 new CertificateTransparencyDownloader(
                         mContext,
-                        mDataStore,
                         new DownloadHelper(mDownloadManager),
                         mSignatureVerifier,
                         mLogger,
@@ -113,14 +110,12 @@ public class CertificateTransparencyDownloaderTest {
 
         prepareDownloadManager();
         mSignatureVerifier.addAllowedKey(mPublicKey);
-        mDataStore.load();
     }
 
     @After
     public void tearDown() {
         mSignatureVerifier.resetPublicKey();
         mCompatVersion.delete();
-        mDataStore.delete();
     }
 
     @Test

From 744a17443a425e3320219ff02f9dbfa78216464e Mon Sep 17 00:00:00 2001
From: Jimi Chen <jimictw@google.com>
Date: Wed, 2 Apr 2025 03:07:56 +0000
Subject: [PATCH 050/377] Improve stability of APFv{4,6} multi-device tests

This commit enhances the stability of the APFv{4,6} multi-device tests by addressing several sources of flakiness and improving the test setup and validation.

Specifically, this commit:

* Increased sleep time in the test setup. This ensures APF is activated before each test, preventing unexpected behavior.
* Added sleep time in `ApfV4Test` to ensure APF remains enabled and is not disabled due to high throughput scenarios.
* Changed the validation order to first check received packets and then APF counters. This helps to more easily identify the root cause of test failures.
* Changed the Ethernet destination address from multicast to unicast in `ApfV6Test` to prevent packets from being filtered due to DTIM skip.
* Removed the `test_broadcast_arp_request_offload()` test, which was flaky due to DTIM skip and is adequately covered by the `test_unicast_arp_request_offload()` test.

Bug: 406570694
Flag: TEST_ONLY
Test: atest CtsConnectivityMultiDevicesTestCases:ApfV4Test
Test: atest CtsConnectivityMultiDevicesTestCases:ApfV6Test
Test: run cts -m CtsConnectivityMultiDevicesTestCases --skip-preconditions -t ApfV4Test --shard-count 2
Test: run cts -m CtsConnectivityMultiDevicesTestCases --skip-preconditions -t ApfV6Test --shard-count 2
Change-Id: I053509459078d0bd94e16a6bf7349b948f930e6c
---
 .../testutils/host/python/apf_test_base.py    | 24 ++++++++++++--
 tests/cts/multidevices/apfv4_test.py          |  4 +++
 tests/cts/multidevices/apfv6_test.py          | 33 +++----------------
 3 files changed, 29 insertions(+), 32 deletions(-)

diff --git a/staticlibs/testutils/host/python/apf_test_base.py b/staticlibs/testutils/host/python/apf_test_base.py
index 6a62e21019..9d1ea02bbe 100644
--- a/staticlibs/testutils/host/python/apf_test_base.py
+++ b/staticlibs/testutils/host/python/apf_test_base.py
@@ -70,8 +70,8 @@ class ApfTestBase(multi_devices_test_base.MultiDevicesTestBase):
     # Enable doze mode to activate APF.
     adb_utils.set_doze_mode(self.clientDevice, True)
 
-    # wait for APF to become active.
-    time.sleep(3)
+    # Longer wait time is required for APF to become active in CTS test suite.
+    time.sleep(5)
 
   def teardown_class(self):
     adb_utils.set_doze_mode(self.clientDevice, False)
@@ -106,7 +106,15 @@ class ApfTestBase(multi_devices_test_base.MultiDevicesTestBase):
     try:
         apf_utils.start_capture_packets(self.serverDevice, self.server_iface_name)
 
-        self.send_packet_and_expect_counter_increased(send_packet, counter_name)
+        count_before_test = apf_utils.get_apf_counter(
+            self.clientDevice,
+            self.client_iface_name,
+            counter_name,
+        )
+
+        apf_utils.send_raw_packet_downstream(
+            self.serverDevice, self.server_iface_name, send_packet
+        )
 
         assert_utils.expect_with_retry(
             lambda: apf_utils.get_matched_packet_counts(
@@ -114,5 +122,15 @@ class ApfTestBase(multi_devices_test_base.MultiDevicesTestBase):
             )
             == 1
         )
+
+        assert_utils.expect_with_retry(
+            lambda: apf_utils.get_apf_counter(
+                self.clientDevice,
+                self.client_iface_name,
+                counter_name,
+            )
+            > count_before_test
+        )
+
     finally:
         apf_utils.stop_capture_packets(self.serverDevice, self.server_iface_name)
diff --git a/tests/cts/multidevices/apfv4_test.py b/tests/cts/multidevices/apfv4_test.py
index 0fc1093f5b..2f212fcdc9 100644
--- a/tests/cts/multidevices/apfv4_test.py
+++ b/tests/cts/multidevices/apfv4_test.py
@@ -16,6 +16,7 @@ from absl.testing import parameterized
 from mobly import asserts
 from net_tests_utils.host.python import apf_test_base, apf_utils
 from scapy.layers.l2 import Ether
+import time
 
 # Constants.
 COUNTER_DROPPED_ETHERTYPE_NOT_ALLOWED = "DROPPED_ETHERTYPE_NOT_ALLOWED"
@@ -59,6 +60,9 @@ class ApfV4Test(apf_test_base.ApfTestBase, parameterized.TestCase):
 
     # Add zero padding up to minimum ethernet frame length
     packet = packet.ljust(MIN_PACKET_SIZE * 2, "0")
+
+    # Pause packet sending between tests to avoid APF disablement due to high throughput.
+    time.sleep(3)
     self.send_packet_and_expect_counter_increased(
         packet, COUNTER_DROPPED_ETHERTYPE_NOT_ALLOWED
     )
diff --git a/tests/cts/multidevices/apfv6_test.py b/tests/cts/multidevices/apfv6_test.py
index 9b2e309d1e..c6e5f8de10 100644
--- a/tests/cts/multidevices/apfv6_test.py
+++ b/tests/cts/multidevices/apfv6_test.py
@@ -79,33 +79,6 @@ class ApfV6Test(apf_test_base.ApfTestBase):
             arp_request, "DROPPED_ARP_REQUEST_REPLIED", expected_arp_reply
         )
 
-    def test_broadcast_arp_request_offload(self):
-        eth = Ether(src=self.server_mac_address, dst='ff:ff:ff:ff:ff:ff')
-        arp = ARP(
-            op=1,
-            psrc=self.server_ipv4_addresses[0],
-            pdst=self.client_ipv4_addresses[0],
-            hwsrc=self.server_mac_address
-        )
-        arp_request = bytes(eth/arp).hex()
-
-        eth = Ether(src=self.client_mac_address, dst=self.server_mac_address)
-        arp = ARP(
-            op=2,
-            psrc=self.client_ipv4_addresses[0],
-            pdst=self.server_ipv4_addresses[0],
-            hwsrc=self.client_mac_address,
-            hwdst=self.server_mac_address
-        )
-        expected_arp_reply = bytes(eth/arp).hex()
-
-        # Add zero padding up to 60 bytes, since APFv6 ARP offload always sent out 60 bytes reply
-        expected_arp_reply = expected_arp_reply.ljust(ARP_OFFLOAD_REPLY_LEN * 2, "0")
-
-        self.send_packet_and_expect_reply_received(
-            arp_request, "DROPPED_ARP_REQUEST_REPLIED", expected_arp_reply
-        )
-
     def test_non_dad_ipv6_neighbor_solicitation_offload(self):
         eth = Ether(src=self.server_mac_address, dst=self.client_mac_address)
         ip = IPv6(src=self.server_ipv6_addresses[0], dst=self.client_ipv6_addresses[0])
@@ -158,7 +131,8 @@ class ApfV6Test(apf_test_base.ApfTestBase):
 
     @apf_utils.at_least_B()
     def test_igmpv3_general_query_offload(self):
-        ether = Ether(src=self.server_mac_address, dst='01:00:5e:00:00:01')
+        # use unicast to replace multicast ether dst to prevent flaky due to DTIM skip
+        ether = Ether(src=self.server_mac_address, dst=self.client_mac_address)
         ip = IP(
             src=self.server_ipv4_addresses[0],
             dst='224.0.0.1',
@@ -206,7 +180,8 @@ class ApfV6Test(apf_test_base.ApfTestBase):
     @apf_utils.at_least_B()
     @apf_utils.apf_ram_at_least(3000)
     def test_mldv2_general_query_offload(self):
-        ether = Ether(src=self.server_mac_address, dst='33:33:00:00:00:01')
+        # use unicast to replace multicast ether dst to prevent flaky due to DTIM skip
+        ether = Ether(src=self.server_mac_address, dst=self.client_mac_address)
         ip = IPv6(src=self.server_ipv6_addresses[0], dst='ff02::1', hlim=1)
         hopOpts = IPv6ExtHdrHopByHop(options=[RouterAlert(otype=5)])
         mld = ICMPv6MLQuery2()

From 2e95c356d7ba97fffbe5ebdca82201ca474cd6f9 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Wed, 2 Apr 2025 09:39:45 -0700
Subject: [PATCH 051/377] s/payload/data/ for brevity

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I03cdb93f616510c3648d91f993577cb4d846a5bd
---
 .../android/testutils/PacketBuilderUtils.kt   | 26 +++++++++----------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
index 7a952f4df8..dba94d3638 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
@@ -271,12 +271,12 @@ class RaPkt(
 class Ip6Pkt(
         private val src: Inet6Address,
         private val dst: Inet6Address,
-        private val payload: L4Packet,
+        private val data: L4Packet,
 ) : L3Packet {
-    constructor(src: String, dst: String, payload: L4Packet) : this(
+    constructor(src: String, dst: String, data: L4Packet) : this(
             InetAddress.getByName(src) as Inet6Address,
             InetAddress.getByName(dst) as Inet6Address,
-            payload,
+            data,
     )
 
     override val etherType = 0x86dd.toShort()
@@ -290,8 +290,8 @@ class Ip6Pkt(
     init {
         val ipv6Header = ByteBuffer.allocate(40)
         ipv6Header.putInt((6 shl 28) or (tc shl 20) or flowlabel)
-        ipv6Header.putShort(payload.size)
-        ipv6Header.put(payload.proto)
+        ipv6Header.putShort(data.size)
+        ipv6Header.put(data.proto)
         ipv6Header.put(hlim)
         ipv6Header.put(src.getAddress())
         ipv6Header.put(dst.getAddress())
@@ -299,7 +299,7 @@ class Ip6Pkt(
 
         val outputStream = ByteArrayOutputStream()
         outputStream.write(ipv6Header.array())
-        outputStream.write(payload.toByteArray())
+        outputStream.write(data.toByteArray())
         bytes = outputStream.toByteArray()
     }
 
@@ -315,18 +315,18 @@ class Ip6Pkt(
  * {@code
  * val ra = RaPkt(routerLft = 50, reachableTime = 100, flags = "O")
  * ra.addPioOption(prefix = "2001:db8::1/64", flags = "LA")
- * val ipv6 = Ip6Pkt(src = "fe80::1", dst = "fe80::2", payload = ra)
- * val ether = EtherPkt(src = "1:2:3:4:5:6", dst = "1:1:1:1:1:1", payload = ipv6)
+ * val ipv6 = Ip6Pkt(src = "fe80::1", dst = "fe80::2", data = ra)
+ * val ether = EtherPkt(src = "1:2:3:4:5:6", dst = "1:1:1:1:1:1", data = ipv6)
  * }
  * </pre>
  **/
 class EtherPkt(
         dst: MacAddress,
         src: MacAddress,
-        payload: L3Packet,
+        data: L3Packet,
     ) : Packet {
-    constructor(dst: String, src: String, payload: L3Packet) :
-        this(MacAddress.fromString(dst), MacAddress.fromString(src), payload)
+    constructor(dst: String, src: String, data: L3Packet) :
+        this(MacAddress.fromString(dst), MacAddress.fromString(src), data)
 
     val bytes: ByteArray
 
@@ -334,12 +334,12 @@ class EtherPkt(
         val ethernetHeader = ByteBuffer.allocate(14)
         ethernetHeader.put(dst.toByteArray())
         ethernetHeader.put(src.toByteArray())
-        ethernetHeader.putShort(payload.etherType)
+        ethernetHeader.putShort(data.etherType)
         ethernetHeader.flip()
 
         val outputStream = ByteArrayOutputStream()
         outputStream.write(ethernetHeader.array())
-        outputStream.write(payload.toByteArray())
+        outputStream.write(data.toByteArray())
         bytes = outputStream.toByteArray()
     }
 

From 22727f7bef2c2ae9e735fc226bce68aac1f69af7 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Wed, 2 Apr 2025 10:20:23 -0700
Subject: [PATCH 052/377] Add some documentation to RaPkt

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I429b316a2660789316f46fae63c621d81dfe67af
---
 .../android/testutils/PacketBuilderUtils.kt   | 65 +++++++++++++++++++
 1 file changed, 65 insertions(+)

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
index dba94d3638..13a6cb6bd1 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
@@ -130,6 +130,11 @@ class NaPkt(
  * Class that facilitates the creation of RA packets.
  *
  * Default argument values reflect the rfc4861 defaults where applicable.
+ *
+ * @param routerLft lifetime of the default router in seconds.
+ * @param reachableTime The time, in milliseconds, that a node assumes a neighbor is reachable.
+ * @param retransTimer The time, in milliseconds, between retransmitted NS messages.
+ * @param flags The Router Advertisement flags.
  */
 class RaPkt(
     private val routerLft: Short,
@@ -137,6 +142,14 @@ class RaPkt(
     private val retransTimer: Int,
     private val flags: EnumSet<RaFlags>,
 ) : L4Packet {
+    /**
+     * Convenience constructor accepting flags parameter as String
+     *
+     * @param routerLft lifetime of the default router in seconds.
+     * @param reachableTime The time, in milliseconds, that a node assumes a neighbor is reachable.
+     * @param retransTimer The time, in milliseconds, between retransmitted NS messages.
+     * @param flags The Router Advertisement flags as a String; e.g. {@code "MO"}. Defaults to "".
+     */
     constructor(
         routerLft: Short = 1800,
         reachableTime: Int = 0,
@@ -145,7 +158,9 @@ class RaPkt(
     ) : this(routerLft, reachableTime, retransTimer, enumSetOfFlags<RaFlags>(flags))
 
     enum class RaFlags(override val value: Int) : Flags {
+        /** Managed address configuration: indicates addresses are available via DHCPv6. */
         M(0x80),
+        /** Other configuration: indicates other configuration info is available via DHCPv6. */
         O(0x40),
     }
 
@@ -169,12 +184,24 @@ class RaPkt(
     }
 
     enum class PioFlags(override val value: Int) : Flags {
+        /** On-Link: indicates that this prefix can be used for on-link determination. */
         L(0x80),
+        /** Autonomous address-configuration: indicates that this prefix can be used for SLAAC. */
         A(0x40),
+        /** Router Address: obsolete. */
         R(0x20),
+        /** PD Preferred: indicates that the network prefers the use of DHCPv6-PD over SLAAC. */
         P(0x10),
     }
 
+    /**
+     * Add a Prefix Information Option
+     *
+     * @param prefix The prefix of an IPv6 address.
+     * @param validLft The time, in seconds, that the prefix is valid for on-link determination.
+     * @param preferredLft The time, in seconds, that SLAAC-generated addresses remain preferred.
+     * @param flags The Prefix Information Option flags.
+     */
     fun addPioOption(
             prefix: IpPrefix,
             validLft: Int,
@@ -195,6 +222,14 @@ class RaPkt(
         outputStream.write(pio.array())
     }
 
+    /**
+     * Add a Prefix Information Option
+     *
+     * @param prefix The IPv6 prefix as a String; e.g. {@code "2001:db8::/64"}
+     * @param validLft The time, in seconds, that the prefix is valid for on-link determination.
+     * @param preferredLft The time, in seconds, that SLAAC-generated addresses remain preferred.
+     * @param flags The PIO flags as a String; e.g. {@code "LA"}
+     */
     fun addPioOption(
             prefix: String,
             validLft: Int = 2592000,
@@ -204,6 +239,11 @@ class RaPkt(
         addPioOption(IpPrefix(prefix), validLft, preferredLft, enumSetOfFlags<PioFlags>(flags))
     }
 
+    /** Add a Recursive DNS Server Option
+     *
+     * @param dns The list of DNS servers.
+     * @param lft The time, in seconds, over which the DNS servers may be used for resolution.
+     */
     fun addRdnssOption(dns: List<Inet6Address>, lft: Int) {
         val length = 1 + (dns.size * 2)
         val rdnss = ByteBuffer.allocate(length * 8) // length is in units of 8 octets.
@@ -218,11 +258,21 @@ class RaPkt(
         outputStream.write(rdnss.array())
     }
 
+    /** Add a Recursive DNS Server Option
+     *
+     * @param dns The list of DNS servers as a String; e.g. {@code "2001:db8:1,2001:db8:2"}
+     * @param lft The time, in seconds, over which the DNS servers may be used for resolution.
+     */
     fun addRdnssOption(dns: String, lft: Int = 1800) {
         val dnsServers = dns.split(",").map { InetAddress.getByName(it) as Inet6Address }
         addRdnssOption(dnsServers, lft)
     }
 
+    /** Add a Route Information Option
+     *
+     * @param prefix The IPv6 prefix of the route.
+     * @param lft The lifetime of the route in seconds.
+     */
     fun addRioOption(prefix: IpPrefix, lft: Int) {
         val rio = ByteBuffer.allocate(24)
         rio.put(24) // Type = 24
@@ -236,10 +286,20 @@ class RaPkt(
         outputStream.write(rio.array())
     }
 
+    /** Add a Route Information Option
+     *
+     * @param prefix The IPv6 prefix of the route as a String; e.g. {@code "2001:db8::/48"}
+     * @param lft The lifetime of the route in seconds.
+     */
     fun addRioOption(prefix: String, lft: Int = 1800) {
         addRioOption(IpPrefix(prefix), lft)
     }
 
+    /** Add a PREF64 Option
+     *
+     * @param prefix The PREF64 prefix.
+     * @param lft The lifetime of the PREF64 prefix in seconds.
+     */
     fun addPref64Option(prefix: IpPrefix, lft: Int) {
         val pref64 = ByteBuffer.allocate(16)
         pref64.put(38) // Type = 38
@@ -260,6 +320,11 @@ class RaPkt(
         outputStream.write(pref64.array())
     }
 
+    /** Add a PREF64 Option
+     *
+     * @param prefix The PREF64 prefix as a String; e.g. {@code "2001:db8::/64"}
+     * @param lft The lifetime of the PREF64 prefix in seconds.
+     */
     fun addPref64Option(prefix: String, lft: Int = 1800) {
         addPref64Option(IpPrefix(prefix), lft)
     }

From 49eede426b61f36eac26deb4c4ea7564bc25a2b9 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Wed, 2 Apr 2025 09:08:51 -0700
Subject: [PATCH 053/377] Add packet builder support for neighbor advertisement

In the future, we could consider adding an ICMPv6 base class that
implements common functionality between NaPkt and RaPkt. However, given
that checksumming is not currently supported, the common functionality
is limited to only a couple of lines.

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: Id45f2ed43f45778e80b303bd356babcc93de1c3f
---
 .../android/testutils/PacketBuilderUtils.kt   | 71 +++++++++++++++++++
 1 file changed, 71 insertions(+)

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
index b6ef68bb0d..7a952f4df8 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
@@ -13,6 +13,9 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+// Ktlint forces a blank line between declarations with comments which wastes space in enum
+// declarations.
+@file:Suppress("ktlint:standard:spacing-between-declarations-with-comments")
 
 package com.android.testutils
 
@@ -55,6 +58,74 @@ private inline fun <reified E> enumSetOfFlags(str: String): EnumSet<E>
     return result
 }
 
+/**
+ * Class that facilitates the creation of NA packets.
+ *
+ * @param target The IPv6 address of the target.
+ * @param flags The Neighbor Advertisement flags.
+ */
+class NaPkt(
+    target: Inet6Address,
+    flags: EnumSet<NaFlags>,
+) : L4Packet {
+    /**
+     * Convenience constructor accepting parameters as Strings.
+     *
+     * @param target Target IPv6 address as a String; e.g. {@code "2001:db8::1"}.
+     * @param flags Neighbor Advertisement flags as a String; e.g. {@code "RS"}
+     */
+    constructor(target: String, flags: String = "RO") :
+        this(Inet6Address.getByName(target) as Inet6Address, enumSetOfFlags<NaFlags>(flags))
+
+    enum class NaFlags(override val value: Int) : Flags {
+        /** Router flag: indicates that the sender is a router. */
+        R(0x80),
+        /** Solicited flag: indicates the advertisement was sent in response to a solicitation. */
+        S(0x40),
+        /** Override flag: indicates the advertisement should override an existing cache entry. */
+        O(0x20),
+    }
+
+    override val proto: Byte = 58
+    override val size: Short
+      get() = outputStream.size().toShort()
+    private val outputStream = ByteArrayOutputStream()
+
+    init {
+        val naHeader = ByteBuffer.allocate(24)
+        naHeader.put(136.toByte()) // Type = 136 (Neighbor Advertisement)
+        naHeader.put(0) // Code = 0
+        naHeader.putShort(0) // Checksum = 0 (ignored)
+        naHeader.put(flags.toByte())
+        naHeader.put(0) // reserved
+        naHeader.putShort(0) // reserved
+        naHeader.put(target.address) // Target address
+        naHeader.flip()
+        outputStream.write(naHeader.array())
+    }
+
+    /** Add Target Link-Layer Address Option */
+    fun addTllaOption(lla: MacAddress) {
+        val llao = ByteBuffer.allocate(8)
+        llao.put(2) // Type = 2 (Target Link-layer Address)
+        llao.put(1) // Length in units of 8 octets
+        llao.put(lla.toByteArray())
+        llao.flip()
+        outputStream.write(llao.array())
+    }
+
+    /**
+     * Add Target Link-Layer Address Option
+     *
+     * @param lla Link-Layer Address as a String; e.g. {@code "0:0:5e:0:53:0"}
+     */
+    fun addTllaOption(lla: String) {
+        addTllaOption(MacAddress.fromString(lla))
+    }
+
+    override fun toByteArray() = outputStream.toByteArray()
+}
+
 /**
  * Class that facilitates the creation of RA packets.
  *

From 91ef24c6f6c5535bbf18094ad8d728244fbe167f Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Wed, 2 Apr 2025 11:37:24 -0700
Subject: [PATCH 054/377] Return this from add*Option methods

To support friendlier builder syntax.

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: Iaf4250da61e2c0b5311682b2c462eb07467428f7
---
 .../android/testutils/PacketBuilderUtils.kt   | 40 ++++++++++++-------
 1 file changed, 25 insertions(+), 15 deletions(-)

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
index 13a6cb6bd1..4d5544a14c 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
@@ -105,13 +105,14 @@ class NaPkt(
     }
 
     /** Add Target Link-Layer Address Option */
-    fun addTllaOption(lla: MacAddress) {
+    fun addTllaOption(lla: MacAddress): NaPkt {
         val llao = ByteBuffer.allocate(8)
         llao.put(2) // Type = 2 (Target Link-layer Address)
         llao.put(1) // Length in units of 8 octets
         llao.put(lla.toByteArray())
         llao.flip()
         outputStream.write(llao.array())
+        return this
     }
 
     /**
@@ -119,8 +120,8 @@ class NaPkt(
      *
      * @param lla Link-Layer Address as a String; e.g. {@code "0:0:5e:0:53:0"}
      */
-    fun addTllaOption(lla: String) {
-        addTllaOption(MacAddress.fromString(lla))
+    fun addTllaOption(lla: String): NaPkt {
+        return addTllaOption(MacAddress.fromString(lla))
     }
 
     override fun toByteArray() = outputStream.toByteArray()
@@ -207,7 +208,7 @@ class RaPkt(
             validLft: Int,
             preferredLft: Int,
             flags: EnumSet<PioFlags>,
-    ) {
+    ): RaPkt {
         if (!prefix.isIPv6()) throw IllegalArgumentException("Invalid prefix")
         val pio = ByteBuffer.allocate(32)
         pio.put(3) // Type = 3
@@ -220,6 +221,7 @@ class RaPkt(
         pio.put(prefix.getRawAddress())
         pio.flip()
         outputStream.write(pio.array())
+        return this
     }
 
     /**
@@ -235,8 +237,13 @@ class RaPkt(
             validLft: Int = 2592000,
             preferredLft: Int = 604800,
             flags: String = "L",
-    ) {
-        addPioOption(IpPrefix(prefix), validLft, preferredLft, enumSetOfFlags<PioFlags>(flags))
+    ): RaPkt {
+        return addPioOption(
+                IpPrefix(prefix),
+                validLft,
+                preferredLft,
+                enumSetOfFlags<PioFlags>(flags)
+        )
     }
 
     /** Add a Recursive DNS Server Option
@@ -244,7 +251,7 @@ class RaPkt(
      * @param dns The list of DNS servers.
      * @param lft The time, in seconds, over which the DNS servers may be used for resolution.
      */
-    fun addRdnssOption(dns: List<Inet6Address>, lft: Int) {
+    fun addRdnssOption(dns: List<Inet6Address>, lft: Int): RaPkt {
         val length = 1 + (dns.size * 2)
         val rdnss = ByteBuffer.allocate(length * 8) // length is in units of 8 octets.
         rdnss.put(25) // Type = 25
@@ -256,6 +263,7 @@ class RaPkt(
         }
         rdnss.flip()
         outputStream.write(rdnss.array())
+        return this
     }
 
     /** Add a Recursive DNS Server Option
@@ -263,9 +271,9 @@ class RaPkt(
      * @param dns The list of DNS servers as a String; e.g. {@code "2001:db8:1,2001:db8:2"}
      * @param lft The time, in seconds, over which the DNS servers may be used for resolution.
      */
-    fun addRdnssOption(dns: String, lft: Int = 1800) {
+    fun addRdnssOption(dns: String, lft: Int = 1800): RaPkt {
         val dnsServers = dns.split(",").map { InetAddress.getByName(it) as Inet6Address }
-        addRdnssOption(dnsServers, lft)
+        return addRdnssOption(dnsServers, lft)
     }
 
     /** Add a Route Information Option
@@ -273,7 +281,7 @@ class RaPkt(
      * @param prefix The IPv6 prefix of the route.
      * @param lft The lifetime of the route in seconds.
      */
-    fun addRioOption(prefix: IpPrefix, lft: Int) {
+    fun addRioOption(prefix: IpPrefix, lft: Int): RaPkt {
         val rio = ByteBuffer.allocate(24)
         rio.put(24) // Type = 24
         rio.put(3) // Length = 3 -- TODO: support variable prefix length
@@ -284,6 +292,7 @@ class RaPkt(
         rio.put(prefix.rawAddress)
         rio.flip()
         outputStream.write(rio.array())
+        return this
     }
 
     /** Add a Route Information Option
@@ -291,8 +300,8 @@ class RaPkt(
      * @param prefix The IPv6 prefix of the route as a String; e.g. {@code "2001:db8::/48"}
      * @param lft The lifetime of the route in seconds.
      */
-    fun addRioOption(prefix: String, lft: Int = 1800) {
-        addRioOption(IpPrefix(prefix), lft)
+    fun addRioOption(prefix: String, lft: Int = 1800): RaPkt {
+        return addRioOption(IpPrefix(prefix), lft)
     }
 
     /** Add a PREF64 Option
@@ -300,7 +309,7 @@ class RaPkt(
      * @param prefix The PREF64 prefix.
      * @param lft The lifetime of the PREF64 prefix in seconds.
      */
-    fun addPref64Option(prefix: IpPrefix, lft: Int) {
+    fun addPref64Option(prefix: IpPrefix, lft: Int): RaPkt {
         val pref64 = ByteBuffer.allocate(16)
         pref64.put(38) // Type = 38
         pref64.put(2) // Length = 2 (*8)
@@ -318,6 +327,7 @@ class RaPkt(
         pref64.put(prefix.rawAddress, 0 /*offset*/, 12 /*length*/) // highest 96 bits of prefix.
         pref64.flip()
         outputStream.write(pref64.array())
+        return this
     }
 
     /** Add a PREF64 Option
@@ -325,8 +335,8 @@ class RaPkt(
      * @param prefix The PREF64 prefix as a String; e.g. {@code "2001:db8::/64"}
      * @param lft The lifetime of the PREF64 prefix in seconds.
      */
-    fun addPref64Option(prefix: String, lft: Int = 1800) {
-        addPref64Option(IpPrefix(prefix), lft)
+    fun addPref64Option(prefix: String, lft: Int = 1800): RaPkt {
+        return addPref64Option(IpPrefix(prefix), lft)
     }
 
     override fun toByteArray() = outputStream.toByteArray()

From e2db1fe7e04727a3d7b8c29269e62a26297cba93 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Wed, 2 Apr 2025 11:41:01 -0700
Subject: [PATCH 055/377] Use Kotlin syntax for getters

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: Ic4b22e2c6154bf634bfbbe6c539bc6b26a29b3af
---
 .../com/android/testutils/PacketBuilderUtils.kt           | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
index 4d5544a14c..3475c72584 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
@@ -213,12 +213,12 @@ class RaPkt(
         val pio = ByteBuffer.allocate(32)
         pio.put(3) // Type = 3
         pio.put(4) // Length = 4 (*8)
-        pio.put(prefix.getPrefixLength().toByte()) // Prefix Length
+        pio.put(prefix.prefixLength.toByte()) // Prefix Length
         pio.put(flags.toByte()) // Flags
         pio.putInt(validLft) // Valid Lifetime
         pio.putInt(preferredLft) // Preferred Lifetime
         pio.putInt(0) // Reserved2
-        pio.put(prefix.getRawAddress())
+        pio.put(prefix.rawAddress)
         pio.flip()
         outputStream.write(pio.array())
         return this
@@ -368,8 +368,8 @@ class Ip6Pkt(
         ipv6Header.putShort(data.size)
         ipv6Header.put(data.proto)
         ipv6Header.put(hlim)
-        ipv6Header.put(src.getAddress())
-        ipv6Header.put(dst.getAddress())
+        ipv6Header.put(src.address)
+        ipv6Header.put(dst.address)
         ipv6Header.flip()
 
         val outputStream = ByteArrayOutputStream()

From 837647cb74a09c2a9a1731a664347abe622c65c9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Wed, 2 Apr 2025 12:48:18 -0700
Subject: [PATCH 056/377] bpf netd: no-op move lockdown check before iif match
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Flag: EXEMPT no-op
Bug: 338629178
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ifd46edfed99849290880aeb1ad26f70a6edad1ff
---
 bpf/progs/netd.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/bpf/progs/netd.c b/bpf/progs/netd.c
index 60c5a1c2ea..2b5d5df756 100644
--- a/bpf/progs/netd.c
+++ b/bpf/progs/netd.c
@@ -483,16 +483,16 @@ static __always_inline inline int bpf_owner_match(struct __sk_buff* skb, uint32_
 
     if (!egress.egress && skb->ifindex != 1) {
         if (ingress_should_discard(skb, kver)) return DROP;
-        if (uidRules & IIF_MATCH) {
+        if (uidRules & LOCKDOWN_VPN_MATCH) {
+            // Drops packets not coming from lo and rule does not have IIF_MATCH but has
+            // LOCKDOWN_VPN_MATCH
+            return DROP_UNLESS_DNS;
+        } else if (uidRules & IIF_MATCH) {
             if (allowed_iif && skb->ifindex != allowed_iif) {
                 // Drops packets not coming from lo nor the allowed interface
                 // allowed interface=0 is a wildcard and does not drop packets
                 return DROP_UNLESS_DNS;
             }
-        } else if (uidRules & LOCKDOWN_VPN_MATCH) {
-            // Drops packets not coming from lo and rule does not have IIF_MATCH but has
-            // LOCKDOWN_VPN_MATCH
-            return DROP_UNLESS_DNS;
         }
     }
 

From 2714fb5ce70c99bab4d0e9d01262eaebad849553 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Wed, 2 Apr 2025 15:13:44 -0700
Subject: [PATCH 057/377] Revert "bpf netd: no-op move lockdown check before
 iif match"

This reverts commit 837647cb74a09c2a9a1731a664347abe622c65c9.

Reason for revert: not a no-op due to else

Change-Id: Iaaa4eb9a3f2c51714fd9fcf69cfd7ef2d125a309
---
 bpf/progs/netd.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/bpf/progs/netd.c b/bpf/progs/netd.c
index 2b5d5df756..60c5a1c2ea 100644
--- a/bpf/progs/netd.c
+++ b/bpf/progs/netd.c
@@ -483,16 +483,16 @@ static __always_inline inline int bpf_owner_match(struct __sk_buff* skb, uint32_
 
     if (!egress.egress && skb->ifindex != 1) {
         if (ingress_should_discard(skb, kver)) return DROP;
-        if (uidRules & LOCKDOWN_VPN_MATCH) {
-            // Drops packets not coming from lo and rule does not have IIF_MATCH but has
-            // LOCKDOWN_VPN_MATCH
-            return DROP_UNLESS_DNS;
-        } else if (uidRules & IIF_MATCH) {
+        if (uidRules & IIF_MATCH) {
             if (allowed_iif && skb->ifindex != allowed_iif) {
                 // Drops packets not coming from lo nor the allowed interface
                 // allowed interface=0 is a wildcard and does not drop packets
                 return DROP_UNLESS_DNS;
             }
+        } else if (uidRules & LOCKDOWN_VPN_MATCH) {
+            // Drops packets not coming from lo and rule does not have IIF_MATCH but has
+            // LOCKDOWN_VPN_MATCH
+            return DROP_UNLESS_DNS;
         }
     }
 

From b3ddc8afad264aa9af94905fba9d14886801cbb1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Wed, 2 Apr 2025 17:52:39 -0700
Subject: [PATCH 058/377] NetBpfLoad: don't fail on S on kernels with buggy bpf
 arrays
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bug: 404427531
Test: TreeHugger
Flag: EXEMPT mainline
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ib30a731d7faecfc7e52590e28350c3289fe26852
---
 bpf/loader/NetBpfLoad.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bpf/loader/NetBpfLoad.cpp b/bpf/loader/NetBpfLoad.cpp
index 74c37c4519..2d8f783365 100644
--- a/bpf/loader/NetBpfLoad.cpp
+++ b/bpf/loader/NetBpfLoad.cpp
@@ -1913,7 +1913,7 @@ static int doLoad(char** argv, char * const envp[]) {
             createMap(BPF_MAP_TYPE_ARRAY, sizeof(key), sizeof(value), 2, 0));
     if (writeToMapEntry(map, &key, &value, BPF_ANY)) {
         ALOGE("Critical kernel bug - failure to write into index 1 of 2 element bpf map array.");
-        return 1;
+        if (isAtLeastT) return 1;
     }
 
     // on S we haven't created this subdir yet, but we need it for 'mainline_done' flag below

From 9236a3e6bf76dbfc12abe89d525dfb85728c10ff Mon Sep 17 00:00:00 2001
From: Tomasz Wasilczyk <twasilczyk@google.com>
Date: Wed, 2 Apr 2025 18:39:22 -0700
Subject: [PATCH 059/377] Skip testMobileDataPreferredUids on automotive

Test: android.net.cts.ConnectivityManagerTest#testMobileDataPreferredUids
Bug: 404186833
Flag: TEST_ONLY
Change-Id: I71843f9cfd0692f1ad1e5d55b9559a1a3f5d3919
---
 .../cts/net/src/android/net/cts/ConnectivityManagerTest.java  | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java b/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
index e20e457b01..207b2e5206 100644
--- a/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
+++ b/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
@@ -28,6 +28,7 @@ import static android.Manifest.permission.NETWORK_SETUP_WIZARD;
 import static android.Manifest.permission.NETWORK_STACK;
 import static android.Manifest.permission.READ_DEVICE_CONFIG;
 import static android.Manifest.permission.TETHER_PRIVILEGED;
+import static android.content.pm.PackageManager.FEATURE_AUTOMOTIVE;
 import static android.content.pm.PackageManager.FEATURE_BLUETOOTH;
 import static android.content.pm.PackageManager.FEATURE_ETHERNET;
 import static android.content.pm.PackageManager.FEATURE_TELEPHONY;
@@ -3417,6 +3418,9 @@ public class ConnectivityManagerTest {
                 && mPackageManager.hasSystemFeature(FEATURE_TELEPHONY);
         assumeTrue("testMobileDataPreferredUidsWithCallback cannot execute"
                 + " unless device supports both WiFi and telephony", canRunTest);
+        // TODO(b/404186833): re-enable
+        assumeFalse("testMobileDataPreferredUids is broken on automotive",
+                mPackageManager.hasSystemFeature(FEATURE_AUTOMOTIVE));
 
         final int uid = mPackageManager.getPackageUid(mContext.getPackageName(), 0 /* flag */);
         final Set<Integer> mobileDataPreferredUids =

From ff3222ce51d88538cc563b84fb90ae197a89efb0 Mon Sep 17 00:00:00 2001
From: Chalard Jean <jchalard@google.com>
Date: Thu, 3 Apr 2025 13:34:36 +0900
Subject: [PATCH 060/377] Temporarily raise the number of system requests to
 375
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is a stopgap to palliate a bad interaction between
ConnectivityService and JobScheduler.

To help developers find request leaks and protect against OOMs
in the system server, ConnectivityService is enforncing a maximum
number of network requests/callbacks per UID. It has a higher
value for system UIDs because some system components need to
file requests on behalf of apps, most prominently JobScheduler.

The count is increased on entry in ConnectivityService, on the
Binder thread ; this is when CS can throw TooManyRequestsException
to the caller, it could not do that later when the request is
actually registered on the handler thread.
Conversely it only decreases the count on the handler thread,
because until then it doesn't know whether the request was
actually registered, and it can't look at that data structure on
the Binder thread.
This leads to a slightly confusing result where a UID can register
a request immediately after it unregisters one, and it will receive
TooManyRequestsException, because the unregister hasn't been
processed yet and the count not decremented yet.
This is arguably a bug, but if your app is treading on that last
request, you almost certainly had a leak anyway, and you should
not be trying to play with the exact count of requests either.
The remaining case is when an app would unregister and register
requests again in a tight loop, but there is no valid use case for
that, right ? Right !?

Enter JobScheduler. Because the limit for system UIDs is 250
requests but there can be more than 250 UIDs (especially on
devices with multiple users), JobScheduler has its own limit of
requests (which is set to 125). It has heuristics to choose which
are the most important 125 UIDs to file requests for.

When the request count exceeds 125, or when something
happens that may change which are the most important 125
UIDs, JobScheduler will re-evaluate which are the most important
ones. Upon doing this, it will unregister all requests and file
again the important ones in a tight loop. At worst, it will
therefore remove 125 requests and add 125 requests again,
taking up at most all 250 requests allowed for system UIDs ;
if the system server has any other request outstanding (and
it does), it may hit the issue where CS doesn't know yet that
requests have been unregistered, and crashes and hilarity ensue.

To palliate the issue above, this patch increases the allowed
request count for system UIDs by 125. This immediately should
fix the issue where all 250 requests are taken up by JobScheduler.

For a long-term fix, we should instead make at least one of the
following fixes :
- Have JobScheduler be smarter, and make sure it only unregisters
  the requests that it no longer needs instead of all of them.
- Make CS only throw when the requests are really full, by using
  some combination of locking, making the caller wait or similar.
- Have a separate pool of requests for JobScheduler that is
  dimensioned so it knows it can file all the necessary requests
  and no longer has to limit itself, and simplify the JS code.

Flag: EXEMPT bugfix
Bug: 391114053
Test: ConnectivityServiceTest
Change-Id: I4c4702e2d0c5d03eb5f3d6fe0f1578a210b188e8
---
 service/src/com/android/server/ConnectivityService.java    | 7 ++++++-
 .../java/com/android/server/ConnectivityServiceTest.java   | 2 +-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index c870edc94f..4021a82eff 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -504,8 +504,13 @@ public class ConnectivityService extends IConnectivityManager.Stub {
     static final int MAX_NETWORK_REQUESTS_PER_UID = 100;
 
     // The maximum number of network request allowed for system UIDs before an exception is thrown.
+    // The point of this limit is to help developers find request leaks, so it should be
+    // appropriately low, while allowing plenty of requests for normal use cases.
+    // In the case of the system UIDs, the main consumer of such requests is JobScheduler, which
+    // at most might file one request per UID on the system. Also see b/391114053 for some context
+    // about the specific JobScheduler case and its own self-imposed limit.
     @VisibleForTesting
-    static final int MAX_NETWORK_REQUESTS_PER_SYSTEM_UID = 250;
+    static final int MAX_NETWORK_REQUESTS_PER_SYSTEM_UID = 375;
 
     @VisibleForTesting
     protected int mLingerDelayMs;  // Can't be final, or test subclass constructors can't change it.
diff --git a/tests/unit/java/com/android/server/ConnectivityServiceTest.java b/tests/unit/java/com/android/server/ConnectivityServiceTest.java
index 5337bfb444..63d014aad9 100755
--- a/tests/unit/java/com/android/server/ConnectivityServiceTest.java
+++ b/tests/unit/java/com/android/server/ConnectivityServiceTest.java
@@ -7611,7 +7611,7 @@ public class ConnectivityServiceTest {
         final int CALLBACKS = 88;
         final int DIFF_INTENTS = 10;
         final int SAME_INTENTS = 10;
-        final int SYSTEM_ONLY_MAX_REQUESTS = 250;
+        final int SYSTEM_ONLY_MAX_REQUESTS = 375;
         // CALLBACKS + DIFF_INTENTS + 1 (same intent)
         // = MAX_REQUESTS - 1, since the capacity is MAX_REQUEST - 1.
         assertEquals(MAX_REQUESTS - 1, CALLBACKS + DIFF_INTENTS + 1);

From d66c016ca1b910326e97b22d6018a94e80dde4cf Mon Sep 17 00:00:00 2001
From: Remi NGUYEN VAN <reminv@google.com>
Date: Tue, 1 Apr 2025 18:35:54 +0900
Subject: [PATCH 061/377] Only flush records with matching rrtype

MdnsResponseDecoder flushed all address records when receiving an
address record with the the cache-flush bit is set. However as per
RFC6762 10.2, only records with a matching rrtype should be
flushed, which means that AAAA records should not be flushed when an A
record is received, and vice-versa.

Fix the logic and include a default-on flag to allow turning it off if
needed.

Test: atest
Flag: EXEMPT bugfix
Bug: 407698496
Change-Id: I6142f9996362dd7c16b4e80c8019f0cb1caef174
---
 .../src/com/android/server/NsdService.java    |   2 +
 .../connectivity/mdns/MdnsFeatureFlags.java   |  29 ++++
 .../mdns/MdnsResponseDecoder.java             |  19 ++-
 .../mdns/MdnsServiceTypeClient.java           |   2 +-
 .../mdns/MdnsResponseDecoderTests.java        | 127 +++++++++++++++++-
 5 files changed, 170 insertions(+), 9 deletions(-)

diff --git a/service-t/src/com/android/server/NsdService.java b/service-t/src/com/android/server/NsdService.java
index 4af8b0e981..c1a263e258 100644
--- a/service-t/src/com/android/server/NsdService.java
+++ b/service-t/src/com/android/server/NsdService.java
@@ -1949,6 +1949,8 @@ public class NsdService extends INsdManager.Stub {
                         MdnsFeatureFlags.DEFAULT_CACHED_SERVICES_RETENTION_TIME_MILLISECONDS))
                 .setIsShortHostnamesEnabled(mDeps.isTetheringFeatureNotChickenedOut(
                         mContext, MdnsFeatureFlags.NSD_USE_SHORT_HOSTNAMES))
+                .setIsCacheFlushPerAddressTypeEnabled(mDeps.isTetheringFeatureNotChickenedOut(
+                        mContext, MdnsFeatureFlags.NSD_CACHE_FLUSH_PER_ADDRESS_TYPE))
                 .setOverrideProvider(new MdnsFeatureFlags.FlagOverrideProvider() {
                     @Override
                     public boolean isForceEnabledForTest(@NonNull String flag) {
diff --git a/service-t/src/com/android/server/connectivity/mdns/MdnsFeatureFlags.java b/service-t/src/com/android/server/connectivity/mdns/MdnsFeatureFlags.java
index 9ea6f5315f..31acab2904 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MdnsFeatureFlags.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MdnsFeatureFlags.java
@@ -86,6 +86,15 @@ public class MdnsFeatureFlags {
      */
     public static final String NSD_USE_SHORT_HOSTNAMES = "nsd_use_short_hostnames";
 
+    /**
+
+     * A feature flag to control whether to only flush address records when another address record
+     * with the same name, rrtype and rrclass is received (as per RFC6762 10.2), instead of flushing
+     * all address records (A and AAAA) for the same name only.
+     */
+    public static final String NSD_CACHE_FLUSH_PER_ADDRESS_TYPE =
+            "nsd_cache_flush_per_address_type";
+
     /**
      * A feature flag to control the retention time for cached services.
      *
@@ -142,6 +151,10 @@ public class MdnsFeatureFlags {
     // Flag to enable guessing the Network of received packets in the legacy MdnsSocketClient.
     public final boolean mIsSocketClientNetworkGuessingEnabled;
 
+    // Flag to only flush address records when another address record with the same name, rrtype and
+    // rrclass is received
+    public final boolean mIsCacheFlushPerAddressTypeEnabled;
+
     @Nullable
     private final FlagOverrideProvider mOverrideProvider;
 
@@ -266,6 +279,7 @@ public class MdnsFeatureFlags {
             boolean isAccurateDelayCallbackEnabled,
             boolean isShortHostnamesEnabled,
             boolean isSocketClientNetworkGuessingEnabled,
+            boolean isCacheFlushPerAddressTypeEnabled,
             @Nullable FlagOverrideProvider overrideProvider) {
         mIsMdnsOffloadFeatureEnabled = isOffloadFeatureEnabled;
         mIncludeInetAddressRecordsInProbing = includeInetAddressRecordsInProbing;
@@ -281,6 +295,7 @@ public class MdnsFeatureFlags {
         mIsAccurateDelayCallbackEnabled = isAccurateDelayCallbackEnabled;
         mIsShortHostnamesEnabled = isShortHostnamesEnabled;
         mIsSocketClientNetworkGuessingEnabled = isSocketClientNetworkGuessingEnabled;
+        mIsCacheFlushPerAddressTypeEnabled = isCacheFlushPerAddressTypeEnabled;
         mOverrideProvider = overrideProvider;
     }
 
@@ -307,6 +322,7 @@ public class MdnsFeatureFlags {
         private boolean mIsAccurateDelayCallbackEnabled;
         private boolean mIsShortHostnamesEnabled;
         private boolean mIsSocketClientNetworkGuessingEnabled;
+        private boolean mIsCacheFlushPerAddressTypeEnabled;
         private FlagOverrideProvider mOverrideProvider;
 
         /**
@@ -327,6 +343,7 @@ public class MdnsFeatureFlags {
             mIsAccurateDelayCallbackEnabled = false;
             mIsShortHostnamesEnabled = true; // Default enabled.
             mIsSocketClientNetworkGuessingEnabled = false;
+            mIsCacheFlushPerAddressTypeEnabled = true; // Default enabled.
             mOverrideProvider = null;
         }
 
@@ -481,6 +498,17 @@ public class MdnsFeatureFlags {
             return this;
         }
 
+        /**
+         * Set whether the cache flush per address type is enabled.
+         *
+         * @see #NSD_CACHE_FLUSH_PER_ADDRESS_TYPE
+         */
+        public Builder setIsCacheFlushPerAddressTypeEnabled(
+                boolean isCacheFlushPerAddressTypeEnabled) {
+            mIsCacheFlushPerAddressTypeEnabled = isCacheFlushPerAddressTypeEnabled;
+            return this;
+        }
+
         /**
          * Builds a {@link MdnsFeatureFlags} with the arguments supplied to this builder.
          */
@@ -499,6 +527,7 @@ public class MdnsFeatureFlags {
                     mIsAccurateDelayCallbackEnabled,
                     mIsShortHostnamesEnabled,
                     mIsSocketClientNetworkGuessingEnabled,
+                    mIsCacheFlushPerAddressTypeEnabled,
                     mOverrideProvider);
         }
     }
diff --git a/service-t/src/com/android/server/connectivity/mdns/MdnsResponseDecoder.java b/service-t/src/com/android/server/connectivity/mdns/MdnsResponseDecoder.java
index 0e9c804e42..1abad5e570 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MdnsResponseDecoder.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MdnsResponseDecoder.java
@@ -16,6 +16,9 @@
 
 package com.android.server.connectivity.mdns;
 
+import static com.android.server.connectivity.mdns.MdnsRecord.TYPE_A;
+import static com.android.server.connectivity.mdns.MdnsRecord.TYPE_AAAA;
+
 import android.annotation.NonNull;
 import android.annotation.Nullable;
 import android.net.Network;
@@ -127,7 +130,8 @@ public class MdnsResponseDecoder {
     public Pair<Set<MdnsResponse>, ArrayList<MdnsResponse>> augmentResponses(
             @NonNull MdnsPacket mdnsPacket,
             @NonNull Collection<MdnsResponse> existingResponses, int interfaceIndex,
-            @Nullable Network network) {
+            @Nullable Network network,
+            @NonNull MdnsFeatureFlags flags) {
         final ArrayList<MdnsRecord> records = new ArrayList<>(
                 mdnsPacket.questions.size() + mdnsPacket.answers.size()
                         + mdnsPacket.authorityRecords.size() + mdnsPacket.additionalRecords.size());
@@ -218,7 +222,8 @@ public class MdnsResponseDecoder {
                 List<MdnsResponse> matchingResponses =
                         findResponsesWithHostName(responses, inetRecord.getName());
                 for (MdnsResponse response : matchingResponses) {
-                    // Per RFC6762 10.2, clear all address records if the cache-flush bit set.
+                    // Per RFC6762 10.2, clear all same-type address records if the cache-flush bit
+                    // set.
                     // This bit, the cache-flush bit, tells neighboring hosts
                     // that this is not a shared record type.  Instead of merging this new
                     // record additively into the cache in addition to any previous records with
@@ -227,8 +232,14 @@ public class MdnsResponseDecoder {
                     //       received more than one second ago are declared invalid, and marked
                     //       to expire from the cache in one second.
                     if (inetRecord.getCacheFlush()) {
-                        response.clearInet4AddressRecords();
-                        response.clearInet6AddressRecords();
+                        if (!flags.mIsCacheFlushPerAddressTypeEnabled
+                                || inetRecord.getType() == TYPE_A) {
+                            response.clearInet4AddressRecords();
+                        }
+                        if (!flags.mIsCacheFlushPerAddressTypeEnabled
+                                || inetRecord.getType() == TYPE_AAAA) {
+                            response.clearInet6AddressRecords();
+                        }
                     }
                 }
             }
diff --git a/service-t/src/com/android/server/connectivity/mdns/MdnsServiceTypeClient.java b/service-t/src/com/android/server/connectivity/mdns/MdnsServiceTypeClient.java
index d5761d0a31..1469a1b164 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MdnsServiceTypeClient.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MdnsServiceTypeClient.java
@@ -501,7 +501,7 @@ public class MdnsServiceTypeClient {
         }
         final Pair<Set<MdnsResponse>, ArrayList<MdnsResponse>> augmentedResult =
                 responseDecoder.augmentResponses(packet, currentList,
-                        socketKey.getInterfaceIndex(), socketKey.getNetwork());
+                        socketKey.getInterfaceIndex(), socketKey.getNetwork(), featureFlags);
 
         final Set<MdnsResponse> modifiedResponse = augmentedResult.first;
         final ArrayList<MdnsResponse> allResponses = augmentedResult.second;
diff --git a/tests/unit/java/com/android/server/connectivity/mdns/MdnsResponseDecoderTests.java b/tests/unit/java/com/android/server/connectivity/mdns/MdnsResponseDecoderTests.java
index e257871e5c..ba6406e76b 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/MdnsResponseDecoderTests.java
+++ b/tests/unit/java/com/android/server/connectivity/mdns/MdnsResponseDecoderTests.java
@@ -164,6 +164,10 @@ public class MdnsResponseDecoderTests {
     // for the records changed.
     private static final byte[] DATAIN_IPV4_2 = HexDump.hexStringToByteArray(
             "0974657374686f73743100000180010000007800040a010204");
+    // MDNS record for name "testhost1" with an IPv4 address of 10.1.2.5. Does not set the cache
+    // flush bit.
+    private static final byte[] DATAIN_IPV4_NOCACHEFLUSH = HexDump.hexStringToByteArray(
+            "0974657374686f73743100000100010000007800040a010205");
     // MDNS record w/name "testhost1" & IPv6 address of aabb:ccdd:1122:3344:a0b0:c0d0:1020:3040.
     // Also set cache flush bit for the records changed.
     private static final byte[] DATAIN_IPV6_1 = HexDump.hexStringToByteArray(
@@ -172,6 +176,10 @@ public class MdnsResponseDecoderTests {
     // Also set cache flush bit for the records changed.
     private static final byte[] DATAIN_IPV6_2 = HexDump.hexStringToByteArray(
             "0974657374686f73743100001c8001000000780010aabbccdd11223344a0b0c0d010203030");
+    // MDNS record for name "testhost1" & IPv6 address of aabb:ccdd:1122:3344:a0b0:c0d0:1020:3050.
+    // Does not set the cache flush bit.
+    private static final byte[] DATAIN_IPV6_NOCACHEFLUSH = HexDump.hexStringToByteArray(
+            "0974657374686f73743100001c0001000000780010aabbccdd11223344a0b0c0d010203050");
     // MDNS record w/name "test" & PTR to foo.bar.quxx
     private static final byte[] DATAIN_PTR_1 = HexDump.hexStringToByteArray(
             "047465737400000C000100001194000E03666F6F03626172047175787800");
@@ -204,6 +212,7 @@ public class MdnsResponseDecoderTests {
     private static final String MATTER_SERVICE_NAME = "_matter";
     private static final String[] MATTER_SERVICE_TYPE =
             new String[] {MATTER_SERVICE_NAME, "_tcp", "local"};
+    private final MdnsFeatureFlags defaultFlags = MdnsFeatureFlags.newBuilder().build();
 
     private ArraySet<MdnsResponse> responses;
 
@@ -339,13 +348,13 @@ public class MdnsResponseDecoderTests {
                 new InetSocketAddress(MdnsConstants.getMdnsIPv6Address(), MdnsConstants.MDNS_PORT));
 
         final MdnsPacket parsedPacket = MdnsResponseDecoder.parseResponse(
-                data6, data6.length, MdnsFeatureFlags.newBuilder().build());
+                data6, data6.length, defaultFlags);
         assertNotNull(parsedPacket);
 
         final Network network = mock(Network.class);
         responses = new ArraySet<>(decoder.augmentResponses(parsedPacket,
                 /* existingResponses= */ Collections.emptyList(),
-                /* interfaceIndex= */ 10, network /* expireOnExit= */).first);
+                /* interfaceIndex= */ 10, network /* expireOnExit= */, defaultFlags).first);
 
         assertEquals(responses.size(), 1);
         assertEquals(responses.valueAt(0).getInterfaceIndex(), 10);
@@ -467,6 +476,96 @@ public class MdnsResponseDecoderTests {
                 updatedResponses.valueAt(0).getInet6AddressRecords().get(0).getInet6Address());
     }
 
+    @Test
+    public void testDecodeWithAddressesAddedAndRemoved_AddIpv4Address() throws IOException {
+        MdnsResponse response = makeMdnsResponse(0, DATAIN_SERVICE_NAME_1, List.of(
+                new PacketAndRecordClass(DATAIN_PTR_1,
+                        MdnsPointerRecord.class),
+                new PacketAndRecordClass(DATAIN_SERVICE_1,
+                        MdnsServiceRecord.class),
+                new PacketAndRecordClass(DATAIN_IPV6_1,
+                        MdnsInet6AddressRecord.class),
+                new PacketAndRecordClass(DATAIN_IPV4_1,
+                        MdnsInet4AddressRecord.class)));
+        // Now update the response replacing IPv6 addresses, and adding an IPv4 address
+        final MdnsResponseDecoder decoder = new MdnsResponseDecoder(mClock, null);
+        final byte[] removedAddrResponse = makeResponsePacket(List.of(
+                DATAIN_PTR_1, DATAIN_SERVICE_1, DATAIN_IPV6_2, DATAIN_IPV4_NOCACHEFLUSH));
+        final ArraySet<MdnsResponse> updatedResponses = decode(
+                decoder, removedAddrResponse, List.of(response));
+        assertEquals(1, updatedResponses.size());
+        assertEquals(1, updatedResponses.valueAt(0).getInet6AddressRecords().size());
+        assertEquals(parseNumericAddress("aabb:ccdd:1122:3344:a0b0:c0d0:1020:3030"),
+                updatedResponses.valueAt(0).getInet6AddressRecords().get(0).getInet6Address());
+        assertEquals(2, updatedResponses.valueAt(0).getInet4AddressRecords().size());
+        assertEquals(parseNumericAddress("10.1.2.3"),
+                updatedResponses.valueAt(0).getInet4AddressRecords().get(0).getInet4Address());
+        assertEquals(parseNumericAddress("10.1.2.5"),
+                updatedResponses.valueAt(0).getInet4AddressRecords().get(1).getInet4Address());
+    }
+
+    @Test
+    public void testDecodeWithAddressesReplaced_PerAddressTypeCacheFlushDisabled()
+            throws IOException {
+        final MdnsFeatureFlags flags = MdnsFeatureFlags.newBuilder()
+                .setIsCacheFlushPerAddressTypeEnabled(false)
+                .build();
+        MdnsResponse response = makeMdnsResponse(0, DATAIN_SERVICE_NAME_1, List.of(
+                new PacketAndRecordClass(DATAIN_PTR_1,
+                        MdnsPointerRecord.class),
+                new PacketAndRecordClass(DATAIN_SERVICE_1,
+                        MdnsServiceRecord.class),
+                new PacketAndRecordClass(DATAIN_IPV6_1,
+                        MdnsInet6AddressRecord.class),
+                new PacketAndRecordClass(DATAIN_IPV4_1,
+                        MdnsInet4AddressRecord.class)));
+        // Update the response replacing addresses with an IPv6 address (per-type flush disabled)
+        final MdnsResponseDecoder decoder = new MdnsResponseDecoder(mClock, null);
+        final byte[] removedAddrResponse = makeResponsePacket(List.of(
+                DATAIN_PTR_1, DATAIN_SERVICE_1, DATAIN_IPV6_2));
+        final MdnsPacket parsedPacket = MdnsResponseDecoder.parseResponse(
+                removedAddrResponse, removedAddrResponse.length, flags);
+        assertNotNull(parsedPacket);
+
+        final ArraySet<MdnsResponse> updatedResponses = new ArraySet<>(decoder.augmentResponses(
+                parsedPacket, List.of(response), MdnsSocket.INTERFACE_INDEX_UNSPECIFIED,
+                mock(Network.class), flags).first);
+
+        assertEquals(1, updatedResponses.size());
+        assertEquals(1, updatedResponses.valueAt(0).getInet6AddressRecords().size());
+        assertEquals(parseNumericAddress("aabb:ccdd:1122:3344:a0b0:c0d0:1020:3030"),
+                updatedResponses.valueAt(0).getInet6AddressRecords().get(0).getInet6Address());
+        assertEquals(0, updatedResponses.valueAt(0).getInet4AddressRecords().size());
+    }
+
+    @Test
+    public void testDecodeWithAddressesAdded_AddIpv6Address() throws IOException {
+        MdnsResponse response = makeMdnsResponse(0, DATAIN_SERVICE_NAME_1, List.of(
+                new PacketAndRecordClass(DATAIN_PTR_1,
+                        MdnsPointerRecord.class),
+                new PacketAndRecordClass(DATAIN_SERVICE_1,
+                        MdnsServiceRecord.class),
+                new PacketAndRecordClass(DATAIN_IPV6_1,
+                        MdnsInet6AddressRecord.class),
+                new PacketAndRecordClass(DATAIN_IPV4_1,
+                        MdnsInet4AddressRecord.class)));
+        // Now update the response adding an IPv6 address
+        final MdnsResponseDecoder decoder = new MdnsResponseDecoder(mClock, null);
+        final byte[] removedAddrResponse = makeResponsePacket(List.of(
+                DATAIN_PTR_1, DATAIN_SERVICE_1, DATAIN_IPV6_NOCACHEFLUSH));
+        final ArraySet<MdnsResponse> updatedResponses = decode(
+                decoder, removedAddrResponse, List.of(response));
+        assertEquals(1, updatedResponses.size());
+        assertEquals(2, updatedResponses.valueAt(0).getInet6AddressRecords().size());
+        assertEquals(parseNumericAddress("aabb:ccdd:1122:3344:a0b0:c0d0:1020:3040"),
+                updatedResponses.valueAt(0).getInet6AddressRecords().get(0).getInet6Address());
+        assertEquals(parseNumericAddress("aabb:ccdd:1122:3344:a0b0:c0d0:1020:3050"),
+                updatedResponses.valueAt(0).getInet6AddressRecords().get(1).getInet6Address());
+        assertEquals(1, updatedResponses.valueAt(0).getInet4AddressRecords().size());
+        assertEquals(parseNumericAddress("10.1.2.3"),
+                updatedResponses.valueAt(0).getInet4AddressRecords().get(0).getInet4Address());
+    }
+
     @Test
     public void testDecodeWithChangeOnText() throws IOException {
         MdnsResponse response = makeMdnsResponse(0, DATAIN_SERVICE_NAME_1, List.of(
@@ -550,6 +649,26 @@ public class MdnsResponseDecoderTests {
         assertEquals(0, changes.size());
     }
 
+    @Test
+    public void testDecodeWithNoChange_AddressRecordWithNoCacheFlush() throws IOException {
+        MdnsResponse response = makeMdnsResponse(0, DATAIN_SERVICE_NAME_1, List.of(
+                new PacketAndRecordClass(DATAIN_PTR_1,
+                        MdnsPointerRecord.class),
+                new PacketAndRecordClass(DATAIN_SERVICE_1,
+                        MdnsServiceRecord.class),
+                new PacketAndRecordClass(DATAIN_IPV6_1,
+                        MdnsInet6AddressRecord.class),
+                new PacketAndRecordClass(DATAIN_IPV4_NOCACHEFLUSH,
+                        MdnsInet4AddressRecord.class)));
+        // Now update the response adding an already existing IPv4 address
+        final MdnsResponseDecoder decoder = new MdnsResponseDecoder(mClock, null);
+        final byte[] removedAddrResponse = makeResponsePacket(List.of(
+                DATAIN_PTR_1, DATAIN_SERVICE_1, DATAIN_IPV4_NOCACHEFLUSH));
+        final ArraySet<MdnsResponse> updatedResponses = decode(
+                decoder, removedAddrResponse, List.of(response));
+        assertEquals(0, updatedResponses.size());
+    }
+
     private static MdnsResponse makeMdnsResponse(long time, String[] serviceName,
             List<PacketAndRecordClass> responseList) throws IOException {
         final MdnsResponse response = new MdnsResponse(
@@ -620,11 +739,11 @@ public class MdnsResponseDecoderTests {
     private ArraySet<MdnsResponse> decode(MdnsResponseDecoder decoder, byte[] data,
             Collection<MdnsResponse> existingResponses) throws MdnsPacket.ParseException {
         final MdnsPacket parsedPacket = MdnsResponseDecoder.parseResponse(
-                data, data.length, MdnsFeatureFlags.newBuilder().build());
+                data, data.length, defaultFlags);
         assertNotNull(parsedPacket);
 
         return new ArraySet<>(decoder.augmentResponses(parsedPacket,
                 existingResponses,
-                MdnsSocket.INTERFACE_INDEX_UNSPECIFIED, mock(Network.class)).first);
+                MdnsSocket.INTERFACE_INDEX_UNSPECIFIED, mock(Network.class), defaultFlags).first);
     }
 }
\ No newline at end of file

From 60488fea8368765d0f39e326b83b9000d4890927 Mon Sep 17 00:00:00 2001
From: Paul Hu <paulhu@google.com>
Date: Wed, 5 Mar 2025 09:27:28 +0000
Subject: [PATCH 062/377] Update cached service first query time

Updated the MdnsServiceCache to maintain the first query time
after the last update of cached services, allowing for more
accurate expired service management.

Bug: 387910548
Test: atest ConnectivityCoverageTests NsdManagerTest
Flag: EXEMPT legacy flag nsd_optimized_expired_service_removal
Change-Id: I6da0691ece239b3b2e5dc5198a656cf21b30e953
---
 .../connectivity/mdns/MdnsServiceCache.java   |  49 +++++-
 .../mdns/MdnsServiceTypeClient.java           |  14 ++
 .../connectivity/mdns/MdnsServiceCacheTest.kt | 150 +++++++++++++++++-
 3 files changed, 205 insertions(+), 8 deletions(-)

diff --git a/service-t/src/com/android/server/connectivity/mdns/MdnsServiceCache.java b/service-t/src/com/android/server/connectivity/mdns/MdnsServiceCache.java
index 7c72fb1a7d..41e265b763 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MdnsServiceCache.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MdnsServiceCache.java
@@ -20,6 +20,7 @@ import static com.android.net.module.util.DnsUtils.equalsIgnoreDnsCase;
 import static com.android.net.module.util.DnsUtils.toDnsUpperCase;
 import static com.android.net.module.util.HandlerUtils.ensureRunningOnHandlerThread;
 import static com.android.server.connectivity.mdns.MdnsResponse.EXPIRATION_NEVER;
+import static com.android.server.connectivity.mdns.util.MdnsUtils.responseMatchesInstanceNameAndSubtypes;
 
 import static java.lang.Math.min;
 
@@ -34,6 +35,7 @@ import com.android.server.connectivity.mdns.util.MdnsUtils;
 
 import java.io.PrintWriter;
 import java.util.ArrayList;
+import java.util.Collection;
 import java.util.Collections;
 import java.util.Iterator;
 import java.util.List;
@@ -49,6 +51,9 @@ import java.util.Objects;
  *  to their default value (0, false or null).
  */
 public class MdnsServiceCache {
+    @VisibleForTesting
+    static final long NEVER_SENT_QUERY = -1L;
+
     public static class CacheKey {
         @NonNull final String mUpperCaseServiceType;
         @NonNull final SocketKey mSocketKey;
@@ -82,10 +87,14 @@ public class MdnsServiceCache {
     public static class CachedService {
         @NonNull final MdnsResponse mService;
         boolean mServiceExpired;
+        // The timestamp of the first query sent after the service last received time (from the SRV
+        // record).
+        long mFirstQueryTimeAfterLastUpdate;
 
         CachedService(MdnsResponse service) {
             mService = service;
             mServiceExpired = false;
+            mFirstQueryTimeAfterLastUpdate = NEVER_SENT_QUERY;
         }
     }
 
@@ -393,6 +402,42 @@ public class MdnsServiceCache {
         mNextExpirationTime = getNextExpirationTime(now);
     }
 
+    /**
+     * Update the query time for the cached services
+     *
+     * @param serviceName the target service name.
+     * @param cacheKey the target CacheKey.
+     * @param currentTime current time.
+     */
+    public void updateFirstQueryTimeForCachedServices(@Nullable String serviceName,
+            @NonNull Collection<String> subtypes, @NonNull CacheKey cacheKey, long currentTime) {
+        ensureRunningOnHandlerThread(mHandler);
+        final List<CachedService> cachedServices = mCachedServices.get(cacheKey);
+        if (cachedServices == null) {
+            // No such services.
+            return;
+        }
+        for (CachedService cachedService : cachedServices) {
+            if (cachedService.mFirstQueryTimeAfterLastUpdate != NEVER_SENT_QUERY) continue;
+            if (responseMatchesInstanceNameAndSubtypes(
+                    cachedService.mService, serviceName, subtypes)) {
+                cachedService.mFirstQueryTimeAfterLastUpdate = currentTime;
+            }
+        }
+    }
+
+    @VisibleForTesting
+    long getFirstQueryTimeAfterLastUpdate(@NonNull String serviceName, @NonNull CacheKey cacheKey) {
+        ensureRunningOnHandlerThread(mHandler);
+        final List<CachedService> cachedServices = mCachedServices.get(cacheKey);
+        if (cachedServices == null) {
+            return NEVER_SENT_QUERY;
+        }
+        final CachedService cachedService = findMatchedCachedService(cachedServices, serviceName);
+        return cachedService != null
+                ? cachedService.mFirstQueryTimeAfterLastUpdate : NEVER_SENT_QUERY;
+    }
+
     /**
      * Dump ServiceCache state.
      */
@@ -404,7 +449,9 @@ public class MdnsServiceCache {
             pw.println(indent + key);
             for (CachedService cachedService : mCachedServices.valueAt(i)) {
                 pw.println(indent + "  Response{ " + cachedService.mService
-                        + " } Expired=" + cachedService.mServiceExpired);
+                        + " } Expired=" + cachedService.mServiceExpired
+                        + " FirstQueryTimeAfterLastUpdate="
+                        + cachedService.mFirstQueryTimeAfterLastUpdate);
             }
             pw.println();
         }
diff --git a/service-t/src/com/android/server/connectivity/mdns/MdnsServiceTypeClient.java b/service-t/src/com/android/server/connectivity/mdns/MdnsServiceTypeClient.java
index 1469a1b164..7c8a2edd1b 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MdnsServiceTypeClient.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MdnsServiceTypeClient.java
@@ -201,6 +201,20 @@ public class MdnsServiceTypeClient {
                                 handler.obtainMessage(EVENT_START_QUERYTASK, args),
                                 timeToNextTaskMs);
                     }
+                    // Update the first query time based on the query result
+                    if (sentResult.queriedBaseType) {
+                        serviceCache.updateFirstQueryTimeForCachedServices(null /* serviceName */,
+                                Collections.emptyList() /* subtypes */, cacheKey, now);
+                    }
+                    if (sentResult.queriedSubtypes.size() != 0) {
+                        serviceCache.updateFirstQueryTimeForCachedServices(null /* serviceName */,
+                                sentResult.queriedSubtypes, cacheKey, now);
+                    }
+                    for (MdnsResponse service : sentResult.resolvedServices) {
+                        serviceCache.updateFirstQueryTimeForCachedServices(
+                                service.getServiceInstanceName(),
+                                Collections.emptyList() /* subtypes */, cacheKey, now);
+                    }
                     break;
                 }
                 default:
diff --git a/tests/unit/java/com/android/server/connectivity/mdns/MdnsServiceCacheTest.kt b/tests/unit/java/com/android/server/connectivity/mdns/MdnsServiceCacheTest.kt
index 2ebe87a9f9..e5ed862171 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/MdnsServiceCacheTest.kt
+++ b/tests/unit/java/com/android/server/connectivity/mdns/MdnsServiceCacheTest.kt
@@ -20,8 +20,10 @@ import android.os.Build
 import android.os.Handler
 import android.os.HandlerThread
 import com.android.net.module.util.ArrayTrackRecord
+import com.android.net.module.util.CollectionUtils
 import com.android.server.connectivity.mdns.MdnsServiceCache.CacheKey
 import com.android.server.connectivity.mdns.MdnsServiceCache.CachedService
+import com.android.server.connectivity.mdns.MdnsServiceCache.NEVER_SENT_QUERY
 import com.android.server.connectivity.mdns.MdnsServiceCacheTest.ExpiredRecord.ExpiredEvent.ServiceRecordExpired
 import com.android.server.connectivity.mdns.util.MdnsUtils
 import com.android.testutils.DevSdkIgnoreRule
@@ -160,6 +162,29 @@ class MdnsServiceCacheTest {
             cacheKey: CacheKey
     ): Unit = runningOnHandlerAndReturn { serviceCache.removeServices(cacheKey) }
 
+    private fun getFirstQueryTimeAfterLastUpdate(
+            serviceCache: MdnsServiceCache,
+            serviceName: String,
+            cacheKey: CacheKey
+    ): Long = runningOnHandlerAndReturn {
+        serviceCache.getFirstQueryTimeAfterLastUpdate(serviceName, cacheKey)
+    }
+
+    private fun updateFirstQueryTimeForCachedServices(
+            serviceCache: MdnsServiceCache,
+            serviceName: String?,
+            subtypes: List<String>,
+            cacheKey: CacheKey,
+            currentTime: Long
+    ): Unit = runningOnHandlerAndReturn {
+        serviceCache.updateFirstQueryTimeForCachedServices(
+                serviceName,
+                subtypes,
+                cacheKey,
+                currentTime
+        )
+    }
+
     @Test
     fun testAddAndRemoveService() {
         val serviceCache = MdnsServiceCache(thread.looper, makeFlags(), clock)
@@ -357,32 +382,143 @@ class MdnsServiceCacheTest {
         assertEquals(0, responses5.size)
     }
 
+    @Test
+    fun testFirstQueryTime_AddService() {
+        val serviceCache = MdnsServiceCache(thread.looper, makeFlags(), clock)
+        addOrUpdateService(serviceCache, cacheKey1, createResponse(SERVICE_NAME_1, SERVICE_TYPE_1))
+        addOrUpdateService(serviceCache, cacheKey1, createResponse(SERVICE_NAME_2, SERVICE_TYPE_1))
+
+        // Verify the first query time
+        assertEquals(
+                NEVER_SENT_QUERY,
+                getFirstQueryTimeAfterLastUpdate(serviceCache, SERVICE_NAME_1, cacheKey1)
+        )
+        assertEquals(
+                NEVER_SENT_QUERY,
+                getFirstQueryTimeAfterLastUpdate(serviceCache, SERVICE_NAME_2, cacheKey1)
+        )
+    }
+
+    @Test
+    fun testFirstQueryTime_UpdateServices() {
+        val serviceCache = MdnsServiceCache(thread.looper, makeFlags(), clock)
+        var currentTime = 12345L
+        addOrUpdateService(serviceCache, cacheKey1, createResponse(SERVICE_NAME_1, SERVICE_TYPE_1))
+        addOrUpdateService(serviceCache, cacheKey1, createResponse(SERVICE_NAME_2, SERVICE_TYPE_1))
+
+        // Update the first query time for all services and verify the update.
+        updateFirstQueryTimeForCachedServices(
+                serviceCache,
+                serviceName = null,
+                subtypes = emptyList(),
+                cacheKey1,
+                currentTime
+        )
+        assertEquals(
+                currentTime,
+                getFirstQueryTimeAfterLastUpdate(serviceCache, SERVICE_NAME_1, cacheKey1)
+        )
+        assertEquals(
+                currentTime,
+                getFirstQueryTimeAfterLastUpdate(serviceCache, SERVICE_NAME_2, cacheKey1)
+        )
+    }
+
+    @Test
+    fun testFirstQueryTime_UpdateServices_WithSubtypes() {
+        val serviceCache = MdnsServiceCache(thread.looper, makeFlags(), clock)
+        var currentTime = 12345L
+        val subType = "subtype"
+        addOrUpdateService(serviceCache, cacheKey1, createResponse(SERVICE_NAME_1, SERVICE_TYPE_1))
+        addOrUpdateService(
+                serviceCache,
+                cacheKey1,
+                createResponse(SERVICE_NAME_2, SERVICE_TYPE_1, subType = subType)
+        )
+
+        // Update the first query time for the service with a subtype and verify the update.
+        updateFirstQueryTimeForCachedServices(
+                serviceCache,
+                serviceName = null,
+                subtypes = listOf(subType),
+                cacheKey1,
+                currentTime
+        )
+
+        assertEquals(
+                NEVER_SENT_QUERY,
+                getFirstQueryTimeAfterLastUpdate(serviceCache, SERVICE_NAME_1, cacheKey1)
+        )
+        assertEquals(
+                currentTime,
+                getFirstQueryTimeAfterLastUpdate(serviceCache, SERVICE_NAME_2, cacheKey1)
+        )
+    }
+
+    @Test
+    fun testFirstQueryTime_UpdateSpecificService() {
+        val serviceCache = MdnsServiceCache(thread.looper, makeFlags(), clock)
+        var currentTime = 12345L
+        addOrUpdateService(serviceCache, cacheKey1, createResponse(SERVICE_NAME_1, SERVICE_TYPE_1))
+        addOrUpdateService(serviceCache, cacheKey1, createResponse(SERVICE_NAME_2, SERVICE_TYPE_1))
+
+        // Update the first query time for service 1 only and verify the update.
+        updateFirstQueryTimeForCachedServices(
+                serviceCache,
+                SERVICE_NAME_1,
+                subtypes = emptyList(),
+                cacheKey1,
+                currentTime
+        )
+        assertEquals(
+                currentTime,
+                getFirstQueryTimeAfterLastUpdate(serviceCache, SERVICE_NAME_1, cacheKey1)
+        )
+        assertEquals(
+                NEVER_SENT_QUERY,
+                getFirstQueryTimeAfterLastUpdate(serviceCache, SERVICE_NAME_2, cacheKey1)
+        )
+    }
+
     private fun createResponse(
             serviceInstanceName: String,
             serviceType: String,
-            ttlTime: Long = 120000L
+            ttlTime: Long = 120000L,
+            subType: String? = null
     ): MdnsResponse {
-        val serviceName = "$serviceInstanceName.$serviceType".split(".").toTypedArray()
+        val serviceTypeArray = if (subType != null) {
+            MdnsUtils.constructFullSubtype(
+                    serviceType.split(".").toTypedArray(),
+                    "_$subType"
+            )
+        } else {
+            serviceType.split(".").toTypedArray()
+        }
+        val serviceNameArray = CollectionUtils.prependArray(
+                String::class.java,
+                serviceTypeArray,
+                serviceInstanceName
+        )
         val response = MdnsResponse(
                 0 /* now */,
-            "$serviceInstanceName.$serviceType".split(".").toTypedArray(),
+                serviceNameArray,
                 socketKey.interfaceIndex,
-            socketKey.network
+                socketKey.network
         )
 
         // Set PTR record
         val pointerRecord = MdnsPointerRecord(
-                serviceType.split(".").toTypedArray(),
+                serviceTypeArray,
                 TEST_ELAPSED_REALTIME_MS /* receiptTimeMillis */,
                 false /* cacheFlush */,
                 ttlTime /* ttlMillis */,
-                serviceName
+                serviceNameArray
         )
         response.addPointerRecord(pointerRecord)
 
         // Set SRV record.
         val serviceRecord = MdnsServiceRecord(
-                serviceName,
+                serviceNameArray,
                 TEST_ELAPSED_REALTIME_MS /* receiptTimeMillis */,
                 false /* cacheFlush */,
                 ttlTime /* ttlMillis */,

From 14c515562a045cfca4cfdc1d7ce4b28004da07b1 Mon Sep 17 00:00:00 2001
From: Paul Hu <paulhu@google.com>
Date: Wed, 12 Mar 2025 08:33:47 +0000
Subject: [PATCH 063/377] Exclude expired services in response retrieval

Update MdnsServiceCache to enhance its ability to retrieve
responses and manage expired services effectively. Introduce an
argument `excludeExpiredServices` to control whether expired
services should be excluded when retrieving responses. And add a
new method `markExpiredServices` to mark services as expired
based on their TTL and current time.

Bug: 387910548
Test: atest ConnectivityCoverageTests NsdManagerTest
Flag: EXEMPT legacy flag nsd_optimized_expired_service_removal
Change-Id: Ifa30fbe75a72ea400a69ab258d67381a54faf9b5
---
 .../connectivity/mdns/MdnsServiceCache.java   |  47 ++++++-
 .../mdns/MdnsServiceTypeClient.java           |  31 +++--
 .../connectivity/mdns/MdnsServiceCacheTest.kt | 130 ++++++++++++++----
 3 files changed, 170 insertions(+), 38 deletions(-)

diff --git a/service-t/src/com/android/server/connectivity/mdns/MdnsServiceCache.java b/service-t/src/com/android/server/connectivity/mdns/MdnsServiceCache.java
index 41e265b763..fbfef017c7 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MdnsServiceCache.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MdnsServiceCache.java
@@ -133,9 +133,11 @@ public class MdnsServiceCache {
         mClock = clock;
     }
 
-    private List<MdnsResponse> cachedServicesToResponses(List<CachedService> cachedServices) {
+    private List<MdnsResponse> cachedServicesToResponses(List<CachedService> cachedServices,
+            boolean excludeExpiredServices) {
         final List<MdnsResponse> responses = new ArrayList<>();
         for (CachedService cachedService : cachedServices) {
+            if (excludeExpiredServices && cachedService.mServiceExpired) continue;
             responses.add(cachedService.mService);
         }
         return responses;
@@ -148,14 +150,16 @@ public class MdnsServiceCache {
      * @return the set of services which matches the given service type.
      */
     @NonNull
-    public List<MdnsResponse> getCachedServices(@NonNull CacheKey cacheKey) {
+    public List<MdnsResponse> getCachedServices(@NonNull CacheKey cacheKey,
+            boolean excludeExpiredServices) {
         ensureRunningOnHandlerThread(mHandler);
         if (mMdnsFeatureFlags.mIsExpiredServicesRemovalEnabled) {
             maybeRemoveExpiredServices(cacheKey, mClock.elapsedRealtime());
         }
         return mCachedServices.containsKey(cacheKey)
                 ? Collections.unmodifiableList(
-                        cachedServicesToResponses(mCachedServices.get(cacheKey)))
+                        cachedServicesToResponses(mCachedServices.get(cacheKey),
+                                excludeExpiredServices))
                 : Collections.emptyList();
     }
 
@@ -194,7 +198,8 @@ public class MdnsServiceCache {
      * @return the service which matches given conditions.
      */
     @Nullable
-    public MdnsResponse getCachedService(@NonNull String serviceName, @NonNull CacheKey cacheKey) {
+    public MdnsResponse getCachedService(@NonNull String serviceName, @NonNull CacheKey cacheKey,
+            boolean excludeExpiredServices) {
         ensureRunningOnHandlerThread(mHandler);
         if (mMdnsFeatureFlags.mIsExpiredServicesRemovalEnabled) {
             maybeRemoveExpiredServices(cacheKey, mClock.elapsedRealtime());
@@ -204,7 +209,8 @@ public class MdnsServiceCache {
             return null;
         }
         final CachedService cachedService = findMatchedCachedService(cachedServices, serviceName);
-        return cachedService != null ? new MdnsResponse(cachedService.mService) : null;
+        return cachedService != null && !(excludeExpiredServices && cachedService.mServiceExpired)
+                ? new MdnsResponse(cachedService.mService) : null;
     }
 
     static void insertServiceAndSortList(
@@ -438,6 +444,37 @@ public class MdnsServiceCache {
                 ? cachedService.mFirstQueryTimeAfterLastUpdate : NEVER_SENT_QUERY;
     }
 
+    /**
+     * Check for expired services and mark them if their TTL has expired.
+     *
+     * @param cacheKey the target CacheKey.
+     * @param now      current time.
+     * @return the number of services marked as expired.
+     */
+    @VisibleForTesting
+    int markExpiredServices(@NonNull CacheKey cacheKey, long now) {
+        ensureRunningOnHandlerThread(mHandler);
+        final List<CachedService> cachedServices = mCachedServices.get(cacheKey);
+        if (cachedServices == null) {
+            // No such services.
+            return 0;
+        }
+
+        int count = 0;
+        for (CachedService cachedService : cachedServices) {
+            if (cachedService.mServiceExpired) continue;
+            if (!cachedService.mService.hasServiceRecord()
+                    || cachedService.mService.getMinRemainingTtl(now) > 0) {
+                // The responses are sorted by the service record ttl time. Break out of loop
+                // early if service is not expired or no service record.
+                break;
+            }
+            cachedService.mServiceExpired = true;
+            count++;
+        }
+        return count;
+    }
+
     /**
      * Dump ServiceCache state.
      */
diff --git a/service-t/src/com/android/server/connectivity/mdns/MdnsServiceTypeClient.java b/service-t/src/com/android/server/connectivity/mdns/MdnsServiceTypeClient.java
index 7c8a2edd1b..3f1b30024b 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MdnsServiceTypeClient.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MdnsServiceTypeClient.java
@@ -349,7 +349,8 @@ public class MdnsServiceTypeClient {
 
     private List<MdnsResponse> getExistingServices() {
         return featureFlags.isQueryWithKnownAnswerEnabled()
-                ? serviceCache.getCachedServices(cacheKey) : Collections.emptyList();
+                ? serviceCache.getCachedServices(cacheKey, true /* excludeExpiredServices */)
+                : Collections.emptyList();
     }
 
     private void setDelayedTask(ScheduledQueryTaskArgs args, long timeToNextTaskMs) {
@@ -377,7 +378,8 @@ public class MdnsServiceTypeClient {
         final ListenerInfo listenerInfo = new ListenerInfo(searchOptions, existingInfo);
         listeners.put(listener, listenerInfo);
         if (existingInfo == null) {
-            for (MdnsResponse existingResponse : serviceCache.getCachedServices(cacheKey)) {
+            for (MdnsResponse existingResponse : serviceCache.getCachedServices(
+                    cacheKey, true /* excludeExpiredServices */)) {
                 if (!responseMatchesInstanceNameAndSubtypes(existingResponse,
                         searchOptions.getResolveInstanceName(), searchOptions.getSubtypes())) {
                     continue;
@@ -504,7 +506,9 @@ public class MdnsServiceTypeClient {
         ensureRunningOnHandlerThread(handler);
         // Augment the list of current known responses, and generated responses for resolve
         // requests if there is no known response
-        final List<MdnsResponse> cachedList = serviceCache.getCachedServices(cacheKey);
+        // Expired services are also needed because the response may include them.
+        final List<MdnsResponse> cachedList = serviceCache.getCachedServices(
+                cacheKey, false /* excludeExpiredServices */);
         final List<MdnsResponse> currentList = new ArrayList<>(cachedList);
         List<MdnsResponse> additionalResponses = makeResponsesForResolve(socketKey);
         for (MdnsResponse additionalResponse : additionalResponses) {
@@ -598,7 +602,8 @@ public class MdnsServiceTypeClient {
     /** Notify all services are removed because the socket is destroyed. */
     public void notifySocketDestroyed() {
         ensureRunningOnHandlerThread(handler);
-        for (MdnsResponse response : serviceCache.getCachedServices(cacheKey)) {
+        for (MdnsResponse response : serviceCache.getCachedServices(
+                cacheKey, false /* excludeExpiredServices */)) {
             final String name = response.getServiceInstanceName();
             if (name == null) continue;
             notifyRemovedServiceToListeners(response, "Socket destroyed");
@@ -608,8 +613,8 @@ public class MdnsServiceTypeClient {
 
     private void onResponseModified(@NonNull MdnsResponse response) {
         final String serviceInstanceName = response.getServiceInstanceName();
-        final MdnsResponse currentResponse =
-                serviceCache.getCachedService(serviceInstanceName, cacheKey);
+        final MdnsResponse currentResponse = serviceCache.getCachedService(serviceInstanceName,
+                cacheKey, false /* excludeExpiredServices */);
 
         final boolean newInCache = currentResponse == null;
         boolean serviceBecomesComplete = false;
@@ -688,8 +693,12 @@ public class MdnsServiceTypeClient {
                     r -> DnsUtils.equalsIgnoreDnsCase(resolveName, r.getServiceInstanceName()))) {
                 continue;
             }
-            MdnsResponse knownResponse =
-                    serviceCache.getCachedService(resolveName, cacheKey);
+            // The "knownResponse" is used by the query to understand what information the cache
+            // already holds, allowing it to determine which records need to be renewed. Therefore,
+            // expired services should always be included in the returned responses to ensure all
+            // their records are renewed.
+            MdnsResponse knownResponse = serviceCache.getCachedService(
+                    resolveName, cacheKey, false /* excludeExpiredServices */);
             if (knownResponse == null) {
                 final ArrayList<String> instanceFullName = new ArrayList<>(
                         serviceTypeLabels.length + 1);
@@ -718,7 +727,8 @@ public class MdnsServiceTypeClient {
     private void tryRemoveServiceAfterTtlExpires() {
         if (!shouldRemoveServiceAfterTtlExpires()) return;
 
-        final Iterator<MdnsResponse> iter = serviceCache.getCachedServices(cacheKey).iterator();
+        final Iterator<MdnsResponse> iter = serviceCache.getCachedServices(
+                cacheKey, false /* excludeExpiredServices */).iterator();
         while (iter.hasNext()) {
             MdnsResponse existingResponse = iter.next();
             if (existingResponse.hasServiceRecord()
@@ -818,7 +828,8 @@ public class MdnsServiceTypeClient {
 
     private long getMinRemainingTtl(long now) {
         long minRemainingTtl = Long.MAX_VALUE;
-        for (MdnsResponse response : serviceCache.getCachedServices(cacheKey)) {
+        for (MdnsResponse response : serviceCache.getCachedServices(
+                cacheKey, false /* excludeExpiredServices */)) {
             if (!response.isComplete()) {
                 continue;
             }
diff --git a/tests/unit/java/com/android/server/connectivity/mdns/MdnsServiceCacheTest.kt b/tests/unit/java/com/android/server/connectivity/mdns/MdnsServiceCacheTest.kt
index e5ed862171..ae55c10c38 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/MdnsServiceCacheTest.kt
+++ b/tests/unit/java/com/android/server/connectivity/mdns/MdnsServiceCacheTest.kt
@@ -139,15 +139,19 @@ class MdnsServiceCacheTest {
     private fun getService(
             serviceCache: MdnsServiceCache,
             serviceName: String,
-            cacheKey: CacheKey
+            cacheKey: CacheKey,
+            excludeExpiredService: Boolean = true,
     ): MdnsResponse? = runningOnHandlerAndReturn {
-        serviceCache.getCachedService(serviceName, cacheKey)
+        serviceCache.getCachedService(serviceName, cacheKey, excludeExpiredService)
     }
 
     private fun getServices(
             serviceCache: MdnsServiceCache,
-            cacheKey: CacheKey
-    ): List<MdnsResponse> = runningOnHandlerAndReturn { serviceCache.getCachedServices(cacheKey) }
+            cacheKey: CacheKey,
+            excludeExpiredService: Boolean = true,
+    ): List<MdnsResponse> = runningOnHandlerAndReturn {
+        serviceCache.getCachedServices(cacheKey, excludeExpiredService)
+    }
 
     private fun registerServiceExpiredCallback(
             serviceCache: MdnsServiceCache,
@@ -185,6 +189,14 @@ class MdnsServiceCacheTest {
         )
     }
 
+    private fun markExpiredServices(
+            serviceCache: MdnsServiceCache,
+            cacheKey: CacheKey,
+            currentTime: Long
+    ): Int = runningOnHandlerAndReturn {
+        serviceCache.markExpiredServices(cacheKey, currentTime)
+    }
+
     @Test
     fun testAddAndRemoveService() {
         val serviceCache = MdnsServiceCache(thread.looper, makeFlags(), clock)
@@ -351,35 +363,42 @@ class MdnsServiceCacheTest {
         assertEquals(service4, services[3])
     }
 
+    private fun verifyGetServices(
+            serviceCache: MdnsServiceCache,
+            cacheKey: CacheKey,
+            excludeExpiredService: Boolean,
+            vararg serviceInstanceNames: String
+    ) {
+        val responses = getServices(serviceCache, cacheKey, excludeExpiredService)
+        assertEquals(serviceInstanceNames.size, responses.size)
+        for (serviceInstanceName: String in serviceInstanceNames) {
+            assertTrue(responses.stream().anyMatch { response ->
+                response.serviceInstanceName == serviceInstanceName
+            })
+        }
+    }
+
     @Test
     fun testRemoveServices() {
         val serviceCache = MdnsServiceCache(thread.looper, makeFlags(), clock)
         addOrUpdateService(serviceCache, cacheKey1, createResponse(SERVICE_NAME_1, SERVICE_TYPE_1))
         addOrUpdateService(serviceCache, cacheKey1, createResponse(SERVICE_NAME_2, SERVICE_TYPE_1))
         addOrUpdateService(serviceCache, cacheKey2, createResponse(SERVICE_NAME_1, SERVICE_TYPE_2))
-        val responses1 = getServices(serviceCache, cacheKey1)
-        assertEquals(2, responses1.size)
-        assertTrue(responses1.stream().anyMatch { response ->
-            response.serviceInstanceName == SERVICE_NAME_1
-        })
-        assertTrue(responses1.any { response ->
-            response.serviceInstanceName == SERVICE_NAME_2
-        })
-        val responses2 = getServices(serviceCache, cacheKey2)
-        assertEquals(1, responses2.size)
-        assertTrue(responses2.stream().anyMatch { response ->
-            response.serviceInstanceName == SERVICE_NAME_1
-        })
+        verifyGetServices(
+                serviceCache,
+                cacheKey1,
+                excludeExpiredService = true,
+                SERVICE_NAME_1,
+                SERVICE_NAME_2
+        )
+        verifyGetServices(serviceCache, cacheKey2, excludeExpiredService = true, SERVICE_NAME_1)
 
         removeServices(serviceCache, cacheKey1)
-        val responses3 = getServices(serviceCache, cacheKey1)
-        assertEquals(0, responses3.size)
-        val responses4 = getServices(serviceCache, cacheKey2)
-        assertEquals(1, responses4.size)
+        verifyGetServices(serviceCache, cacheKey1, excludeExpiredService = true)
+        verifyGetServices(serviceCache, cacheKey2, excludeExpiredService = true, SERVICE_NAME_1)
 
         removeServices(serviceCache, cacheKey2)
-        val responses5 = getServices(serviceCache, cacheKey2)
-        assertEquals(0, responses5.size)
+        verifyGetServices(serviceCache, cacheKey2, excludeExpiredService = true)
     }
 
     @Test
@@ -480,6 +499,71 @@ class MdnsServiceCacheTest {
         )
     }
 
+    @Test
+    fun testGetExpiredServices() {
+        val serviceCache = MdnsServiceCache(thread.looper, makeFlags(), clock)
+
+        // Add services
+        doReturn(TEST_ELAPSED_REALTIME_MS).`when`(clock).elapsedRealtime()
+        addOrUpdateService(
+                serviceCache,
+                cacheKey1,
+                createResponse(SERVICE_NAME_1, SERVICE_TYPE_1, 1L /* ttlTime */)
+        )
+        addOrUpdateService(
+                serviceCache,
+                cacheKey1,
+                createResponse(SERVICE_NAME_2, SERVICE_TYPE_1, 11L /* ttlTime */)
+        )
+        verifyGetServices(
+                serviceCache,
+                cacheKey1,
+                excludeExpiredService = true,
+                SERVICE_NAME_1,
+                SERVICE_NAME_2
+        )
+        var response =
+                getService(serviceCache, SERVICE_NAME_1, cacheKey1, excludeExpiredService = true)
+        assertNotNull(response)
+        assertEquals(SERVICE_NAME_1, response.serviceInstanceName)
+
+        // Mark the SERVICE_NAME_1 service expired
+        assertEquals(
+            1,
+            markExpiredServices(
+                serviceCache,
+                cacheKey1,
+                currentTime = TEST_ELAPSED_REALTIME_MS + 5L
+            )
+        )
+        // Verify that expired services have been excluded
+        verifyGetServices(
+                serviceCache,
+                cacheKey1,
+                excludeExpiredService = true,
+                SERVICE_NAME_2
+        )
+        response = getService(serviceCache, SERVICE_NAME_1, cacheKey1, excludeExpiredService = true)
+        assertNull(response)
+
+        // Verify that expired services can still be retrieved.
+        verifyGetServices(
+                serviceCache,
+                cacheKey1,
+                excludeExpiredService = false,
+                SERVICE_NAME_1,
+                SERVICE_NAME_2
+        )
+        response = getService(
+                serviceCache,
+                SERVICE_NAME_1,
+                cacheKey1,
+                excludeExpiredService = false
+        )
+        assertNotNull(response)
+        assertEquals(SERVICE_NAME_1, response.serviceInstanceName)
+    }
+
     private fun createResponse(
             serviceInstanceName: String,
             serviceType: String,

From 1fd85ef1db2551d4213ef23d32cd09797c70f66f Mon Sep 17 00:00:00 2001
From: Paul Hu <paulhu@google.com>
Date: Wed, 12 Mar 2025 09:17:12 +0000
Subject: [PATCH 064/377] Optimized Expired Service Removal

This commit introduces a new feature to optimize the removal of
expired services. After the query is sent, a task is scheduled
with a 2-second delay to wait for responses. During this delay,
if a service response is received, the service information is
updated, and the service is removed from the removal list. After
the delay, services that are expired, have sent a query, and for
which the query time was 2 seconds ago are removed, and listeners
are notified.

Bug: 387910548
Test: atest ConnectivityCoverageTests NsdManagerTest
Flag: EXEMPT legacy flag nsd_optimized_expired_service_removal
Change-Id: I498747839664eed8fe5b73a6f6d002deb9167271
---
 .../connectivity/mdns/MdnsFeatureFlags.java   |  34 ++++
 .../connectivity/mdns/MdnsServiceCache.java   | 107 +++++++-----
 .../mdns/MdnsServiceTypeClient.java           |  55 ++++--
 .../connectivity/mdns/MdnsServiceCacheTest.kt | 161 +++++++++++-------
 .../mdns/MdnsServiceTypeClientTests.java      |  78 ++++++++-
 5 files changed, 313 insertions(+), 122 deletions(-)

diff --git a/service-t/src/com/android/server/connectivity/mdns/MdnsFeatureFlags.java b/service-t/src/com/android/server/connectivity/mdns/MdnsFeatureFlags.java
index 31acab2904..546e508b8b 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MdnsFeatureFlags.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MdnsFeatureFlags.java
@@ -109,6 +109,12 @@ public class MdnsFeatureFlags {
      */
     public static final String NSD_ACCURATE_DELAY_CALLBACK = "nsd_accurate_delay_callback";
 
+    /**
+     * A feature flag to control whether the optimized expired service removal should be enabled.
+     */
+    public static final String NSD_OPTIMIZED_EXPIRED_SERVICE_REMOVAL =
+            "nsd_optimized_expired_service_removal";
+
     // Flag for offload feature
     public final boolean mIsMdnsOffloadFeatureEnabled;
 
@@ -155,6 +161,9 @@ public class MdnsFeatureFlags {
     // rrclass is received
     public final boolean mIsCacheFlushPerAddressTypeEnabled;
 
+    // Flag for optimized expired service removal
+    public final boolean mIsOptimizedExpiredServiceRemovalEnabled;
+
     @Nullable
     private final FlagOverrideProvider mOverrideProvider;
 
@@ -262,6 +271,15 @@ public class MdnsFeatureFlags {
                 || isForceEnabledForTest(NSD_ACCURATE_DELAY_CALLBACK);
     }
 
+    /**
+     * Indicates whether {@link #NSD_OPTIMIZED_EXPIRED_SERVICE_REMOVAL} is enabled, including for
+     * testing.
+     */
+    public boolean isOptimizedExpiredServiceRemovalEnabled() {
+        return mIsOptimizedExpiredServiceRemovalEnabled
+                || isForceEnabledForTest(NSD_OPTIMIZED_EXPIRED_SERVICE_REMOVAL);
+    }
+
     /**
      * The constructor for {@link MdnsFeatureFlags}.
      */
@@ -280,6 +298,7 @@ public class MdnsFeatureFlags {
             boolean isShortHostnamesEnabled,
             boolean isSocketClientNetworkGuessingEnabled,
             boolean isCacheFlushPerAddressTypeEnabled,
+            boolean isOptimizedExpiredServiceRemovalEnabled,
             @Nullable FlagOverrideProvider overrideProvider) {
         mIsMdnsOffloadFeatureEnabled = isOffloadFeatureEnabled;
         mIncludeInetAddressRecordsInProbing = includeInetAddressRecordsInProbing;
@@ -296,6 +315,7 @@ public class MdnsFeatureFlags {
         mIsShortHostnamesEnabled = isShortHostnamesEnabled;
         mIsSocketClientNetworkGuessingEnabled = isSocketClientNetworkGuessingEnabled;
         mIsCacheFlushPerAddressTypeEnabled = isCacheFlushPerAddressTypeEnabled;
+        mIsOptimizedExpiredServiceRemovalEnabled = isOptimizedExpiredServiceRemovalEnabled;
         mOverrideProvider = overrideProvider;
     }
 
@@ -323,6 +343,7 @@ public class MdnsFeatureFlags {
         private boolean mIsShortHostnamesEnabled;
         private boolean mIsSocketClientNetworkGuessingEnabled;
         private boolean mIsCacheFlushPerAddressTypeEnabled;
+        private boolean mIsOptimizedExpiredServiceRemovalEnabled;
         private FlagOverrideProvider mOverrideProvider;
 
         /**
@@ -344,6 +365,7 @@ public class MdnsFeatureFlags {
             mIsShortHostnamesEnabled = true; // Default enabled.
             mIsSocketClientNetworkGuessingEnabled = false;
             mIsCacheFlushPerAddressTypeEnabled = true; // Default enabled.
+            mIsOptimizedExpiredServiceRemovalEnabled = false;
             mOverrideProvider = null;
         }
 
@@ -509,6 +531,17 @@ public class MdnsFeatureFlags {
             return this;
         }
 
+        /**
+         * Set whether the optimized expired service removal is enabled.
+         *
+         * @see #NSD_OPTIMIZED_EXPIRED_SERVICE_REMOVAL
+         */
+        public Builder setIsOptimizedExpiredServiceRemovalEnabled(
+                boolean isOptimizedExpiredServiceRemovalEnabled) {
+            mIsOptimizedExpiredServiceRemovalEnabled = isOptimizedExpiredServiceRemovalEnabled;
+            return this;
+        }
+
         /**
          * Builds a {@link MdnsFeatureFlags} with the arguments supplied to this builder.
          */
@@ -528,6 +561,7 @@ public class MdnsFeatureFlags {
                     mIsShortHostnamesEnabled,
                     mIsSocketClientNetworkGuessingEnabled,
                     mIsCacheFlushPerAddressTypeEnabled,
+                    mIsOptimizedExpiredServiceRemovalEnabled,
                     mOverrideProvider);
         }
     }
diff --git a/service-t/src/com/android/server/connectivity/mdns/MdnsServiceCache.java b/service-t/src/com/android/server/connectivity/mdns/MdnsServiceCache.java
index fbfef017c7..dc0dbeba87 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MdnsServiceCache.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MdnsServiceCache.java
@@ -20,6 +20,7 @@ import static com.android.net.module.util.DnsUtils.equalsIgnoreDnsCase;
 import static com.android.net.module.util.DnsUtils.toDnsUpperCase;
 import static com.android.net.module.util.HandlerUtils.ensureRunningOnHandlerThread;
 import static com.android.server.connectivity.mdns.MdnsResponse.EXPIRATION_NEVER;
+import static com.android.server.connectivity.mdns.MdnsServiceTypeClient.REMOVE_SERVICE_AFTER_QUERY_SENT_TIME;
 import static com.android.server.connectivity.mdns.util.MdnsUtils.responseMatchesInstanceNameAndSubtypes;
 
 import static java.lang.Math.min;
@@ -31,6 +32,7 @@ import android.os.Looper;
 import android.util.ArrayMap;
 
 import com.android.internal.annotations.VisibleForTesting;
+import com.android.net.module.util.CollectionUtils;
 import com.android.server.connectivity.mdns.util.MdnsUtils;
 
 import java.io.PrintWriter;
@@ -96,6 +98,12 @@ public class MdnsServiceCache {
             mServiceExpired = false;
             mFirstQueryTimeAfterLastUpdate = NEVER_SENT_QUERY;
         }
+
+        boolean isServiceQueriedAfterLastUpdate(long now) {
+            return mFirstQueryTimeAfterLastUpdate != NEVER_SENT_QUERY
+                    && (now - mFirstQueryTimeAfterLastUpdate)
+                    >= REMOVE_SERVICE_AFTER_QUERY_SENT_TIME;
+        }
     }
 
     /**
@@ -336,8 +344,8 @@ public class MdnsServiceCache {
         mHandler.post(()-> callback.onServiceRecordExpired(previousResponse, newResponse));
     }
 
-    static List<CachedService> removeExpiredServices(@NonNull List<CachedService> cachedServices,
-            long now) {
+    private List<CachedService> removeExpiredServices(@NonNull List<CachedService> cachedServices,
+            long now, boolean removeOnlyIfQuerySent) {
         final List<CachedService> removedServices = new ArrayList<>();
         final Iterator<CachedService> iterator = cachedServices.iterator();
         while (iterator.hasNext()) {
@@ -350,46 +358,71 @@ public class MdnsServiceCache {
                 // early if service is not expired or no service record.
                 break;
             }
+            if (removeOnlyIfQuerySent) {
+                // Set service is expired.
+                cachedService.mServiceExpired = true;
+                // Skip removal if no query sent for this expired service.
+                if (!cachedService.isServiceQueriedAfterLastUpdate(now)) {
+                    continue;
+                }
+            }
             // Remove the ttl expired service.
             iterator.remove();
             removedServices.add(cachedService);
         }
+
+        // Update next expiration time.
+        mNextExpirationTime = getNextExpirationTime(now);
+
         return removedServices;
     }
 
+    /**
+     * Calculates the absolute timestamp for the next service expiration based on cached services.
+     *
+     * If the cache is empty or if all cached services are already expired, this method returns
+     * {@code EXPIRATION_NEVER}.
+     *
+     * @param now The current time.
+     * @return The absolute timestamp when the next service is expected to expire, or
+     *         {@code EXPIRATION_NEVER} if no non-expired services are found in the cache.
+     */
     private long getNextExpirationTime(long now) {
+        ensureRunningOnHandlerThread(mHandler);
         if (mCachedServices.isEmpty()) {
             return EXPIRATION_NEVER;
         }
 
         long minRemainingTtl = EXPIRATION_NEVER;
         for (int i = 0; i < mCachedServices.size(); i++) {
+            final List<CachedService> services = mCachedServices.valueAt(i);
+            final int index = CollectionUtils.indexOf(
+                    services, service -> !service.mServiceExpired);
+            if (index == -1) continue;
             minRemainingTtl = min(minRemainingTtl,
-                    // The empty lists are not kept in the map, so there's always at least one
-                    // element in the list. Therefore, it's fine to get the first element without a
-                    // null check.
-                    mCachedServices.valueAt(i).get(0).mService.getMinRemainingTtl(now));
+                    services.get(index).mService.getMinRemainingTtl(now));
         }
         return minRemainingTtl == EXPIRATION_NEVER ? EXPIRATION_NEVER : now + minRemainingTtl;
     }
 
     /**
-     * Check whether the ttl time is expired on each service and notify to the listeners
+     * Check for expired services, remove them if they meet the removal criteria, and notify
+     * listeners.
+     *
+     * @param cacheKey the target CacheKey.
+     * @param now current time
      */
-    private void maybeRemoveExpiredServices(CacheKey cacheKey, long now) {
+    public void removeExpiredServicesAndNotifyListeners(CacheKey cacheKey, long now) {
         ensureRunningOnHandlerThread(mHandler);
-        if (now < mNextExpirationTime) {
-            // Skip the check if ttl time is not expired.
-            return;
-        }
-
         final List<CachedService> cachedServices = mCachedServices.get(cacheKey);
         if (cachedServices == null) {
             // No such services.
             return;
         }
 
-        final List<CachedService> removedServices = removeExpiredServices(cachedServices, now);
+        final List<CachedService> removedServices = removeExpiredServices(
+                cachedServices, now, mMdnsFeatureFlags.mIsOptimizedExpiredServiceRemovalEnabled);
+
         if (removedServices.isEmpty()) {
             // No expired services.
             return;
@@ -403,9 +436,19 @@ public class MdnsServiceCache {
         if (cachedServices.isEmpty()) {
             mCachedServices.remove(cacheKey);
         }
+    }
 
-        // Update next expiration time.
-        mNextExpirationTime = getNextExpirationTime(now);
+    /**
+     * Check whether the ttl time is expired on each service and notify to the listeners
+     */
+    private void maybeRemoveExpiredServices(CacheKey cacheKey, long now) {
+        ensureRunningOnHandlerThread(mHandler);
+        if (now < mNextExpirationTime) {
+            // Skip the check if ttl time is not expired.
+            return;
+        }
+
+        removeExpiredServicesAndNotifyListeners(cacheKey, now);
     }
 
     /**
@@ -445,34 +488,16 @@ public class MdnsServiceCache {
     }
 
     /**
-     * Check for expired services and mark them if their TTL has expired.
+     * Retrieve the current expiration time.
+     * <p>
+     * NOTE: This method exposes internal state ({@code mNextExpirationTime}) for testing purposes.
+     * It should not be used in production code.
      *
-     * @param cacheKey the target CacheKey.
-     * @param now      current time.
-     * @return the number of services marked as expired.
+     * @return The expiration time.
      */
     @VisibleForTesting
-    int markExpiredServices(@NonNull CacheKey cacheKey, long now) {
-        ensureRunningOnHandlerThread(mHandler);
-        final List<CachedService> cachedServices = mCachedServices.get(cacheKey);
-        if (cachedServices == null) {
-            // No such services.
-            return 0;
-        }
-
-        int count = 0;
-        for (CachedService cachedService : cachedServices) {
-            if (cachedService.mServiceExpired) continue;
-            if (!cachedService.mService.hasServiceRecord()
-                    || cachedService.mService.getMinRemainingTtl(now) > 0) {
-                // The responses are sorted by the service record ttl time. Break out of loop
-                // early if service is not expired or no service record.
-                break;
-            }
-            cachedService.mServiceExpired = true;
-            count++;
-        }
-        return count;
+    long getCurrentExpiredTime() {
+        return mNextExpirationTime;
     }
 
     /**
diff --git a/service-t/src/com/android/server/connectivity/mdns/MdnsServiceTypeClient.java b/service-t/src/com/android/server/connectivity/mdns/MdnsServiceTypeClient.java
index 3f1b30024b..97a5ec1c96 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MdnsServiceTypeClient.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MdnsServiceTypeClient.java
@@ -65,7 +65,9 @@ public class MdnsServiceTypeClient {
     @VisibleForTesting
     static final int EVENT_START_QUERYTASK = 1;
     static final int EVENT_QUERY_RESULT = 2;
+    static final int EVENT_REMOVE_EXPIRED_SERVICES = 3;
     static final int INVALID_TRANSACTION_ID = -1;
+    static final long REMOVE_SERVICE_AFTER_QUERY_SENT_TIME = 2000L;
 
     private final String serviceType;
     private final String[] serviceTypeLabels;
@@ -173,7 +175,10 @@ public class MdnsServiceTypeClient {
                         }
                     }
 
-                    tryRemoveServiceAfterTtlExpires();
+                    if (!featureFlags.mIsOptimizedExpiredServiceRemovalEnabled) {
+                        tryRemoveServiceAfterTtlExpires();
+                    }
+
 
                     final long now = clock.elapsedRealtime();
                     lastSentTime = now;
@@ -201,22 +206,44 @@ public class MdnsServiceTypeClient {
                                 handler.obtainMessage(EVENT_START_QUERYTASK, args),
                                 timeToNextTaskMs);
                     }
-                    // Update the first query time based on the query result
-                    if (sentResult.queriedBaseType) {
-                        serviceCache.updateFirstQueryTimeForCachedServices(null /* serviceName */,
-                                Collections.emptyList() /* subtypes */, cacheKey, now);
-                    }
-                    if (sentResult.queriedSubtypes.size() != 0) {
-                        serviceCache.updateFirstQueryTimeForCachedServices(null /* serviceName */,
-                                sentResult.queriedSubtypes, cacheKey, now);
-                    }
-                    for (MdnsResponse service : sentResult.resolvedServices) {
-                        serviceCache.updateFirstQueryTimeForCachedServices(
-                                service.getServiceInstanceName(),
-                                Collections.emptyList() /* subtypes */, cacheKey, now);
+                    if (featureFlags.mIsOptimizedExpiredServiceRemovalEnabled) {
+                        // Update the first query time based on the query result
+                        if (sentResult.queriedBaseType) {
+                            serviceCache.updateFirstQueryTimeForCachedServices(
+                                    null /* serviceName */,
+                                    Collections.emptyList() /* subtypes */, cacheKey, now);
+                        }
+                        if (sentResult.queriedSubtypes.size() != 0) {
+                            serviceCache.updateFirstQueryTimeForCachedServices(
+                                    null /* serviceName */,
+                                    sentResult.queriedSubtypes, cacheKey, now);
+                        }
+                        for (MdnsResponse service : sentResult.resolvedServices) {
+                            serviceCache.updateFirstQueryTimeForCachedServices(
+                                    service.getServiceInstanceName(),
+                                    Collections.emptyList() /* subtypes */, cacheKey, now);
+                        }
+
+                        // A query is sent. Schedule a task with a delay to wait for responses, and
+                        // then remove expired services, and notify listeners.
+                        if (scheduler != null) {
+                            scheduler.sendDelayedMessage(
+                                    handler.obtainMessage(EVENT_REMOVE_EXPIRED_SERVICES),
+                                    REMOVE_SERVICE_AFTER_QUERY_SENT_TIME);
+                        } else {
+                            dependencies.sendMessageDelayed(
+                                    handler,
+                                    handler.obtainMessage(EVENT_REMOVE_EXPIRED_SERVICES),
+                                    REMOVE_SERVICE_AFTER_QUERY_SENT_TIME);
+                        }
                     }
                     break;
                 }
+                case EVENT_REMOVE_EXPIRED_SERVICES: {
+                    serviceCache.removeExpiredServicesAndNotifyListeners(
+                            cacheKey, clock.elapsedRealtime());
+                    break;
+                }
                 default:
                     sharedLog.e("Unrecognized event " + msg.what);
                     break;
diff --git a/tests/unit/java/com/android/server/connectivity/mdns/MdnsServiceCacheTest.kt b/tests/unit/java/com/android/server/connectivity/mdns/MdnsServiceCacheTest.kt
index ae55c10c38..40065c1a6d 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/MdnsServiceCacheTest.kt
+++ b/tests/unit/java/com/android/server/connectivity/mdns/MdnsServiceCacheTest.kt
@@ -21,6 +21,7 @@ import android.os.Handler
 import android.os.HandlerThread
 import com.android.net.module.util.ArrayTrackRecord
 import com.android.net.module.util.CollectionUtils
+import com.android.server.connectivity.mdns.MdnsResponse.EXPIRATION_NEVER
 import com.android.server.connectivity.mdns.MdnsServiceCache.CacheKey
 import com.android.server.connectivity.mdns.MdnsServiceCache.CachedService
 import com.android.server.connectivity.mdns.MdnsServiceCache.NEVER_SENT_QUERY
@@ -111,10 +112,13 @@ class MdnsServiceCacheTest {
         thread.join()
     }
 
-    private fun makeFlags(isExpiredServicesRemovalEnabled: Boolean = false) =
-            MdnsFeatureFlags.Builder()
-                    .setIsExpiredServicesRemovalEnabled(isExpiredServicesRemovalEnabled)
-                    .build()
+    private fun makeFlags(
+            isExpiredServicesRemovalEnabled: Boolean = false,
+            isOptimizedExpiredServiceRemovalEnabled: Boolean = false
+    ) = MdnsFeatureFlags.Builder()
+            .setIsExpiredServicesRemovalEnabled(isExpiredServicesRemovalEnabled)
+            .setIsOptimizedExpiredServiceRemovalEnabled(isOptimizedExpiredServiceRemovalEnabled)
+            .build()
 
     private fun <T> runningOnHandlerAndReturn(functor: (() -> T)): T {
         val future = CompletableFuture<T>()
@@ -189,12 +193,12 @@ class MdnsServiceCacheTest {
         )
     }
 
-    private fun markExpiredServices(
+    private fun removeExpiredServicesAndNotifyListeners(
             serviceCache: MdnsServiceCache,
             cacheKey: CacheKey,
             currentTime: Long
-    ): Int = runningOnHandlerAndReturn {
-        serviceCache.markExpiredServices(cacheKey, currentTime)
+    ): Unit = runningOnHandlerAndReturn {
+        serviceCache.removeExpiredServicesAndNotifyListeners(cacheKey, currentTime)
     }
 
     @Test
@@ -500,74 +504,103 @@ class MdnsServiceCacheTest {
     }
 
     @Test
-    fun testGetExpiredServices() {
-        val serviceCache = MdnsServiceCache(thread.looper, makeFlags(), clock)
+    fun testRemoveExpiredServiceAfterQuerySent() {
+        val serviceCache = MdnsServiceCache(
+                thread.looper,
+                makeFlags(
+                        isExpiredServicesRemovalEnabled = true,
+                        isOptimizedExpiredServiceRemovalEnabled = true
+                ),
+                clock
+        )
+        var currentTime = TEST_ELAPSED_REALTIME_MS
 
-        // Add services
-        doReturn(TEST_ELAPSED_REALTIME_MS).`when`(clock).elapsedRealtime()
-        addOrUpdateService(
-                serviceCache,
-                cacheKey1,
-                createResponse(SERVICE_NAME_1, SERVICE_TYPE_1, 1L /* ttlTime */)
-        )
-        addOrUpdateService(
-                serviceCache,
-                cacheKey1,
-                createResponse(SERVICE_NAME_2, SERVICE_TYPE_1, 11L /* ttlTime */)
-        )
-        verifyGetServices(
-                serviceCache,
-                cacheKey1,
-                excludeExpiredService = true,
-                SERVICE_NAME_1,
-                SERVICE_NAME_2
-        )
-        var response =
-                getService(serviceCache, SERVICE_NAME_1, cacheKey1, excludeExpiredService = true)
-        assertNotNull(response)
-        assertEquals(SERVICE_NAME_1, response.serviceInstanceName)
-
-        // Mark the SERVICE_NAME_1 service expired
-        assertEquals(
-            1,
-            markExpiredServices(
-                serviceCache,
-                cacheKey1,
-                currentTime = TEST_ELAPSED_REALTIME_MS + 5L
-            )
-        )
-        // Verify that expired services have been excluded
-        verifyGetServices(
-                serviceCache,
-                cacheKey1,
-                excludeExpiredService = true,
-                SERVICE_NAME_2
-        )
-        response = getService(serviceCache, SERVICE_NAME_1, cacheKey1, excludeExpiredService = true)
-        assertNull(response)
-
-        // Verify that expired services can still be retrieved.
-        verifyGetServices(
-                serviceCache,
-                cacheKey1,
-                excludeExpiredService = false,
-                SERVICE_NAME_1,
-                SERVICE_NAME_2
-        )
-        response = getService(
+        // Add a service, then advance the time to expire the service.
+        doReturn(currentTime).`when`(clock).elapsedRealtime()
+        addOrUpdateService(serviceCache, cacheKey1, createResponse(SERVICE_NAME_1, SERVICE_TYPE_1))
+        currentTime += DEFAULT_TTL_TIME_MS
+        doReturn(currentTime).`when`(clock).elapsedRealtime()
+        // No service because the service has been marked as expired
+        assertNull(getService(serviceCache, SERVICE_NAME_1, cacheKey1))
+        // Can still get the service if expired services are included.
+        assertNotNull(getService(
                 serviceCache,
                 SERVICE_NAME_1,
                 cacheKey1,
                 excludeExpiredService = false
+        ))
+
+        // Attempt to remove the expired service, but it should not be removed due to no query being
+        // sent.
+        removeExpiredServicesAndNotifyListeners(serviceCache, cacheKey1, currentTime)
+        assertNotNull(getService(
+                serviceCache,
+                SERVICE_NAME_1,
+                cacheKey1,
+                excludeExpiredService = false
+        ))
+
+        // Update the first query time and attempt to remove the expired service again after 2 sec
+        // later. It should now be removed.
+        updateFirstQueryTimeForCachedServices(
+                serviceCache,
+                SERVICE_NAME_1,
+                subtypes = emptyList(),
+                cacheKey1,
+                currentTime
         )
-        assertNotNull(response)
-        assertEquals(SERVICE_NAME_1, response.serviceInstanceName)
+        currentTime += MdnsServiceTypeClient.REMOVE_SERVICE_AFTER_QUERY_SENT_TIME
+        doReturn(currentTime).`when`(clock).elapsedRealtime()
+        removeExpiredServicesAndNotifyListeners(serviceCache, cacheKey1, currentTime)
+        assertNull(getService(
+                serviceCache,
+                SERVICE_NAME_1,
+                cacheKey1,
+                excludeExpiredService = false
+        ))
+    }
+
+    @Test
+    fun testGetNextExpirationTime() {
+        val serviceCache = MdnsServiceCache(
+                thread.looper,
+                makeFlags(
+                        isExpiredServicesRemovalEnabled = true,
+                        isOptimizedExpiredServiceRemovalEnabled = true
+                ),
+                clock
+        )
+        var currentTime = TEST_ELAPSED_REALTIME_MS
+        assertEquals(EXPIRATION_NEVER, serviceCache.currentExpiredTime)
+
+        doReturn(currentTime).`when`(clock).elapsedRealtime()
+        addOrUpdateService(
+                serviceCache,
+                cacheKey1,
+                createResponse(SERVICE_NAME_1, SERVICE_TYPE_1, ttlTime = 30000L)
+        )
+        addOrUpdateService(
+                serviceCache,
+                cacheKey1,
+                createResponse(SERVICE_NAME_2, SERVICE_TYPE_1, ttlTime = 60000L)
+        )
+        assertEquals(TEST_ELAPSED_REALTIME_MS + 30000L, serviceCache.currentExpiredTime)
+
+        currentTime += 45000L
+        doReturn(currentTime).`when`(clock).elapsedRealtime()
+        removeExpiredServicesAndNotifyListeners(serviceCache, cacheKey1, currentTime)
+        assertEquals(TEST_ELAPSED_REALTIME_MS + 60000L, serviceCache.currentExpiredTime)
+
+        currentTime += 100000L
+        doReturn(currentTime).`when`(clock).elapsedRealtime()
+        removeExpiredServicesAndNotifyListeners(serviceCache, cacheKey1, currentTime)
+        assertEquals(EXPIRATION_NEVER, serviceCache.currentExpiredTime)
     }
 
     private fun createResponse(
             serviceInstanceName: String,
             serviceType: String,
-            ttlTime: Long = 120000L,
+            ttlTime: Long = DEFAULT_TTL_TIME_MS,
             subType: String? = null
     ): MdnsResponse {
         val serviceTypeArray = if (subType != null) {
diff --git a/tests/unit/java/com/android/server/connectivity/mdns/MdnsServiceTypeClientTests.java b/tests/unit/java/com/android/server/connectivity/mdns/MdnsServiceTypeClientTests.java
index b9c0d2f7ca..a893f03a51 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/MdnsServiceTypeClientTests.java
+++ b/tests/unit/java/com/android/server/connectivity/mdns/MdnsServiceTypeClientTests.java
@@ -22,7 +22,10 @@ import static com.android.server.connectivity.mdns.MdnsQueryScheduler.TIME_BETWE
 import static com.android.server.connectivity.mdns.MdnsSearchOptions.ACTIVE_QUERY_MODE;
 import static com.android.server.connectivity.mdns.MdnsSearchOptions.AGGRESSIVE_QUERY_MODE;
 import static com.android.server.connectivity.mdns.MdnsSearchOptions.PASSIVE_QUERY_MODE;
+import static com.android.server.connectivity.mdns.MdnsServiceTypeClient.EVENT_QUERY_RESULT;
+import static com.android.server.connectivity.mdns.MdnsServiceTypeClient.EVENT_REMOVE_EXPIRED_SERVICES;
 import static com.android.server.connectivity.mdns.MdnsServiceTypeClient.EVENT_START_QUERYTASK;
+import static com.android.server.connectivity.mdns.MdnsServiceTypeClient.REMOVE_SERVICE_AFTER_QUERY_SENT_TIME;
 import static com.android.testutils.DevSdkIgnoreRuleKt.SC_V2;
 
 import static org.junit.Assert.assertArrayEquals;
@@ -42,6 +45,7 @@ import static org.mockito.Mockito.doCallRealMethod;
 import static org.mockito.Mockito.doReturn;
 import static org.mockito.Mockito.inOrder;
 import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.timeout;
 import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.verifyNoMoreInteractions;
@@ -253,7 +257,10 @@ public class MdnsServiceTypeClientTests {
         }).when(mockDeps).createScheduler(any(Handler.class));
 
         doAnswer(inv -> {
-            message = (Message) inv.getArguments()[0];
+            final Message temp = (Message) inv.getArguments()[0];
+            if (temp.what == EVENT_START_QUERYTASK) {
+                message = (Message) inv.getArguments()[0];
+            }
             latestDelayMs = (long) inv.getArguments()[1];
             return null;
         }).when(mockScheduler).sendDelayedMessage(any(), anyLong());
@@ -302,6 +309,11 @@ public class MdnsServiceTypeClientTests {
         delayMessage = null;
     }
 
+    private void dispatchRealtimeSchedulerMessage() {
+        runOnHandler(() -> realHandler.dispatchMessage(message));
+        message = null;
+    }
+
     @Test
     public void sendQueries_activeScanMode() {
         MdnsSearchOptions searchOptions = MdnsSearchOptions.newBuilder()
@@ -2191,6 +2203,67 @@ public class MdnsServiceTypeClientTests {
         verify(mockScheduler).close();
     }
 
+    private void verifyQuerySentAndRemoveExpiredServices(int count) {
+        currentThreadExecutor.getAndClearLastScheduledRunnable().run();
+        verify(mockDeps, times(count)).sendMessage(
+                any(Handler.class), argThat(message -> message.what == EVENT_QUERY_RESULT));
+        verify(mockScheduler, times(count)).sendDelayedMessage(
+                argThat(message -> message.what == EVENT_REMOVE_EXPIRED_SERVICES), anyLong());
+        verify(mockScheduler, times(count)).sendDelayedMessage(
+                argThat(message -> message.what == EVENT_START_QUERYTASK), anyLong());
+    }
+
+    @Test
+    public void testExpireServiceRemovedAfterQuerySent() throws IOException {
+        final String requestedInstance = "instance1";
+        final String ipV4Address = "192.0.2.0";
+        final MdnsFeatureFlags flags = MdnsFeatureFlags.newBuilder()
+                .setIsExpiredServicesRemovalEnabled(true)
+                .setIsOptimizedExpiredServiceRemovalEnabled(true)
+                .setIsAccurateDelayCallbackEnabled(true)
+                .build();
+        serviceCache = new MdnsServiceCache(thread.getLooper(), flags, mockDecoderClock);
+        client = makeMdnsServiceTypeClient(flags);
+        startSendAndReceive(mockListenerOne,
+                MdnsSearchOptions.newBuilder().setQueryMode(AGGRESSIVE_QUERY_MODE).build());
+
+        // Sent a query
+        verifyQuerySentAndRemoveExpiredServices(1 /* count */);
+
+        // Receive a response
+        processResponse(
+                createResponse(requestedInstance, ipV4Address, 5353, SERVICE_TYPE_LABELS,
+                        Collections.emptyMap() /* textAttributes */, TEST_TTL),
+                socketKey);
+        verify(mockListenerOne).onServiceNameDiscovered(
+                matchServiceName(requestedInstance), eq(false) /* isServiceFromCache */);
+        verify(mockListenerOne).onServiceFound(
+                matchServiceName(requestedInstance), eq(false) /* isServiceFromCache */);
+
+        // Advance the time so that the service's TTL is not expired and send a query again. Attempt
+        // to remove expired services for which there should be no callback.
+        doReturn(TEST_ELAPSED_REALTIME + TEST_TTL - 1).when(mockDecoderClock).elapsedRealtime();
+        dispatchRealtimeSchedulerMessage();
+        verifyQuerySentAndRemoveExpiredServices(2 /* count */);
+        runOnHandler(() -> realHandler.dispatchMessage(
+                realHandler.obtainMessage(EVENT_REMOVE_EXPIRED_SERVICES)));
+        verify(mockListenerOne, never()).onServiceRemoved(any());
+        verify(mockListenerOne, never()).onServiceNameRemoved(any());
+
+        // Advance the time so that the service's TTL is expired, and send a query again. Attempt to
+        // remove expired services for which there should be a callback.
+        doReturn(TEST_ELAPSED_REALTIME + TEST_TTL + REMOVE_SERVICE_AFTER_QUERY_SENT_TIME)
+                .when(mockDecoderClock).elapsedRealtime();
+        dispatchRealtimeSchedulerMessage();
+        verifyQuerySentAndRemoveExpiredServices(3 /* count */);
+        runOnHandler(() -> realHandler.dispatchMessage(
+                realHandler.obtainMessage(EVENT_REMOVE_EXPIRED_SERVICES)));
+        verify(mockListenerOne, timeout(TEST_TIMEOUT_MS).times(1))
+                .onServiceRemoved(matchServiceName(requestedInstance));
+        verify(mockListenerOne, timeout(TEST_TIMEOUT_MS).times(1))
+                .onServiceNameRemoved(matchServiceName(requestedInstance));
+    }
+
     private static MdnsServiceInfo matchServiceName(String name) {
         return argThat(info -> info.getServiceInstanceName().equals(name));
     }
@@ -2213,8 +2286,7 @@ public class MdnsServiceTypeClientTests {
             boolean multipleSocketDiscovery, int scheduledCount, int sendMessageCount,
             boolean useAccurateDelayCallback) {
         if (useAccurateDelayCallback && message != null && realHandler != null) {
-            runOnHandler(() -> realHandler.dispatchMessage(message));
-            message = null;
+            dispatchRealtimeSchedulerMessage();
         } else {
             // Dispatch the message
             if (delayMessage != null && realHandler != null) {

From 1cba7f04ca72192a15aa3f9874bbf5500a1ab890 Mon Sep 17 00:00:00 2001
From: Paul Hu <paulhu@google.com>
Date: Wed, 5 Mar 2025 10:02:37 +0000
Subject: [PATCH 065/377] Avoid unnecessary lost callbacks

The lost callback should be skipped if the service has not been
previously notified. Otherwise, the listener could inadvertently
initiate the service removal process for the incorrect service.

Bug: 387910548
Test: atest ConnectivityCoverageTests NsdManagerTest
Flag: EXEMPT legacy flag nsd_optimized_expired_service_removal
Change-Id: I7fdf31f0b15f19becc10fcb35c7b1f47dcc38c27
---
 .../mdns/MdnsServiceTypeClient.java           | 15 ++++-
 .../mdns/MdnsServiceTypeClientTests.java      | 57 +++++++++++++++++++
 2 files changed, 69 insertions(+), 3 deletions(-)

diff --git a/service-t/src/com/android/server/connectivity/mdns/MdnsServiceTypeClient.java b/service-t/src/com/android/server/connectivity/mdns/MdnsServiceTypeClient.java
index 97a5ec1c96..55c6f70962 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MdnsServiceTypeClient.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MdnsServiceTypeClient.java
@@ -131,8 +131,13 @@ public class MdnsServiceTypeClient {
             return discoveredServiceNames.add(DnsUtils.toDnsUpperCase(serviceName));
         }
 
-        void unsetServiceDiscovered(@NonNull String serviceName) {
-            discoveredServiceNames.remove(DnsUtils.toDnsUpperCase(serviceName));
+        /**
+         * Unset the given service name as discovered.
+         *
+         * @return true if the service name was discovered before.
+         */
+        boolean unsetServiceDiscovered(@NonNull String serviceName) {
+            return discoveredServiceNames.remove(DnsUtils.toDnsUpperCase(serviceName));
         }
     }
 
@@ -613,7 +618,11 @@ public class MdnsServiceTypeClient {
             }
             final MdnsServiceBrowserListener listener = listeners.keyAt(i);
             if (response.getServiceInstanceName() != null) {
-                listeners.valueAt(i).unsetServiceDiscovered(response.getServiceInstanceName());
+                if (!listeners.valueAt(i).unsetServiceDiscovered(
+                        response.getServiceInstanceName())) {
+                    // Skip the lost callback if this service has not been notified previously
+                    continue;
+                }
                 final MdnsServiceInfo serviceInfo = buildMdnsServiceInfoFromResponse(
                         response, serviceTypeLabels, clock.elapsedRealtime());
                 if (response.isComplete()) {
diff --git a/tests/unit/java/com/android/server/connectivity/mdns/MdnsServiceTypeClientTests.java b/tests/unit/java/com/android/server/connectivity/mdns/MdnsServiceTypeClientTests.java
index a893f03a51..eb1e47c54d 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/MdnsServiceTypeClientTests.java
+++ b/tests/unit/java/com/android/server/connectivity/mdns/MdnsServiceTypeClientTests.java
@@ -2264,6 +2264,63 @@ public class MdnsServiceTypeClientTests {
                 .onServiceNameRemoved(matchServiceName(requestedInstance));
     }
 
+    @Test
+    public void testNoLostCallbackIfServiceHasNotNotified() throws IOException {
+        final String requestedInstance = "instance1";
+        final String ipV4Address = "192.0.2.0";
+        final MdnsFeatureFlags flags = MdnsFeatureFlags.newBuilder()
+                .setIsExpiredServicesRemovalEnabled(true)
+                .setIsOptimizedExpiredServiceRemovalEnabled(true)
+                .setIsAccurateDelayCallbackEnabled(true)
+                .build();
+        long currentTime = TEST_ELAPSED_REALTIME;
+        serviceCache = new MdnsServiceCache(thread.getLooper(), flags, mockDecoderClock);
+        client = makeMdnsServiceTypeClient(flags);
+        doReturn(currentTime).when(mockDecoderClock).elapsedRealtime();
+        startSendAndReceive(mockListenerOne,
+                MdnsSearchOptions.newBuilder().setQueryMode(AGGRESSIVE_QUERY_MODE).build());
+
+        // Sent a query
+        verifyQuerySentAndRemoveExpiredServices(1 /* count */);
+
+        // Receive a response
+        processResponse(
+                createResponse(requestedInstance, ipV4Address, 5353, SERVICE_TYPE_LABELS,
+                        Collections.emptyMap() /* textAttributes */, TEST_TTL),
+                socketKey);
+        verify(mockListenerOne).onServiceNameDiscovered(
+                matchServiceName(requestedInstance), eq(false) /* isServiceFromCache */);
+        verify(mockListenerOne).onServiceFound(
+                matchServiceName(requestedInstance), eq(false) /* isServiceFromCache */);
+
+        // Advance the time so that the service's TTL is expired, and send a query again
+        currentTime += TEST_TTL + 1;
+        doReturn(currentTime).when(mockDecoderClock).elapsedRealtime();
+        dispatchRealtimeSchedulerMessage();
+        verifyQuerySentAndRemoveExpiredServices(2 /* count */);
+
+        // A new listener was added, but it should not receive any callback because the existing
+        // service is expired.
+        startSendAndReceive(mockListenerTwo,
+                MdnsSearchOptions.newBuilder().setQueryMode(AGGRESSIVE_QUERY_MODE).build());
+        verifyQuerySentAndRemoveExpiredServices(3 /* count */);
+        verify(mockListenerTwo, never()).onServiceNameDiscovered(any(), anyBoolean());
+        verify(mockListenerTwo, never()).onServiceFound(any(), anyBoolean());
+
+        // Advance the time and attempt to remove expired services. Only the listener, which was
+        // previously notified, should receive a callback.
+        currentTime += REMOVE_SERVICE_AFTER_QUERY_SENT_TIME;
+        doReturn(currentTime).when(mockDecoderClock).elapsedRealtime();
+        runOnHandler(() -> realHandler.dispatchMessage(
+                realHandler.obtainMessage(EVENT_REMOVE_EXPIRED_SERVICES)));
+        verify(mockListenerOne, timeout(TEST_TIMEOUT_MS).times(1))
+                .onServiceRemoved(matchServiceName(requestedInstance));
+        verify(mockListenerOne, timeout(TEST_TIMEOUT_MS).times(1))
+                .onServiceNameRemoved(matchServiceName(requestedInstance));
+        verify(mockListenerTwo, never()).onServiceRemoved(any());
+        verify(mockListenerTwo, never()).onServiceNameRemoved(any());
+    }
+
     private static MdnsServiceInfo matchServiceName(String name) {
         return argThat(info -> info.getServiceInstanceName().equals(name));
     }

From efa867c2b238ebfda0c2762bad7cf5e93347e42f Mon Sep 17 00:00:00 2001
From: Remi NGUYEN VAN <reminv@google.com>
Date: Thu, 3 Apr 2025 16:06:17 +0900
Subject: [PATCH 066/377] Only recalculate expiration when necessary

Improve the previous MdnsServiceCache change to only update
mNextExpirationTime when a service has expired.

Bug: 387910548
Test: atest ConnectivityCoverageTests NsdManagerTest
Flag: EXEMPT legacy flag nsd_optimized_expired_service_removal
Change-Id: Ia9b1fd4c16daa06af9818ff50c0a6c6e43f00ff8
---
 .../android/server/connectivity/mdns/MdnsServiceCache.java  | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/service-t/src/com/android/server/connectivity/mdns/MdnsServiceCache.java b/service-t/src/com/android/server/connectivity/mdns/MdnsServiceCache.java
index dc0dbeba87..3c13798fda 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MdnsServiceCache.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MdnsServiceCache.java
@@ -348,6 +348,7 @@ public class MdnsServiceCache {
             long now, boolean removeOnlyIfQuerySent) {
         final List<CachedService> removedServices = new ArrayList<>();
         final Iterator<CachedService> iterator = cachedServices.iterator();
+        boolean hasNewlyExpiredService = false;
         while (iterator.hasNext()) {
             final CachedService cachedService = iterator.next();
             // TODO: Check other records (A, AAAA, TXT) ttl time and remove the record if it's
@@ -358,6 +359,7 @@ public class MdnsServiceCache {
                 // early if service is not expired or no service record.
                 break;
             }
+            hasNewlyExpiredService = true;
             if (removeOnlyIfQuerySent) {
                 // Set service is expired.
                 cachedService.mServiceExpired = true;
@@ -372,7 +374,9 @@ public class MdnsServiceCache {
         }
 
         // Update next expiration time.
-        mNextExpirationTime = getNextExpirationTime(now);
+        if (hasNewlyExpiredService) {
+            mNextExpirationTime = getNextExpirationTime(now);
+        }
 
         return removedServices;
     }

From d363be65577a5f58ec41571ecceff228c67dd208 Mon Sep 17 00:00:00 2001
From: Gazal Agarwal <agazal@google.com>
Date: Thu, 3 Apr 2025 09:13:40 -0700
Subject: [PATCH 067/377] Add connectivity tests for presubmit on tv

Bug: 404543522
Test: make and flash
FLAG: EXEMPT TEST_ONLY
Change-Id: Iebd46137b6aaae93dc8d92ac0d3ab30ad327c78f
---
 TEST_MAPPING | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/TEST_MAPPING b/TEST_MAPPING
index 8592af2859..9f8868c3ef 100644
--- a/TEST_MAPPING
+++ b/TEST_MAPPING
@@ -435,6 +435,23 @@
       "name": "CtsNetTestCasesUpdateStatsPermission"
     }
   ],
+  "tv-presubmit": [
+    {
+      "name": "CtsNetTestCases"
+    },
+    {
+      "name": "CtsNativeNetTestCases"
+    },
+    {
+      "name": "CtsNativeNetDnsTestCases"
+    },
+    {
+      "name": "CtsNetTestCasesInternetPermission"
+    },
+    {
+      "name": "CtsNetTestCasesUpdateStatsPermission"
+    }
+  ],
   "imports": [
     {
       "path": "frameworks/base/core/java/android/net"

From 20d4024748914d43414e3b606281caaa22778e1b Mon Sep 17 00:00:00 2001
From: Bessie Jiang <bessiej@google.com>
Date: Thu, 3 Apr 2025 16:10:50 +0000
Subject: [PATCH 068/377] Remove dependency on DataStore from CT logging infra

The ct.preferences file has caused some issues (e.g. b/404408218), and
now that the logic of the logging is on every log list update (as
opposed to a certain number of consecutive failures), there is limited
utility in still relying on the DataStore to maintain a number of
crashes as this can be aggregated on the server side anyways.

Bug: 407940468
Test: atest NetworkSecurityUnitTests
Flag: com.android.net.ct.flags.certificate_transparency_service
Change-Id: I63bd9d87e1abd74c112485e8debfa284b81cc1ad
---
 .../ct/CertificateTransparencyLoggerImpl.java | 38 +------------------
 .../ct/CertificateTransparencyService.java    |  2 +-
 2 files changed, 2 insertions(+), 38 deletions(-)

diff --git a/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyLoggerImpl.java b/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyLoggerImpl.java
index b551d870d1..bec9cdcaeb 100644
--- a/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyLoggerImpl.java
+++ b/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyLoggerImpl.java
@@ -40,32 +40,17 @@ import android.app.DownloadManager;
 /** Implementation for logging to statsd for Certificate Transparency. */
 class CertificateTransparencyLoggerImpl implements CertificateTransparencyLogger {
 
-    private final DataStore mDataStore;
-
-    CertificateTransparencyLoggerImpl(DataStore dataStore) {
-        mDataStore = dataStore;
-    }
-
     @Override
     public void logCTLogListUpdateStateChangedEvent(LogListUpdateStatus updateStatus) {
-        if (updateStatus.isSuccessful()) {
-            resetFailureCount();
-        } else {
-            updateFailureCount();
-        }
-
         int updateState =
                 updateStatus
                         .downloadStatus()
                         .map(s -> downloadStatusToFailureReason(s))
                         .orElseGet(() -> localEnumToStatsLogEnum(updateStatus.state()));
-        int failureCount =
-                mDataStore.getPropertyInt(
-                        Config.LOG_LIST_UPDATE_FAILURE_COUNT, /* defaultValue= */ 0);
 
         logCTLogListUpdateStateChangedEvent(
                 updateState,
-                failureCount,
+                /* failureCount= */ updateStatus.isSuccessful() ? 0 : 1,
                 updateStatus.httpErrorStatusCode(),
                 updateStatus.signature(),
                 updateStatus.logListTimestamp());
@@ -86,27 +71,6 @@ class CertificateTransparencyLoggerImpl implements CertificateTransparencyLogger
                 logListTimestamp);
     }
 
-    /**
-     * Resets the number of consecutive log list update failures in the data store back to zero.
-     */
-    private void resetFailureCount() {
-        mDataStore.setPropertyInt(Config.LOG_LIST_UPDATE_FAILURE_COUNT, /* value= */ 0);
-        mDataStore.store();
-    }
-
-    /**
-     * Updates the data store with the current number of consecutive log list update failures.
-     */
-    private void updateFailureCount() {
-        int failure_count =
-                mDataStore.getPropertyInt(
-                        Config.LOG_LIST_UPDATE_FAILURE_COUNT, /* defaultValue= */ 0);
-        int new_failure_count = failure_count + 1;
-
-        mDataStore.setPropertyInt(Config.LOG_LIST_UPDATE_FAILURE_COUNT, new_failure_count);
-        mDataStore.store();
-    }
-
     /** Converts DownloadStatus reason into failure reason to log. */
     private int downloadStatusToFailureReason(int downloadStatusReason) {
         switch (downloadStatusReason) {
diff --git a/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyService.java b/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyService.java
index e77996387d..3ce8cb65e2 100644
--- a/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyService.java
+++ b/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyService.java
@@ -73,7 +73,7 @@ public class CertificateTransparencyService extends ICertificateTransparencyMana
                                 context,
                                 new DownloadHelper(context),
                                 signatureVerifier,
-                                new CertificateTransparencyLoggerImpl(dataStore),
+                                new CertificateTransparencyLoggerImpl(),
                                 compatVersions),
                         signatureVerifier,
                         compatVersions);

From 0b8e3a26fb11ad8bc934ce6dd03d0f6d4305c23d Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Thu, 3 Apr 2025 14:39:17 -0700
Subject: [PATCH 069/377] Support scapy packet builder syntax

Scapy allows building packets in order, i.e. by assembling them using
the division operator: val p = ether / ipv6 / icmpv6.

This change adds support for an identical pattern. To do so, it first
assembles all packets in order inside a packet builder class. When
build() is called, it traverses the packet list in reverse and assembles
the final packet, similar to ther original instance of the code. To
support checksum generation in the future, the code also keeps track of
the "closest pseudo header packet", i.e. the nearest encapsulating IPv6
(and soon IPv4) packet. This architecture should eventually be able to
support the creation of more complex packets, for example:
val p = ether / ipv6 / ipv6-ext / udp / ipv6 / udp.

(Note that now that I am writing this, I realize that this could
probably be significantly simplified by including IPv6 extension header
support as part of Ip6Pkt and always using the encapsulating packet for
the pseudo header...)

This code does not yet implement checksum generation.

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I9b0fa0e5bb66edf6928d9b96144c5ed133ebab64
---
 .../android/testutils/PacketBuilderUtils.kt   | 153 ++++++++++++------
 1 file changed, 107 insertions(+), 46 deletions(-)

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
index 3475c72584..41689b5f8e 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
@@ -27,18 +27,72 @@ import java.net.InetAddress
 import java.nio.ByteBuffer
 import java.util.EnumSet
 
+class PacketBuilder(outerPacket: Packet, innerPacket: Packet) {
+    private data class PacketHolder(
+            /** Points to the last encapsulating packet that includes a pseudo header (IPv4 or IPv6)
+             * for the purpose of checksum calculation. May be null if no such packet exists. */
+            val pseudoHeaderPacket: Packet?,
+            val packet: Packet,
+    )
+    private var lastPseudoHeaderPacket: Packet? = null
+    /** Collects packets in order, where the outermost packet is at index 0. */
+    private val packetCollector = ArrayList<PacketHolder>()
+
+    private fun addPacket(p: Packet) {
+        // TODO: update this logic when Ip4Pkt type is added.
+        if (p is Ip6Pkt) {
+            lastPseudoHeaderPacket = p
+        }
+        packetCollector.add(PacketHolder(lastPseudoHeaderPacket, p))
+    }
+
+    init {
+        addPacket(outerPacket)
+        addPacket(innerPacket)
+    }
+
+    operator fun div(p: Packet): PacketBuilder {
+        addPacket(p)
+        return this
+    }
+
+    fun build(): ByteArray {
+        var payload: FinalizedPacket? = null
+        for (holder in packetCollector.reversed()) {
+            payload = holder.packet.build(payload, holder.pseudoHeaderPacket)
+        }
+
+        // payload is guaranteed non-null as PacketBuilder is created with at least two packets.
+        return payload!!.bytes
+    }
+
+    // For ByteArray.toHexString
+    @kotlin.ExperimentalStdlibApi
+    override fun toString(): String {
+        return build().toHexString()
+    }
+}
+
+/** Interface to support PacketBuilder syntax, i.e. {@code val p = ether / ipv6 / icmpv6} */
 interface Packet {
-    fun toByteArray(): ByteArray
+    operator fun div(p: Packet): PacketBuilder {
+        return PacketBuilder(this, p)
+    }
+    fun build(payload: FinalizedPacket?, pseudoHeaderPacket: Packet?): FinalizedPacket
 }
 
-interface L3Packet : Packet {
-    val etherType: Short
+/**
+ * Represents a packet that has been built. Depending on the type of packet, it includes additional
+ * information on top of the ByteArray.
+ */
+interface FinalizedPacket {
+    val bytes: ByteArray
 }
 
-interface L4Packet : Packet {
-    val proto: Byte
-    val size: Short
-}
+data class L2Packet(override val bytes: ByteArray) : FinalizedPacket
+// Some L3 packets can be carried by an L3 packet (e.g. 6in4), so consider adding proto to L3Packet.
+data class L3Packet(override val bytes: ByteArray, val etherType: Short) : FinalizedPacket
+data class L4Packet(override val bytes: ByteArray, val proto: Byte) : FinalizedPacket
 
 private interface Flags {
     val value: Int
@@ -67,7 +121,7 @@ private inline fun <reified E> enumSetOfFlags(str: String): EnumSet<E>
 class NaPkt(
     target: Inet6Address,
     flags: EnumSet<NaFlags>,
-) : L4Packet {
+) : Packet {
     /**
      * Convenience constructor accepting parameters as Strings.
      *
@@ -86,9 +140,6 @@ class NaPkt(
         O(0x20),
     }
 
-    override val proto: Byte = 58
-    override val size: Short
-      get() = outputStream.size().toShort()
     private val outputStream = ByteArrayOutputStream()
 
     init {
@@ -124,7 +175,16 @@ class NaPkt(
         return addTllaOption(MacAddress.fromString(lla))
     }
 
-    override fun toByteArray() = outputStream.toByteArray()
+    // TODO: create a base class for both NaPkt and RaPkt
+    override fun build(payload: FinalizedPacket?, pseudoHeaderPacket: Packet?): FinalizedPacket {
+        // ICMPv6 packets do not carry a payload but require the pseudo-header to calculate their
+        // checksum.
+        require(payload == null)
+        require(pseudoHeaderPacket != null)
+
+        // TODO: calculate checksum
+        return L4Packet(proto = 58, bytes = outputStream.toByteArray())
+    }
 }
 
 /**
@@ -142,7 +202,7 @@ class RaPkt(
     private val reachableTime: Int,
     private val retransTimer: Int,
     private val flags: EnumSet<RaFlags>,
-) : L4Packet {
+) : Packet {
     /**
      * Convenience constructor accepting flags parameter as String
      *
@@ -165,9 +225,6 @@ class RaPkt(
         O(0x40),
     }
 
-    override val proto: Byte = 58
-    override val size: Short
-      get() = outputStream.size().toShort()
     private val outputStream = ByteArrayOutputStream()
 
     init {
@@ -339,34 +396,40 @@ class RaPkt(
         return addPref64Option(IpPrefix(prefix), lft)
     }
 
-    override fun toByteArray() = outputStream.toByteArray()
+    // TODO: create a base class for both NaPkt and RaPkt
+    override fun build(payload: FinalizedPacket?, pseudoHeaderPacket: Packet?): FinalizedPacket {
+        // ICMPv6 packets do not carry a payload but require the pseudo-header to calculate their
+        // checksum.
+        require(payload == null)
+        require(pseudoHeaderPacket != null)
+
+        // TODO: calculate checksum
+        return L4Packet(proto = 58, bytes = outputStream.toByteArray())
+    }
 }
 
 /** Class that facilitates the creation of IPv6 packets. */
 class Ip6Pkt(
         private val src: Inet6Address,
         private val dst: Inet6Address,
-        private val data: L4Packet,
-) : L3Packet {
-    constructor(src: String, dst: String, data: L4Packet) : this(
+) : Packet {
+    constructor(src: String, dst: String) : this(
             InetAddress.getByName(src) as Inet6Address,
             InetAddress.getByName(dst) as Inet6Address,
-            data,
     )
 
-    override val etherType = 0x86dd.toShort()
-
     private val tc = 0
     private val flowlabel = 0
     private val hlim = 255.toByte()
 
-    private val bytes: ByteArray
+    override fun build(payload: FinalizedPacket?, pseudoHeaderPacket: Packet?): FinalizedPacket {
+        require(payload != null)
+        require(payload is L4Packet)
 
-    init {
         val ipv6Header = ByteBuffer.allocate(40)
         ipv6Header.putInt((6 shl 28) or (tc shl 20) or flowlabel)
-        ipv6Header.putShort(data.size)
-        ipv6Header.put(data.proto)
+        ipv6Header.putShort(payload.bytes.size.toShort())
+        ipv6Header.put(payload.proto)
         ipv6Header.put(hlim)
         ipv6Header.put(src.address)
         ipv6Header.put(dst.address)
@@ -374,11 +437,9 @@ class Ip6Pkt(
 
         val outputStream = ByteArrayOutputStream()
         outputStream.write(ipv6Header.array())
-        outputStream.write(data.toByteArray())
-        bytes = outputStream.toByteArray()
+        outputStream.write(payload.bytes)
+        return L3Packet(etherType = 0x86dd.toShort(), bytes = outputStream.toByteArray())
     }
-
-    override fun toByteArray() = bytes
 }
 
 /**
@@ -388,35 +449,35 @@ class Ip6Pkt(
  *
  * <pre>
  * {@code
+ * val ether = EtherPkt(src = "1:2:3:4:5:6", dst = "1:1:1:1:1:1")
+ * val ipv6 = Ip6Pkt(src = "fe80::1", dst = "fe80::2")
  * val ra = RaPkt(routerLft = 50, reachableTime = 100, flags = "O")
- * ra.addPioOption(prefix = "2001:db8::1/64", flags = "LA")
- * val ipv6 = Ip6Pkt(src = "fe80::1", dst = "fe80::2", data = ra)
- * val ether = EtherPkt(src = "1:2:3:4:5:6", dst = "1:1:1:1:1:1", data = ipv6)
+ *         .addPioOption(prefix = "2001:db8::1/64", flags = "LA")
+ * val p = ether / ipv6 / ra
+ * val bytes = p.bytes
  * }
  * </pre>
  **/
 class EtherPkt(
-        dst: MacAddress,
-        src: MacAddress,
-        data: L3Packet,
+        private val dst: MacAddress,
+        private val src: MacAddress,
     ) : Packet {
-    constructor(dst: String, src: String, data: L3Packet) :
-        this(MacAddress.fromString(dst), MacAddress.fromString(src), data)
+    constructor(dst: String, src: String) :
+        this(MacAddress.fromString(dst), MacAddress.fromString(src))
 
-    val bytes: ByteArray
+    override fun build(payload: FinalizedPacket?, pseudoHeaderPacket: Packet?): FinalizedPacket {
+        require(payload != null)
+        require(payload is L3Packet)
 
-    init {
         val ethernetHeader = ByteBuffer.allocate(14)
         ethernetHeader.put(dst.toByteArray())
         ethernetHeader.put(src.toByteArray())
-        ethernetHeader.putShort(data.etherType)
+        ethernetHeader.putShort(payload.etherType)
         ethernetHeader.flip()
 
         val outputStream = ByteArrayOutputStream()
         outputStream.write(ethernetHeader.array())
-        outputStream.write(data.toByteArray())
-        bytes = outputStream.toByteArray()
+        outputStream.write(payload.bytes)
+        return L2Packet(bytes = outputStream.toByteArray())
     }
-
-    override fun toByteArray() = bytes
 }

From a39bf4ee976406f2a216cb83c33827e868a3db2a Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Thu, 3 Apr 2025 16:22:07 -0700
Subject: [PATCH 070/377] Add support for ICMPv6 checksumming

Test: parsed packet on packetor
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: Id81c57a7f9ca9ee3671768941687458100beb068
---
 .../android/testutils/PacketBuilderUtils.kt   | 94 +++++++++++--------
 1 file changed, 57 insertions(+), 37 deletions(-)

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
index 41689b5f8e..f9b1ff1acd 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
@@ -21,6 +21,7 @@ package com.android.testutils
 
 import android.net.IpPrefix
 import android.net.MacAddress
+import com.android.net.module.util.IpUtils
 import java.io.ByteArrayOutputStream
 import java.net.Inet6Address
 import java.net.InetAddress
@@ -31,16 +32,15 @@ class PacketBuilder(outerPacket: Packet, innerPacket: Packet) {
     private data class PacketHolder(
             /** Points to the last encapsulating packet that includes a pseudo header (IPv4 or IPv6)
              * for the purpose of checksum calculation. May be null if no such packet exists. */
-            val pseudoHeaderPacket: Packet?,
+            val pseudoHeaderPacket: PseudoHeaderPacket?,
             val packet: Packet,
     )
-    private var lastPseudoHeaderPacket: Packet? = null
+    private var lastPseudoHeaderPacket: PseudoHeaderPacket? = null
     /** Collects packets in order, where the outermost packet is at index 0. */
     private val packetCollector = ArrayList<PacketHolder>()
 
     private fun addPacket(p: Packet) {
-        // TODO: update this logic when Ip4Pkt type is added.
-        if (p is Ip6Pkt) {
+        if (p is PseudoHeaderPacket) {
             lastPseudoHeaderPacket = p
         }
         packetCollector.add(PacketHolder(lastPseudoHeaderPacket, p))
@@ -78,7 +78,15 @@ interface Packet {
     operator fun div(p: Packet): PacketBuilder {
         return PacketBuilder(this, p)
     }
-    fun build(payload: FinalizedPacket?, pseudoHeaderPacket: Packet?): FinalizedPacket
+    fun build(payload: FinalizedPacket?, pseudo: PseudoHeaderPacket?): FinalizedPacket
+}
+
+interface PseudoHeaderPacket : Packet {
+    /**
+     * Calculates the partial checksum (i.e. pseudo header checksum) to be used as a seed value for
+     * the higher layer checksum calculation.
+     */
+    fun calculatePseudoHeaderCsum(proto: Byte, length: Int): Int
 }
 
 /**
@@ -112,6 +120,30 @@ private inline fun <reified E> enumSetOfFlags(str: String): EnumSet<E>
     return result
 }
 
+/** Base class that holds the common checksum implementation */
+open class Icmp6Pkt : Packet {
+    protected val outputStream = ByteArrayOutputStream()
+
+    override fun build(payload: FinalizedPacket?, pseudo: PseudoHeaderPacket?): FinalizedPacket {
+        // ICMPv6 packets do not carry a payload but require the pseudo-header to calculate their
+        // checksum.
+        require(payload == null)
+        require(pseudo != null)
+
+        val packetBytes = outputStream.toByteArray()
+        val packetBuffer = ByteBuffer.wrap(packetBytes)
+        var csum = pseudo.calculatePseudoHeaderCsum(58 /* proto */, packetBytes.size)
+        csum = IpUtils.checksum(packetBuffer, csum, 0 /*start*/, packetBytes.size)
+
+        // Fixup packetBuffer
+        packetBuffer.position(2)
+        packetBuffer.putShort(csum.toShort())
+
+        // TODO: calculate checksum
+        return L4Packet(proto = 58, bytes = packetBytes)
+    }
+}
+
 /**
  * Class that facilitates the creation of NA packets.
  *
@@ -121,7 +153,7 @@ private inline fun <reified E> enumSetOfFlags(str: String): EnumSet<E>
 class NaPkt(
     target: Inet6Address,
     flags: EnumSet<NaFlags>,
-) : Packet {
+) : Icmp6Pkt() {
     /**
      * Convenience constructor accepting parameters as Strings.
      *
@@ -140,8 +172,6 @@ class NaPkt(
         O(0x20),
     }
 
-    private val outputStream = ByteArrayOutputStream()
-
     init {
         val naHeader = ByteBuffer.allocate(24)
         naHeader.put(136.toByte()) // Type = 136 (Neighbor Advertisement)
@@ -174,17 +204,6 @@ class NaPkt(
     fun addTllaOption(lla: String): NaPkt {
         return addTllaOption(MacAddress.fromString(lla))
     }
-
-    // TODO: create a base class for both NaPkt and RaPkt
-    override fun build(payload: FinalizedPacket?, pseudoHeaderPacket: Packet?): FinalizedPacket {
-        // ICMPv6 packets do not carry a payload but require the pseudo-header to calculate their
-        // checksum.
-        require(payload == null)
-        require(pseudoHeaderPacket != null)
-
-        // TODO: calculate checksum
-        return L4Packet(proto = 58, bytes = outputStream.toByteArray())
-    }
 }
 
 /**
@@ -202,7 +221,7 @@ class RaPkt(
     private val reachableTime: Int,
     private val retransTimer: Int,
     private val flags: EnumSet<RaFlags>,
-) : Packet {
+) : Icmp6Pkt() {
     /**
      * Convenience constructor accepting flags parameter as String
      *
@@ -225,13 +244,11 @@ class RaPkt(
         O(0x40),
     }
 
-    private val outputStream = ByteArrayOutputStream()
-
     init {
         val raHeader = ByteBuffer.allocate(16)
         raHeader.put(134.toByte()) // Type = 134 (Router Advertisement)
         raHeader.put(0) // Code = 0
-        raHeader.putShort(0) // Checksum = 0 (ignored)
+        raHeader.putShort(0) // Checksum = 0 (filled in later)
         raHeader.put(255.toByte()) // Cur Hop Limit
         raHeader.put(flags.toByte())
         raHeader.putShort(routerLft)
@@ -395,24 +412,13 @@ class RaPkt(
     fun addPref64Option(prefix: String, lft: Int = 1800): RaPkt {
         return addPref64Option(IpPrefix(prefix), lft)
     }
-
-    // TODO: create a base class for both NaPkt and RaPkt
-    override fun build(payload: FinalizedPacket?, pseudoHeaderPacket: Packet?): FinalizedPacket {
-        // ICMPv6 packets do not carry a payload but require the pseudo-header to calculate their
-        // checksum.
-        require(payload == null)
-        require(pseudoHeaderPacket != null)
-
-        // TODO: calculate checksum
-        return L4Packet(proto = 58, bytes = outputStream.toByteArray())
-    }
 }
 
 /** Class that facilitates the creation of IPv6 packets. */
 class Ip6Pkt(
         private val src: Inet6Address,
         private val dst: Inet6Address,
-) : Packet {
+) : PseudoHeaderPacket {
     constructor(src: String, dst: String) : this(
             InetAddress.getByName(src) as Inet6Address,
             InetAddress.getByName(dst) as Inet6Address,
@@ -422,7 +428,7 @@ class Ip6Pkt(
     private val flowlabel = 0
     private val hlim = 255.toByte()
 
-    override fun build(payload: FinalizedPacket?, pseudoHeaderPacket: Packet?): FinalizedPacket {
+    override fun build(payload: FinalizedPacket?, pseudo: PseudoHeaderPacket?): FinalizedPacket {
         require(payload != null)
         require(payload is L4Packet)
 
@@ -440,6 +446,20 @@ class Ip6Pkt(
         outputStream.write(payload.bytes)
         return L3Packet(etherType = 0x86dd.toShort(), bytes = outputStream.toByteArray())
     }
+
+    override fun calculatePseudoHeaderCsum(proto: Byte, length: Int): Int {
+        // Calculates the checksum over the src and dst IPv6 addresses.
+        // TODO: assemble IPv6 header in constructor and let build() update payload length and
+        // proto instead.
+        val buffer = ByteBuffer.allocate((2 * 16) + 4 + 2)
+        buffer.put(src.address)
+        buffer.put(dst.address)
+        buffer.putInt(length)
+        buffer.putShort(proto.toShort())
+        buffer.flip()
+        // Note that IpUtils.checksum() flips the result, so it is flipped back here.
+        return IpUtils.checksum(buffer, 0 /*seed*/, 0 /*start*/, buffer.limit()) xor 0xffff
+    }
 }
 
 /**
@@ -465,7 +485,7 @@ class EtherPkt(
     constructor(dst: String, src: String) :
         this(MacAddress.fromString(dst), MacAddress.fromString(src))
 
-    override fun build(payload: FinalizedPacket?, pseudoHeaderPacket: Packet?): FinalizedPacket {
+    override fun build(payload: FinalizedPacket?, pseudo: PseudoHeaderPacket?): FinalizedPacket {
         require(payload != null)
         require(payload is L3Packet)
 

From 766451a78523d31ffcd1483267022aa6b5b441a0 Mon Sep 17 00:00:00 2001
From: Remi NGUYEN VAN <reminv@google.com>
Date: Thu, 3 Apr 2025 15:42:31 +0900
Subject: [PATCH 071/377] Allow tagging sockets with a specified tag

Address the TODO to allow tagging sockets, which was done before the
code was imported to the Android codebase.

Also remove the comment in MdnsSocket, as the tagging is already done by
setting the thread tag, and tagSocket in the original code actually did
nothing for DatagramSockets.

The option is unset in the Android repository, so this code is unused
there.

Test: atest
Flag: EXEMPT unused in Android repo
Change-Id: Ifccc4ec2f0b63bf2caabe1d9ef4f57f08731a2b1
---
 .../connectivity/mdns/MdnsFeatureFlags.java   | 23 ++++++++++
 .../server/connectivity/mdns/MdnsSocket.java  |  1 -
 .../connectivity/mdns/MdnsSocketClient.java   | 21 ++++++++-
 .../mdns/MdnsSocketClientTests.java           | 44 +++++++++++++++----
 4 files changed, 77 insertions(+), 12 deletions(-)

diff --git a/service-t/src/com/android/server/connectivity/mdns/MdnsFeatureFlags.java b/service-t/src/com/android/server/connectivity/mdns/MdnsFeatureFlags.java
index 546e508b8b..97a65f62d7 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MdnsFeatureFlags.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MdnsFeatureFlags.java
@@ -104,6 +104,13 @@ public class MdnsFeatureFlags {
             "nsd_cached_services_retention_time";
     public static final int DEFAULT_CACHED_SERVICES_RETENTION_TIME_MILLISECONDS = 10000;
 
+    /**
+     * Tag indicating that socket tagging should not be done.
+     *
+     * <p>Corresponds to the same value TrafficStats uses to for "no tag".
+     */
+    public static final int MDNS_SOCKET_THREAD_STATS_TAG_NONE = -1;
+
     /**
      * A feature flag to control whether the accurate delay callback should be enabled.
      */
@@ -164,6 +171,9 @@ public class MdnsFeatureFlags {
     // Flag for optimized expired service removal
     public final boolean mIsOptimizedExpiredServiceRemovalEnabled;
 
+    // Thread stats tag for MdnsSocketClient
+    public final int mMdnsSocketThreadStatsTag;
+
     @Nullable
     private final FlagOverrideProvider mOverrideProvider;
 
@@ -299,6 +309,7 @@ public class MdnsFeatureFlags {
             boolean isSocketClientNetworkGuessingEnabled,
             boolean isCacheFlushPerAddressTypeEnabled,
             boolean isOptimizedExpiredServiceRemovalEnabled,
+            int mdnsSocketThreadStatsTag,
             @Nullable FlagOverrideProvider overrideProvider) {
         mIsMdnsOffloadFeatureEnabled = isOffloadFeatureEnabled;
         mIncludeInetAddressRecordsInProbing = includeInetAddressRecordsInProbing;
@@ -316,6 +327,7 @@ public class MdnsFeatureFlags {
         mIsSocketClientNetworkGuessingEnabled = isSocketClientNetworkGuessingEnabled;
         mIsCacheFlushPerAddressTypeEnabled = isCacheFlushPerAddressTypeEnabled;
         mIsOptimizedExpiredServiceRemovalEnabled = isOptimizedExpiredServiceRemovalEnabled;
+        mMdnsSocketThreadStatsTag = mdnsSocketThreadStatsTag;
         mOverrideProvider = overrideProvider;
     }
 
@@ -344,6 +356,7 @@ public class MdnsFeatureFlags {
         private boolean mIsSocketClientNetworkGuessingEnabled;
         private boolean mIsCacheFlushPerAddressTypeEnabled;
         private boolean mIsOptimizedExpiredServiceRemovalEnabled;
+        private int mMdnsSocketThreadStatsTag;
         private FlagOverrideProvider mOverrideProvider;
 
         /**
@@ -366,6 +379,7 @@ public class MdnsFeatureFlags {
             mIsSocketClientNetworkGuessingEnabled = false;
             mIsCacheFlushPerAddressTypeEnabled = true; // Default enabled.
             mIsOptimizedExpiredServiceRemovalEnabled = false;
+            mMdnsSocketThreadStatsTag = MDNS_SOCKET_THREAD_STATS_TAG_NONE;
             mOverrideProvider = null;
         }
 
@@ -542,6 +556,14 @@ public class MdnsFeatureFlags {
             return this;
         }
 
+        /**
+         * Set the thread stats tag to use in {@link MdnsSocketClient}.
+         */
+        public Builder setMdnsSocketThreadStatsTag(int mdnsSocketThreadStatsTag) {
+            mMdnsSocketThreadStatsTag = mdnsSocketThreadStatsTag;
+            return this;
+        }
+
         /**
          * Builds a {@link MdnsFeatureFlags} with the arguments supplied to this builder.
          */
@@ -562,6 +584,7 @@ public class MdnsFeatureFlags {
                     mIsSocketClientNetworkGuessingEnabled,
                     mIsCacheFlushPerAddressTypeEnabled,
                     mIsOptimizedExpiredServiceRemovalEnabled,
+                    mMdnsSocketThreadStatsTag,
                     mOverrideProvider);
         }
     }
diff --git a/service-t/src/com/android/server/connectivity/mdns/MdnsSocket.java b/service-t/src/com/android/server/connectivity/mdns/MdnsSocket.java
index 653ea6ccad..e69c819299 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MdnsSocket.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MdnsSocket.java
@@ -64,7 +64,6 @@ public class MdnsSocket {
         // Time to live is set 255, which is similar to the jMDNS implementation.
         multicastSocket.setTimeToLive(255);
 
-        // TODO (changed when importing code): consider tagging the socket for data usage
         isOnIPv6OnlyNetwork = false;
     }
 
diff --git a/service-t/src/com/android/server/connectivity/mdns/MdnsSocketClient.java b/service-t/src/com/android/server/connectivity/mdns/MdnsSocketClient.java
index 0d727794ea..dceb9078b2 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MdnsSocketClient.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MdnsSocketClient.java
@@ -22,6 +22,7 @@ import android.annotation.Nullable;
 import android.annotation.RequiresPermission;
 import android.content.Context;
 import android.net.Network;
+import android.net.TrafficStats;
 import android.net.wifi.WifiManager.MulticastLock;
 import android.os.SystemClock;
 import android.text.format.DateUtils;
@@ -145,7 +146,10 @@ public class MdnsSocketClient implements MdnsSocketClientBase {
         shouldStopSocketLoop = false;
         interfaceProvider.startWatchingConnectivityChanges();
         try {
-            // TODO (changed when importing code): consider setting thread stats tag
+            if (mdnsFeatureFlags.mMdnsSocketThreadStatsTag
+                    != MdnsFeatureFlags.MDNS_SOCKET_THREAD_STATS_TAG_NONE) {
+                setThreadStatsTag(mdnsFeatureFlags.mMdnsSocketThreadStatsTag);
+            }
             multicastSocket = createMdnsSocket(MdnsConstants.MDNS_PORT, sharedLog);
             multicastSocket.joinGroup();
             if (useSeparateSocketForUnicast) {
@@ -165,7 +169,10 @@ public class MdnsSocketClient implements MdnsSocketClientBase {
             }
             throw e;
         } finally {
-            // TODO (changed when importing code): consider resetting thread stats tag
+            if (mdnsFeatureFlags.mMdnsSocketThreadStatsTag
+                    != MdnsFeatureFlags.MDNS_SOCKET_THREAD_STATS_TAG_NONE) {
+                clearThreadStatsTag();
+            }
         }
         createAndStartSendThread();
         createAndStartReceiverThreads();
@@ -516,6 +523,16 @@ public class MdnsSocketClient implements MdnsSocketClientBase {
         return new MdnsSocket(interfaceProvider, port, sharedLog);
     }
 
+    @VisibleForTesting
+    void setThreadStatsTag(int tag) {
+        TrafficStats.setThreadStatsTag(tag);
+    }
+
+    @VisibleForTesting
+    void clearThreadStatsTag() {
+        TrafficStats.clearThreadStatsTag();
+    }
+
     private void sendPackets(List<DatagramPacket> packets, MdnsSocket socket) {
         String requestType = socket == multicastSocket ? "multicast" : "unicast";
         for (DatagramPacket packet : packets) {
diff --git a/tests/unit/java/com/android/server/connectivity/mdns/MdnsSocketClientTests.java b/tests/unit/java/com/android/server/connectivity/mdns/MdnsSocketClientTests.java
index ab70e385dd..6c128804e8 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/MdnsSocketClientTests.java
+++ b/tests/unit/java/com/android/server/connectivity/mdns/MdnsSocketClientTests.java
@@ -27,9 +27,11 @@ import static org.mockito.ArgumentMatchers.anyInt;
 import static org.mockito.ArgumentMatchers.argThat;
 import static org.mockito.ArgumentMatchers.eq;
 import static org.mockito.Mockito.doAnswer;
+import static org.mockito.Mockito.doNothing;
 import static org.mockito.Mockito.doReturn;
 import static org.mockito.Mockito.inOrder;
 import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.spy;
 import static org.mockito.Mockito.timeout;
 import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
@@ -102,15 +104,7 @@ public class MdnsSocketClientTests {
         when(mockWifiManager.createMulticastLock(ArgumentMatchers.anyString()))
                 .thenReturn(mockMulticastLock);
 
-        mdnsClient = new MdnsSocketClient(mContext, mockMulticastLock, sharedLog, flags) {
-                    @Override
-                    MdnsSocket createMdnsSocket(int port, SharedLog sharedLog) throws IOException {
-                        if (port == MdnsConstants.MDNS_PORT) {
-                            return mockMulticastSocket;
-                        }
-                        return mockUnicastSocket;
-                    }
-                };
+        mdnsClient = makeTestSocketClient(flags);
         mdnsClient.setCallback(mockCallback);
 
         doAnswer(
@@ -217,6 +211,18 @@ public class MdnsSocketClientTests {
                 .receive(any(DatagramPacket.class));
     }
 
+    private MdnsSocketClient makeTestSocketClient(MdnsFeatureFlags flags) {
+        return new MdnsSocketClient(mContext, mockMulticastLock, sharedLog, flags) {
+            @Override
+            MdnsSocket createMdnsSocket(int port, SharedLog sharedLog) throws IOException {
+                if (port == MdnsConstants.MDNS_PORT) {
+                    return mockMulticastSocket;
+                }
+                return mockUnicastSocket;
+            }
+        };
+    }
+
     @After
     public void tearDown() {
         mdnsClient.stopDiscovery();
@@ -620,6 +626,26 @@ public class MdnsSocketClientTests {
         }, () -> Log.setWtfHandler(originalHandler));
     }
 
+    @Test
+    public void testSetThreadStatsTag() throws IOException {
+        final MdnsFeatureFlags flags = MdnsFeatureFlags.newBuilder()
+                .setMdnsSocketThreadStatsTag(42).build();
+
+        final MdnsSocketClient socketClient = spy(makeTestSocketClient(flags));
+
+
+        doNothing().when(socketClient).setThreadStatsTag(anyInt());
+        doNothing().when(socketClient).clearThreadStatsTag();
+        final InOrder inOrder = inOrder(socketClient);
+        socketClient.startDiscovery();
+
+        testAndCleanup(() -> {
+            inOrder.verify(socketClient).setThreadStatsTag(42);
+            inOrder.verify(socketClient).createMdnsSocket(anyInt(), any());
+            inOrder.verify(socketClient).clearThreadStatsTag();
+        }, socketClient::stopDiscovery);
+    }
+
     private DatagramPacket getTestDatagramPacket() {
         return new DatagramPacket(buf, 0, 5,
                 new InetSocketAddress(MdnsConstants.getMdnsIPv4Address(), 5353 /* port */));

From b5fbc0143af3409c5c8c660c3ecb34d4e964efdb Mon Sep 17 00:00:00 2001
From: Remi NGUYEN VAN <reminv@google.com>
Date: Fri, 4 Apr 2025 13:11:08 +0900
Subject: [PATCH 072/377] Ensure PacketHandler is removed from sockets

When MdnsMultinetworkSocketClient stops using a socket (when
isSocketActive starts returning false), the packet handler should be
removed from that socket. The code only removed it from the
mSocketPacketHandlers map without clearing it from the socket.

This caused packets to be handled potentially many times, affecting
performance.

Bug: 406623719
Bug: 408324621
Test: atest
Flag: EXEMPT bugfix
Change-Id: I3d1117a4b847f3b95a01fc8a5997a53655ef608a
---
 .../mdns/MdnsMultinetworkSocketClient.java          | 13 +++++++++----
 .../mdns/MdnsMultinetworkSocketClientTest.java      |  5 +++++
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/service-t/src/com/android/server/connectivity/mdns/MdnsMultinetworkSocketClient.java b/service-t/src/com/android/server/connectivity/mdns/MdnsMultinetworkSocketClient.java
index 36fad31746..4c760d6d18 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MdnsMultinetworkSocketClient.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MdnsMultinetworkSocketClient.java
@@ -101,7 +101,7 @@ public class MdnsMultinetworkSocketClient implements MdnsSocketClientBase {
                 @NonNull MdnsInterfaceSocket socket) {
             mActiveSockets.remove(socketKey);
             mSocketCreationCallback.onSocketDestroyed(socketKey);
-            maybeCleanupPacketHandler(socketKey);
+            maybeCleanupPacketHandler(socketKey, socket);
         }
 
         private void notifySocketDestroyed(@NonNull SocketKey socketKey) {
@@ -115,8 +115,9 @@ public class MdnsMultinetworkSocketClient implements MdnsSocketClientBase {
             for (int i = mActiveSockets.size() - 1; i >= 0; i--) {
                 // Iterate from the end so the socket can be removed
                 final SocketKey socketKey = mActiveSockets.keyAt(i);
+                final MdnsInterfaceSocket socket = mActiveSockets.valueAt(i);
                 notifySocketDestroyed(socketKey);
-                maybeCleanupPacketHandler(socketKey);
+                maybeCleanupPacketHandler(socketKey, socket);
             }
         }
     }
@@ -143,9 +144,13 @@ public class MdnsMultinetworkSocketClient implements MdnsSocketClientBase {
         return null;
     }
 
-    private void maybeCleanupPacketHandler(@NonNull SocketKey socketKey) {
+    private void maybeCleanupPacketHandler(@NonNull SocketKey socketKey,
+            @NonNull MdnsInterfaceSocket socket) {
         if (isSocketActive(socketKey)) return;
-        mSocketPacketHandlers.remove(socketKey);
+        final ReadPacketHandler handler = mSocketPacketHandlers.remove(socketKey);
+        if (handler != null) {
+            socket.removePacketHandler(handler);
+        }
     }
 
     private class ReadPacketHandler implements MulticastPacketReader.PacketHandler {
diff --git a/tests/unit/java/com/android/server/connectivity/mdns/MdnsMultinetworkSocketClientTest.java b/tests/unit/java/com/android/server/connectivity/mdns/MdnsMultinetworkSocketClientTest.java
index 4c71991474..e115d5a882 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/MdnsMultinetworkSocketClientTest.java
+++ b/tests/unit/java/com/android/server/connectivity/mdns/MdnsMultinetworkSocketClientTest.java
@@ -357,6 +357,8 @@ public class MdnsMultinetworkSocketClientTest {
         verify(mProvider).unrequestSocket(callback);
         verify(mSocketCreationCallback).onSocketDestroyed(mSocketKey);
         verify(mSocketCreationCallback).onSocketDestroyed(otherSocketKey);
+        verify(mSocket).removePacketHandler(any());
+        verify(otherSocket).removePacketHandler(any());
     }
 
     @Test
@@ -375,8 +377,10 @@ public class MdnsMultinetworkSocketClientTest {
         // Notify socket destroyed
         callback.onInterfaceDestroyed(mSocketKey, mSocket);
         verify(mSocketCreationCallback).onSocketDestroyed(mSocketKey);
+        verify(mSocket).removePacketHandler(any());
         callback.onInterfaceDestroyed(otherSocketKey, otherSocket);
         verify(mSocketCreationCallback).onSocketDestroyed(otherSocketKey);
+        verify(otherSocket).removePacketHandler(any());
     }
 
     @Test
@@ -413,6 +417,7 @@ public class MdnsMultinetworkSocketClientTest {
         verify(creationCallback2).onSocketDestroyed(mSocketKey);
         verify(creationCallback3).onSocketDestroyed(mSocketKey);
         verify(creationCallback3, never()).onSocketDestroyed(socketKey2);
+        verify(mSocket).removePacketHandler(any());
     }
 
     @Test

From 75a83c51ad8e0a34bc606fb9992ef594c6d24f44 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Thu, 3 Apr 2025 21:51:24 -0700
Subject: [PATCH 073/377] Rewrite RouterAdvertisementResponder in Kotlin

And integrate into EthernetManager. So it can make proper use of
PacketBuilderUtils.

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: Ifbca38e6efde68e015c69bf919d079d1605310d1
---
 .../com/android/testutils/NdResponder.kt      | 150 ++++++++++++++++++
 .../android/net/cts/EthernetManagerTest.kt    |  14 +-
 2 files changed, 157 insertions(+), 7 deletions(-)
 create mode 100644 staticlibs/testutils/devicetests/com/android/testutils/NdResponder.kt

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/NdResponder.kt b/staticlibs/testutils/devicetests/com/android/testutils/NdResponder.kt
new file mode 100644
index 0000000000..d578b0362c
--- /dev/null
+++ b/staticlibs/testutils/devicetests/com/android/testutils/NdResponder.kt
@@ -0,0 +1,150 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License
+ */
+
+package com.android.testutils
+
+import android.net.IpPrefix
+import android.net.MacAddress
+import android.system.OsConstants.IPPROTO_ICMPV6
+import android.util.ArrayMap
+import android.util.Log
+import com.android.net.module.util.NetworkStackConstants.ETHER_TYPE_IPV6
+import com.android.net.module.util.NetworkStackConstants.ICMPV6_NEIGHBOR_SOLICITATION
+import com.android.net.module.util.NetworkStackConstants.ICMPV6_ROUTER_SOLICITATION
+import com.android.net.module.util.Struct
+import com.android.net.module.util.structs.EthernetHeader
+import com.android.net.module.util.structs.Icmpv6Header
+import com.android.net.module.util.structs.Ipv6Header
+import com.android.net.module.util.structs.NsHeader
+import java.io.FileOutputStream
+import java.io.IOException
+import java.net.Inet6Address
+import java.nio.ByteBuffer
+import kotlin.random.Random
+
+private const val TAG = "NdResponder"
+
+class NdResponder(
+    val packetReader: PollPacketReader,
+    val prefix: IpPrefix,
+) : PacketResponder(packetReader, ::isRsOrNs, TAG) {
+    companion object {
+        private fun isRsOrNs(packet: ByteArray): Boolean {
+            val buffer = ByteBuffer.wrap(packet)
+            val ethHeader = Struct.parse(EthernetHeader::class.java, buffer)
+            if (ethHeader.etherType.toInt() != ETHER_TYPE_IPV6) return false
+
+            val ipv6Header = Struct.parse(Ipv6Header::class.java, buffer)
+            if (ipv6Header.nextHeader.toInt() != IPPROTO_ICMPV6) return false
+
+            val icmpv6Header = Struct.parse(Icmpv6Header::class.java, buffer)
+            return icmpv6Header.type.toInt() == ICMPV6_ROUTER_SOLICITATION ||
+                    icmpv6Header.type.toInt() == ICMPV6_NEIGHBOR_SOLICITATION
+        }
+
+        private fun makeRandomPrefix(): IpPrefix {
+            val prefixBytes = IpPrefix("2001:db8::/64").address.address
+            Random.Default.nextBytes(prefixBytes, fromIndex = 4, toIndex = 16)
+            return IpPrefix(prefixBytes, 64)
+        }
+    }
+
+    data class NeighborEntry(
+        val macAddr: MacAddress,
+        val ipAddr: Inet6Address,
+        val isRouter: Boolean,
+    )
+    private val neighborMap: MutableMap<Inet6Address, NeighborEntry> = ArrayMap()
+
+    constructor(packetReader: PollPacketReader) : this(packetReader, makeRandomPrefix())
+
+    /**
+     * Adds a new router to be advertised.
+     * @param mac the mac address of the router.
+     * @param ip the link-local address of the router.
+     */
+    fun addRouterEntry(mac: MacAddress, ip: Inet6Address) {
+        neighborMap[ip] = NeighborEntry(mac, ip, true)
+    }
+
+    /**
+     * Adds a new neighbor to be advertised.
+     * @param mac the mac address of the neighbor.
+     * @param ip the link-local address of the neighbor.
+     */
+    fun addNeighborEntry(mac: MacAddress, ip: Inet6Address) {
+        neighborMap[ip] = NeighborEntry(mac, ip, false)
+    }
+
+    private fun sendPacket(reader: PollPacketReader, packet: ByteArray) {
+        try {
+            // Note: PollPacketReader#createFd() is just a getter for the underlying fd.
+            FileOutputStream(reader.createFd()).use { it.write(packet) }
+        } catch (e: IOException) {
+            // Throwing an exception here will crash the test process.
+            Log.e(TAG, "Failed to send packet", e)
+        }
+    }
+
+    private fun replyToRouterSolicitation(reader: PollPacketReader, dstMac: MacAddress) {
+        for ((ip, neigh) in neighborMap) {
+            if (!neigh.isRouter) continue
+            // TODO: add prefix to neighborMap
+            val ether = EtherPkt(src = neigh.macAddr, dst = dstMac)
+            val ip6 = Ip6Pkt(src = neigh.ipAddr.hostAddress, dst = "ff02::1")
+            val ra = RaPkt()
+                    .addPioOption(prefix = prefix.toString(), flags = "LA")
+                    .addRdnssOption(dns = "2001:4860:4860::8888,2001:4860:4860::8844")
+            val p = ether / ip6 / ra
+            sendPacket(reader, p.build())
+        }
+    }
+
+    private fun replyToNeighborSolicitation(
+        reader: PollPacketReader,
+        dstMac: MacAddress,
+        dstIp: Inet6Address,
+        targetIp: Inet6Address
+    ) {
+        val neighbor = neighborMap[targetIp]
+        if (neighbor == null) return
+
+        val ether = EtherPkt(dst = dstMac, src = neighbor.macAddr)
+        val ipv6 = Ip6Pkt(src = neighbor.ipAddr, dst = dstIp)
+        val flags = if (neighbor.isRouter) "RSO" else "SO"
+        val na = NaPkt(targetIp.hostAddress, flags)
+                .addTllaOption(neighbor.macAddr)
+        val p = ether / ipv6 / na
+        sendPacket(reader, p.build())
+    }
+
+    protected override fun replyToPacket(packet: ByteArray, reader: PollPacketReader) {
+        val buf = ByteBuffer.wrap(packet)
+        // Messages are filtered by parent class, so it is safe to assume that packet is either an
+        // RS or NS.
+        val ethHdr = Struct.parse(EthernetHeader::class.java, buf)
+        val ipv6Hdr = Struct.parse(Ipv6Header::class.java, buf)
+        val icmpv6Header = Struct.parse(Icmpv6Header::class.java, buf)
+
+        when (icmpv6Header.type.toInt()) {
+            ICMPV6_ROUTER_SOLICITATION -> replyToRouterSolicitation(reader, ethHdr.srcMac)
+            ICMPV6_NEIGHBOR_SOLICITATION -> {
+                val nsHeader = Struct.parse(NsHeader::class.java, buf)
+                replyToNeighborSolicitation(reader, ethHdr.srcMac, ipv6Hdr.srcIp, nsHeader.target)
+            }
+        }
+    }
+}
diff --git a/tests/cts/net/src/android/net/cts/EthernetManagerTest.kt b/tests/cts/net/src/android/net/cts/EthernetManagerTest.kt
index 9f3213206f..9065b4e1f9 100644
--- a/tests/cts/net/src/android/net/cts/EthernetManagerTest.kt
+++ b/tests/cts/net/src/android/net/cts/EthernetManagerTest.kt
@@ -68,11 +68,11 @@ import com.android.testutils.ConnectivityModuleTest
 import com.android.testutils.DevSdkIgnoreRule
 import com.android.testutils.DevSdkIgnoreRunner
 import com.android.testutils.DeviceInfoUtils.isKernelVersionAtLeast
+import com.android.testutils.NdResponder
 import com.android.testutils.RecorderCallback.CallbackEntry.Available
 import com.android.testutils.RecorderCallback.CallbackEntry.CapabilitiesChanged
 import com.android.testutils.RecorderCallback.CallbackEntry.LinkPropertiesChanged
 import com.android.testutils.RecorderCallback.CallbackEntry.Lost
-import com.android.testutils.RouterAdvertisementResponder
 import com.android.testutils.PollPacketReader
 import com.android.testutils.TestableNetworkCallback
 import com.android.testutils.assertThrows
@@ -156,10 +156,10 @@ class EthernetManagerTest {
     ) {
         private val tapInterface: TestNetworkInterface
         private val packetReader: PollPacketReader
-        private val raResponder: RouterAdvertisementResponder
+        private val ndResponder: NdResponder
         private val tnm: TestNetworkManager
         val name get() = tapInterface.interfaceName
-        val onLinkPrefix get() = raResponder.prefix
+        val onLinkPrefix get() = ndResponder.prefix
 
         init {
             tnm = runAsShell(MANAGE_TEST_NETWORKS) {
@@ -183,13 +183,13 @@ class EthernetManagerTest {
                     tapInterface.fileDescriptor.fileDescriptor,
                     mtu
             )
-            raResponder = RouterAdvertisementResponder(packetReader)
+            ndResponder = NdResponder(packetReader)
             val iidString = "fe80::${Integer.toHexString(Random().nextInt(65536))}"
             val linklocal = InetAddresses.parseNumericAddress(iidString) as Inet6Address
-            raResponder.addRouterEntry(MacAddress.fromString("01:23:45:67:89:ab"), linklocal)
+            ndResponder.addRouterEntry(MacAddress.fromString("01:23:45:67:89:ab"), linklocal)
 
             packetReader.startAsyncForTest()
-            raResponder.start()
+            ndResponder.start()
         }
 
         // WARNING: this function requires kernel support. Call assumeChangingCarrierSupported() at
@@ -201,7 +201,7 @@ class EthernetManagerTest {
         }
 
         fun destroy() {
-            raResponder.stop()
+            ndResponder.stop()
             handler.post({ packetReader.stop() })
             handler.waitForIdle(TIMEOUT_MS)
         }

From d107a1692f42df516bf345426457f93f3fbf5888 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Thu, 3 Apr 2025 22:09:47 -0700
Subject: [PATCH 074/377] Delete RouterAdvertisementResponder

And move all other tests over to NdResponder.

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: Ia1e08c439a039a4ffa020318da44652fadadf5c9
---
 .../RouterAdvertisementResponder.java         | 208 ------------------
 .../src/android/net/cts/DnsResolverTapTest.kt |   6 +-
 .../net/src/android/net/cts/DscpPolicyTest.kt |  14 +-
 3 files changed, 10 insertions(+), 218 deletions(-)
 delete mode 100644 staticlibs/testutils/devicetests/com/android/testutils/RouterAdvertisementResponder.java

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/RouterAdvertisementResponder.java b/staticlibs/testutils/devicetests/com/android/testutils/RouterAdvertisementResponder.java
deleted file mode 100644
index 6709555f3a..0000000000
--- a/staticlibs/testutils/devicetests/com/android/testutils/RouterAdvertisementResponder.java
+++ /dev/null
@@ -1,208 +0,0 @@
-/*
- * Copyright (C) 2022 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package com.android.testutils;
-
-import static android.system.OsConstants.IPPROTO_ICMPV6;
-
-import static com.android.net.module.util.NetworkStackConstants.ETHER_TYPE_IPV6;
-import static com.android.net.module.util.NetworkStackConstants.ICMPV6_ND_OPTION_SLLA;
-import static com.android.net.module.util.NetworkStackConstants.ICMPV6_ND_OPTION_TLLA;
-import static com.android.net.module.util.NetworkStackConstants.ICMPV6_NEIGHBOR_SOLICITATION;
-import static com.android.net.module.util.NetworkStackConstants.ICMPV6_ROUTER_SOLICITATION;
-import static com.android.net.module.util.NetworkStackConstants.IPV6_ADDR_ALL_NODES_MULTICAST;
-import static com.android.net.module.util.NetworkStackConstants.NEIGHBOR_ADVERTISEMENT_FLAG_OVERRIDE;
-import static com.android.net.module.util.NetworkStackConstants.NEIGHBOR_ADVERTISEMENT_FLAG_ROUTER;
-import static com.android.net.module.util.NetworkStackConstants.NEIGHBOR_ADVERTISEMENT_FLAG_SOLICITED;
-import static com.android.net.module.util.NetworkStackConstants.PIO_FLAG_AUTONOMOUS;
-import static com.android.net.module.util.NetworkStackConstants.PIO_FLAG_ON_LINK;
-
-import android.net.InetAddresses;
-import android.net.IpPrefix;
-import android.net.MacAddress;
-import android.util.ArrayMap;
-import android.util.Log;
-import android.util.Pair;
-
-import com.android.net.module.util.Ipv6Utils;
-import com.android.net.module.util.Struct;
-import com.android.net.module.util.structs.EthernetHeader;
-import com.android.net.module.util.structs.Icmpv6Header;
-import com.android.net.module.util.structs.Ipv6Header;
-import com.android.net.module.util.structs.LlaOption;
-import com.android.net.module.util.structs.NsHeader;
-import com.android.net.module.util.structs.PrefixInformationOption;
-import com.android.net.module.util.structs.RdnssOption;
-
-import java.io.IOException;
-import java.net.Inet6Address;
-import java.nio.ByteBuffer;
-import java.util.Map;
-import java.util.Objects;
-import java.util.Random;
-
-/**
- * ND (RA & NA) responder class useful for tests that require a provisioned IPv6 interface.
- * TODO: rename to NdResponder
- */
-public class RouterAdvertisementResponder extends PacketResponder {
-    private static final String TAG = "RouterAdvertisementResponder";
-    private static final Inet6Address DNS_SERVER =
-            (Inet6Address) InetAddresses.parseNumericAddress("2001:4860:4860::64");
-    private final PollPacketReader mPacketReader;
-    // Maps IPv6 address to MacAddress and isRouter boolean.
-    private final Map<Inet6Address, Pair<MacAddress, Boolean>> mNeighborMap = new ArrayMap<>();
-    private final IpPrefix mPrefix;
-
-    public RouterAdvertisementResponder(PollPacketReader packetReader, IpPrefix prefix) {
-        super(packetReader, RouterAdvertisementResponder::isRsOrNs, TAG);
-        mPacketReader = packetReader;
-        mPrefix = Objects.requireNonNull(prefix);
-    }
-
-    public RouterAdvertisementResponder(PollPacketReader packetReader) {
-        this(packetReader, makeRandomPrefix());
-    }
-
-    private static IpPrefix makeRandomPrefix() {
-        final byte[] prefixBytes = new IpPrefix("2001:db8::/64").getAddress().getAddress();
-        final Random r = new Random();
-        for (int i = 4; i < 8; i++) {
-            prefixBytes[i] = (byte) r.nextInt();
-        }
-        return new IpPrefix(prefixBytes, 64);
-    }
-
-    /** Returns true if the packet is a router solicitation or neighbor solicitation message. */
-    private static boolean isRsOrNs(byte[] packet) {
-        final ByteBuffer buffer = ByteBuffer.wrap(packet);
-        final EthernetHeader ethHeader = Struct.parse(EthernetHeader.class, buffer);
-        if (ethHeader.etherType != ETHER_TYPE_IPV6) {
-            return false;
-        }
-        final Ipv6Header ipv6Header = Struct.parse(Ipv6Header.class, buffer);
-        if (ipv6Header.nextHeader != IPPROTO_ICMPV6) {
-            return false;
-        }
-        final Icmpv6Header icmpv6Header = Struct.parse(Icmpv6Header.class, buffer);
-        return icmpv6Header.type == ICMPV6_ROUTER_SOLICITATION
-            || icmpv6Header.type == ICMPV6_NEIGHBOR_SOLICITATION;
-    }
-
-    /**
-     * Adds a new router to be advertised.
-     * @param mac the mac address of the router.
-     * @param ip the link-local address of the router.
-     */
-    public void addRouterEntry(MacAddress mac, Inet6Address ip) {
-        mNeighborMap.put(ip, new Pair<>(mac, true));
-    }
-
-    /**
-     * Adds a new neighbor to be advertised.
-     * @param mac the mac address of the neighbor.
-     * @param ip the link-local address of the neighbor.
-     */
-    public void addNeighborEntry(MacAddress mac, Inet6Address ip) {
-        mNeighborMap.put(ip, new Pair<>(mac, false));
-    }
-
-    /**
-     * @return the prefix that is announced in the Router Advertisements sent by this object.
-     */
-    public IpPrefix getPrefix() {
-        return mPrefix;
-    }
-
-    private ByteBuffer buildPrefixOption() {
-        return PrefixInformationOption.build(
-                mPrefix, (byte) (PIO_FLAG_ON_LINK | PIO_FLAG_AUTONOMOUS),
-                3600 /* valid lifetime */, 3600 /* preferred lifetime */);
-    }
-
-    private ByteBuffer buildRdnssOption() {
-        return RdnssOption.build(3600/*lifetime, must be at least 120*/, DNS_SERVER);
-    }
-
-    private ByteBuffer buildSllaOption(MacAddress srcMac) {
-        return LlaOption.build((byte) ICMPV6_ND_OPTION_SLLA, srcMac);
-    }
-
-    private ByteBuffer buildRaPacket(MacAddress srcMac, MacAddress dstMac, Inet6Address srcIp) {
-        return Ipv6Utils.buildRaPacket(srcMac, dstMac, srcIp, IPV6_ADDR_ALL_NODES_MULTICAST,
-                (byte) 0 /*M=0, O=0*/, 3600 /*lifetime*/, 0 /*reachableTime, unspecified*/,
-                0/*retransTimer, unspecified*/, buildPrefixOption(), buildRdnssOption(),
-                buildSllaOption(srcMac));
-    }
-
-    private static void sendResponse(PollPacketReader reader, ByteBuffer buffer) {
-        try {
-            reader.sendResponse(buffer);
-        } catch (IOException e) {
-            // Throwing an exception here will crash the test process. Let's stick to logging, as
-            // the test will fail either way.
-            Log.e(TAG, "Failed to send buffer", e);
-        }
-    }
-
-    private void replyToRouterSolicitation(PollPacketReader reader, MacAddress dstMac) {
-        for (Map.Entry<Inet6Address, Pair<MacAddress, Boolean>> it : mNeighborMap.entrySet()) {
-            final boolean isRouter = it.getValue().second;
-            if (!isRouter) {
-                continue;
-            }
-            final ByteBuffer raResponse = buildRaPacket(it.getValue().first, dstMac, it.getKey());
-            sendResponse(reader, raResponse);
-        }
-    }
-
-    private void replyToNeighborSolicitation(PollPacketReader reader, MacAddress dstMac,
-            Inet6Address dstIp, Inet6Address targetIp) {
-        final Pair<MacAddress, Boolean> neighbor = mNeighborMap.get(targetIp);
-        if (neighbor == null) {
-            return;
-        }
-
-        final MacAddress srcMac = neighbor.first;
-        final boolean isRouter = neighbor.second;
-        int flags = NEIGHBOR_ADVERTISEMENT_FLAG_SOLICITED | NEIGHBOR_ADVERTISEMENT_FLAG_OVERRIDE;
-        if (isRouter) {
-            flags |= NEIGHBOR_ADVERTISEMENT_FLAG_ROUTER;
-        }
-
-        final ByteBuffer tlla = LlaOption.build((byte) ICMPV6_ND_OPTION_TLLA, srcMac);
-        final ByteBuffer naResponse = Ipv6Utils.buildNaPacket(srcMac, dstMac, targetIp, dstIp,
-                flags, targetIp, tlla);
-        sendResponse(reader, naResponse);
-    }
-
-    @Override
-    protected void replyToPacket(byte[] packet, PollPacketReader reader) {
-        final ByteBuffer buf = ByteBuffer.wrap(packet);
-        // Messages are filtered by parent class, so it is safe to assume that packet is either an
-        // RS or NS.
-        final EthernetHeader ethHdr = Struct.parse(EthernetHeader.class, buf);
-        final Ipv6Header ipv6Hdr = Struct.parse(Ipv6Header.class, buf);
-        final Icmpv6Header icmpv6Header = Struct.parse(Icmpv6Header.class, buf);
-
-        if (icmpv6Header.type == ICMPV6_ROUTER_SOLICITATION) {
-            replyToRouterSolicitation(reader, ethHdr.srcMac);
-        } else if (icmpv6Header.type == ICMPV6_NEIGHBOR_SOLICITATION) {
-            final NsHeader nsHeader = Struct.parse(NsHeader.class, buf);
-            replyToNeighborSolicitation(reader, ethHdr.srcMac, ipv6Hdr.srcIp, nsHeader.target);
-        }
-    }
-}
diff --git a/tests/cts/net/src/android/net/cts/DnsResolverTapTest.kt b/tests/cts/net/src/android/net/cts/DnsResolverTapTest.kt
index ff608f287f..172885dfcf 100644
--- a/tests/cts/net/src/android/net/cts/DnsResolverTapTest.kt
+++ b/tests/cts/net/src/android/net/cts/DnsResolverTapTest.kt
@@ -38,8 +38,8 @@ import com.android.testutils.AutoReleaseNetworkCallbackRule
 import com.android.testutils.DeviceConfigRule
 import com.android.testutils.DnsResolverModuleTest
 import com.android.testutils.IPv6UdpFilter
+import com.android.testutils.NdResponder
 import com.android.testutils.RecorderCallback.CallbackEntry.LinkPropertiesChanged
-import com.android.testutils.RouterAdvertisementResponder
 import com.android.testutils.TapPacketReaderRule
 import com.android.testutils.TestableNetworkAgent
 import com.android.testutils.TestDnsPacket
@@ -92,7 +92,7 @@ class DnsResolverTapTest {
     @get:Rule(order = 4)
     val cbRule = AutoReleaseNetworkCallbackRule()
 
-    private val ndResponder by lazy { RouterAdvertisementResponder(packetReaderRule.reader) }
+    private val ndResponder by lazy { NdResponder(packetReaderRule.reader) }
     private val dnsServerAddr by lazy {
         parseNumericAddress("fe80::124%${packetReaderRule.iface.interfaceName}") as Inet6Address
     }
@@ -182,4 +182,4 @@ class DnsResolverTapTest {
         doCancellationTest("test2.example.com",
             waitTimeForNoRetryAfterCancellationMs = timeWithRetryWhenNotCancelled + 50L)
     }
-}
\ No newline at end of file
+}
diff --git a/tests/cts/net/src/android/net/cts/DscpPolicyTest.kt b/tests/cts/net/src/android/net/cts/DscpPolicyTest.kt
index d531e7abee..1b17c87f0f 100644
--- a/tests/cts/net/src/android/net/cts/DscpPolicyTest.kt
+++ b/tests/cts/net/src/android/net/cts/DscpPolicyTest.kt
@@ -70,7 +70,7 @@ import com.android.testutils.ArpResponder
 import com.android.testutils.CompatUtil
 import com.android.testutils.ConnectivityModuleTest
 import com.android.testutils.DevSdkIgnoreRule
-import com.android.testutils.RouterAdvertisementResponder
+import com.android.testutils.NdResponder
 import com.android.testutils.SC_V2
 import com.android.testutils.PollPacketReader
 import com.android.testutils.TestableNetworkAgent
@@ -138,7 +138,7 @@ class DscpPolicyTest {
     private lateinit var tunNetworkCallback: TestNetworkCallback
     private lateinit var reader: PollPacketReader
     private lateinit var arpResponder: ArpResponder
-    private lateinit var raResponder: RouterAdvertisementResponder
+    private lateinit var ndResponder: NdResponder
 
     private fun getKernelVersion(): IntArray {
         // Example:
@@ -182,9 +182,9 @@ class DscpPolicyTest {
 
         arpResponder = ArpResponder(reader, mapOf(TEST_TARGET_IPV4_ADDR to TEST_TARGET_MAC_ADDR))
         arpResponder.start()
-        raResponder = RouterAdvertisementResponder(reader)
-        raResponder.addRouterEntry(TEST_TARGET_MAC_ADDR, TEST_ROUTER_IPV6_ADDR)
-        raResponder.start()
+        ndResponder = NdResponder(reader)
+        ndResponder.addRouterEntry(TEST_TARGET_MAC_ADDR, TEST_ROUTER_IPV6_ADDR)
+        ndResponder.start()
     }
 
     @After
@@ -192,7 +192,7 @@ class DscpPolicyTest {
         if (!kernelIsAtLeast(5, 15)) {
             return
         }
-        raResponder.stop()
+        ndResponder.stop()
         arpResponder.stop()
 
         agentsToCleanUp.forEach { it.unregister() }
@@ -226,7 +226,7 @@ class DscpPolicyTest {
     private fun waitForGlobalIpv6Address(network: Network): Inet6Address {
         // Wait for global IPv6 address to be available
         var inet6Addr: Inet6Address? = null
-        val onLinkPrefix = raResponder.prefix
+        val onLinkPrefix = ndResponder.prefix
         val startTime = SystemClock.elapsedRealtime()
         while (SystemClock.elapsedRealtime() - startTime < IPV6_ADDRESS_WAIT_TIME_MS) {
             SystemClock.sleep(50 /* ms */)

From 706a61776dc10d7b66a360806b28e0c3be795d3a Mon Sep 17 00:00:00 2001
From: Bessie Jiang <bessiej@google.com>
Date: Fri, 4 Apr 2025 14:22:34 +0000
Subject: [PATCH 075/377] Remove the DataStore from the CT codebase

The DataStore is now unused and can be safely removed. See b/407940468
for more details on why this preferences file was removed.

Fixes: 407940468
Test: atest NetworkSecurityUnitTests
Flag: com.android.net.ct.flags.certificate_transparency_service
Change-Id: Ic4427958acef94984f728398bdb9a6f7e53a9cbe
---
 .../net/ct/CertificateTransparencyJob.java    |  5 --
 .../ct/CertificateTransparencyService.java    |  2 -
 .../src/com/android/server/net/ct/Config.java | 13 ---
 .../android/server/net/ct/DataStoreTest.java  | 89 -------------------
 4 files changed, 109 deletions(-)
 delete mode 100644 networksecurity/tests/unit/src/com/android/server/net/ct/DataStoreTest.java

diff --git a/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyJob.java b/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyJob.java
index 286f3268bf..7240d729b7 100644
--- a/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyJob.java
+++ b/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyJob.java
@@ -37,7 +37,6 @@ public class CertificateTransparencyJob extends BroadcastReceiver {
     private static final String TAG = "CertificateTransparencyJob";
 
     private final Context mContext;
-    private final DataStore mDataStore;
     private final CertificateTransparencyDownloader mCertificateTransparencyDownloader;
     private final SignatureVerifier mSignatureVerifier;
     private final Collection<CompatibilityVersion> mCompatVersions;
@@ -50,12 +49,10 @@ public class CertificateTransparencyJob extends BroadcastReceiver {
     /** Creates a new {@link CertificateTransparencyJob} object. */
     public CertificateTransparencyJob(
             Context context,
-            DataStore dataStore,
             CertificateTransparencyDownloader certificateTransparencyDownloader,
             SignatureVerifier signatureVerifier,
             Collection<CompatibilityVersion> compatVersions) {
         mContext = context;
-        mDataStore = dataStore;
         mCertificateTransparencyDownloader = certificateTransparencyDownloader;
         mSignatureVerifier = signatureVerifier;
         mCompatVersions = compatVersions;
@@ -132,7 +129,6 @@ public class CertificateTransparencyJob extends BroadcastReceiver {
     }
 
     private void startDependencies() {
-        mDataStore.load();
         mSignatureVerifier.loadAllowedKeys();
         mContext.registerReceiver(
                 mCertificateTransparencyDownloader,
@@ -147,7 +143,6 @@ public class CertificateTransparencyJob extends BroadcastReceiver {
     private void stopDependencies() {
         mContext.unregisterReceiver(mCertificateTransparencyDownloader);
         mSignatureVerifier.clearAllowedKeys();
-        mDataStore.delete();
 
         if (Config.DEBUG) {
             Log.d(TAG, "CertificateTransparencyJob dependencies stopped.");
diff --git a/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyService.java b/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyService.java
index 3ce8cb65e2..b009a4afc9 100644
--- a/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyService.java
+++ b/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyService.java
@@ -52,7 +52,6 @@ public class CertificateTransparencyService extends ICertificateTransparencyMana
 
     /** Creates a new {@link CertificateTransparencyService} object. */
     public CertificateTransparencyService(Context context) {
-        DataStore dataStore = new DataStore(Config.PREFERENCES_FILE);
         SignatureVerifier signatureVerifier = new SignatureVerifier(context);
         Collection<CompatibilityVersion> compatVersions =
                 Arrays.asList(
@@ -68,7 +67,6 @@ public class CertificateTransparencyService extends ICertificateTransparencyMana
         mCertificateTransparencyJob =
                 new CertificateTransparencyJob(
                         context,
-                        dataStore,
                         new CertificateTransparencyDownloader(
                                 context,
                                 new DownloadHelper(context),
diff --git a/networksecurity/service/src/com/android/server/net/ct/Config.java b/networksecurity/service/src/com/android/server/net/ct/Config.java
index 72b715aefe..85351696ef 100644
--- a/networksecurity/service/src/com/android/server/net/ct/Config.java
+++ b/networksecurity/service/src/com/android/server/net/ct/Config.java
@@ -15,24 +15,11 @@
  */
 package com.android.server.net.ct;
 
-import android.content.ApexEnvironment;
-
-import com.android.net.module.util.DeviceConfigUtils;
-
-import java.io.File;
-
 /** Class holding the constants used by the CT feature. */
 final class Config {
 
     static final boolean DEBUG = false;
 
-    // preferences file
-    private static final File DEVICE_PROTECTED_DATA_DIR =
-            ApexEnvironment.getApexEnvironment(DeviceConfigUtils.TETHERING_MODULE_NAME)
-                    .getDeviceProtectedDataDir();
-    private static final String PREFERENCES_FILE_NAME = "ct.preferences";
-    static final File PREFERENCES_FILE = new File(DEVICE_PROTECTED_DATA_DIR, PREFERENCES_FILE_NAME);
-
     // CT paths
     static final String CT_ROOT_DIRECTORY_PATH = "/data/misc/keychain/ct/";
     static final String URL_PREFIX = "https://www.gstatic.com/android/certificate_transparency/";
diff --git a/networksecurity/tests/unit/src/com/android/server/net/ct/DataStoreTest.java b/networksecurity/tests/unit/src/com/android/server/net/ct/DataStoreTest.java
deleted file mode 100644
index 3e670d4f91..0000000000
--- a/networksecurity/tests/unit/src/com/android/server/net/ct/DataStoreTest.java
+++ /dev/null
@@ -1,89 +0,0 @@
-/*
- * Copyright (C) 2024 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package com.android.server.net.ct;
-
-import static com.google.common.truth.Truth.assertThat;
-
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.JUnit4;
-
-import java.io.File;
-import java.io.IOException;
-
-/** Tests for the {@link DataStore}. */
-@RunWith(JUnit4.class)
-public class DataStoreTest {
-
-    private File mTempFile;
-    private DataStore mDataStore;
-
-    @Before
-    public void setUp() throws IOException {
-        mTempFile = File.createTempFile("datastore-test", ".properties");
-        mDataStore = new DataStore(mTempFile);
-    }
-
-    @After
-    public void tearDown() {
-        mTempFile.delete();
-    }
-
-    @Test
-    public void testDataStore_propertyFileCreatedSuccessfully() {
-        assertThat(mTempFile.exists()).isTrue();
-        assertThat(mDataStore.isEmpty()).isTrue();
-    }
-
-    @Test
-    public void testDataStore_propertySet() {
-        String stringProperty = "prop1";
-        String stringValue = "i_am_a_string";
-        String longProperty = "prop3";
-        long longValue = 9000;
-
-        assertThat(mDataStore.getProperty(stringProperty)).isNull();
-        assertThat(mDataStore.getPropertyLong(longProperty, -1)).isEqualTo(-1);
-
-        mDataStore.setProperty(stringProperty, stringValue);
-        mDataStore.setPropertyLong(longProperty, longValue);
-
-        assertThat(mDataStore.getProperty(stringProperty)).isEqualTo(stringValue);
-        assertThat(mDataStore.getPropertyLong(longProperty, -1)).isEqualTo(longValue);
-    }
-
-    @Test
-    public void testDataStore_propertyStore() {
-        String stringProperty = "prop1";
-        String stringValue = "i_am_a_string";
-        String longProperty = "prop3";
-        long longValue = 9000;
-
-        mDataStore.setProperty(stringProperty, stringValue);
-        mDataStore.setPropertyLong(longProperty, longValue);
-        mDataStore.store();
-
-        mDataStore.clear();
-        assertThat(mDataStore.getProperty(stringProperty)).isNull();
-        assertThat(mDataStore.getPropertyLong(longProperty, -1)).isEqualTo(-1);
-
-        mDataStore.load();
-        assertThat(mDataStore.getProperty(stringProperty)).isEqualTo(stringValue);
-        assertThat(mDataStore.getPropertyLong(longProperty, -1)).isEqualTo(longValue);
-    }
-}

From 6b24c93fe402200dc4a88b324f43825916af3e21 Mon Sep 17 00:00:00 2001
From: Yuyang Huang <yuyanghuang@google.com>
Date: Sun, 6 Apr 2025 11:50:13 +0900
Subject: [PATCH 076/377] Temporarily disable low power standby during
 ApfIntegrationTest

ApfIntegrationTest includes test cases that require turning off the
screen and waiting before sending packets. On devices with low power
standby capabilities, such as Android TVs, the packets sent by these CTS
test cases can be blocked. To prevent this interference, this commit
temporarily disables the low power standby policy during test execution.

Bug: 407698167
Flag: EXEMPT bug fix
Test: manually test on TV and Phone
Change-Id: I7312626b4d1939847e5bf5267da5e81dab241a64
---
 .../src/android/net/cts/ApfIntegrationTest.kt | 27 +++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt b/tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt
index 7dbb9b24a9..2800db982a 100644
--- a/tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt
+++ b/tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt
@@ -19,6 +19,7 @@
 
 package android.net.cts
 
+import android.Manifest.permission
 import android.content.pm.PackageManager.FEATURE_AUTOMOTIVE
 import android.content.pm.PackageManager.FEATURE_LEANBACK
 import android.content.pm.PackageManager.FEATURE_WIFI
@@ -88,6 +89,7 @@ import com.android.testutils.RecorderCallback.CallbackEntry.LinkPropertiesChange
 import com.android.testutils.SkipPresubmit
 import com.android.testutils.TestableNetworkCallback
 import com.android.testutils.pollingCheck
+import com.android.testutils.runAsShell
 import com.android.testutils.waitForIdle
 import com.google.common.truth.Expect
 import com.google.common.truth.Truth.assertThat
@@ -130,6 +132,8 @@ class ApfIntegrationTest {
         private val context = InstrumentationRegistry.getInstrumentation().context
         private val powerManager = context.getSystemService(PowerManager::class.java)!!
         private val wakeLock = powerManager.newWakeLock(PowerManager.PARTIAL_WAKE_LOCK, TAG)
+        private var isLowPowerStandbyOriginalEnabled: Boolean = false
+        private var originalPolicy: PowerManager.LowPowerStandbyPolicy? = null
 
         fun turnScreenOff() {
             if (!wakeLock.isHeld()) wakeLock.acquire()
@@ -166,6 +170,27 @@ class ApfIntegrationTest {
                     userManager.isVisibleBackgroundUsersSupported)
         }
 
+        private fun disableLowPowerStandby() {
+            runAsShell(permission.DEVICE_POWER) {
+                if (powerManager.isLowPowerStandbySupported) {
+                    isLowPowerStandbyOriginalEnabled = powerManager.isLowPowerStandbyEnabled
+                    originalPolicy = powerManager.lowPowerStandbyPolicy
+                    powerManager.isLowPowerStandbyEnabled = false
+                    Log.i(TAG, "Low power standby is supported, disabling it temporary.")
+                }
+            }
+        }
+
+        private fun restoreLowPowerStandby() {
+            runAsShell(permission.DEVICE_POWER) {
+                if (powerManager.isLowPowerStandbySupported) {
+                    powerManager.isLowPowerStandbyEnabled = isLowPowerStandbyOriginalEnabled
+                    powerManager.lowPowerStandbyPolicy = originalPolicy
+                    Log.i(TAG, "Reset Low power standby to original state.")
+                }
+            }
+        }
+
         @BeforeClass
         @JvmStatic
         @Suppress("ktlint:standard:no-multi-spaces")
@@ -180,12 +205,14 @@ class ApfIntegrationTest {
             Thread.sleep(1000)
             // TODO: check that there is no active wifi network. Otherwise, ApfFilter has already been
             // created.
+            disableLowPowerStandby()
         }
 
         @AfterClass
         @JvmStatic
         fun tearDownOnce() {
             turnScreenOn()
+            restoreLowPowerStandby()
         }
     }
 

From 4f07a5b9115538adcac844d872e0a6070db68410 Mon Sep 17 00:00:00 2001
From: Chalard Jean <jchalard@google.com>
Date: Fri, 7 Mar 2025 10:54:52 +0900
Subject: [PATCH 077/377] Parcel Network#mPrivateDnsBypass

Though all versions will parcel this, the behavior will not change
before B. Starting with B, this flag is parceled and handed over
to apps.

Test: ConnectivityCoverageTests, CtsNetTestCases
Flag: EXEMPT no behavior change before B
Change-Id: I7e9ae9011c74b80c208d8f297aa3b7d1aea176f2
---
 framework/src/android/net/Network.java        | 50 ++++++++++++-------
 .../common/java/android/net/NetworkTest.java  | 34 +++++++++++++
 2 files changed, 65 insertions(+), 19 deletions(-)

diff --git a/framework/src/android/net/Network.java b/framework/src/android/net/Network.java
index 53f171a017..bc8071277a 100644
--- a/framework/src/android/net/Network.java
+++ b/framework/src/android/net/Network.java
@@ -29,6 +29,7 @@ import android.system.Os;
 import android.system.OsConstants;
 
 import com.android.internal.annotations.GuardedBy;
+import com.android.modules.utils.build.SdkLevel;
 
 import libcore.io.IoUtils;
 import libcore.net.http.Dns;
@@ -102,12 +103,7 @@ public class Network implements Parcelable {
     // and permission checks are made by netd (attempts to bypass Private DNS
     // without appropriate permission are silently turned into vanilla DNS
     // requests). This only affects DNS queries made using this network object.
-    //
-    // It it not parceled to receivers because (a) it can be set or cleared at
-    // anytime and (b) receivers should be explicit about attempts to bypass
-    // Private DNS so that the intent of the code is easily determined and
-    // code search audits are possible.
-    private final transient boolean mPrivateDnsBypass;
+    private final boolean mPrivateDnsBypass;
 
     /**
      * @hide
@@ -170,6 +166,18 @@ public class Network implements Parcelable {
         return new Network(netId, true);
     }
 
+    /**
+     * Obtain a Network object that respects the Private DNS settings when attempting
+     * to use {@link #getAllByName(String)}/{@link #getByName(String)} methods on the given
+     * instance for hostname resolution.
+     *
+     * @hide
+     */
+    // TODO : @SystemApi if this becomes useful.
+    public @NonNull Network getPrivateDnsNonBypassingCopy() {
+        return new Network(netId, false);
+    }
+
     /**
      * Get the unique id of the network.
      *
@@ -497,31 +505,35 @@ public class Network implements Parcelable {
     }
     public void writeToParcel(Parcel dest, int flags) {
         dest.writeInt(netId);
+        if (SdkLevel.isAtLeastB()) {
+            dest.writeBoolean(mPrivateDnsBypass);
+        } else {
+            dest.writeBoolean(false);
+        }
     }
 
     public static final @android.annotation.NonNull Creator<Network> CREATOR =
-        new Creator<Network>() {
-            public Network createFromParcel(Parcel in) {
-                int netId = in.readInt();
+            new Creator<>() {
+                public Network createFromParcel(Parcel in) {
+                    final int netId = in.readInt();
+                    final boolean bypass = in.readBoolean();
+                    return new Network(netId, bypass);
+                }
 
-                return new Network(netId);
-            }
-
-            public Network[] newArray(int size) {
-                return new Network[size];
-            }
-    };
+                public Network[] newArray(int size) {
+                    return new Network[size];
+                }
+            };
 
     @Override
     public boolean equals(@Nullable Object obj) {
-        if (!(obj instanceof Network)) return false;
-        Network other = (Network)obj;
+        if (!(obj instanceof Network other)) return false;
         return this.netId == other.netId;
     }
 
     @Override
     public int hashCode() {
-        return netId * 11;
+        return netId;
     }
 
     @Override
diff --git a/tests/common/java/android/net/NetworkTest.java b/tests/common/java/android/net/NetworkTest.java
index 86d2463ce2..580beabe63 100644
--- a/tests/common/java/android/net/NetworkTest.java
+++ b/tests/common/java/android/net/NetworkTest.java
@@ -32,6 +32,7 @@ import com.android.testutils.ConnectivityModuleTest;
 import com.android.testutils.DevSdkIgnoreRule;
 import com.android.testutils.DevSdkIgnoreRule.IgnoreAfter;
 import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo;
+import com.android.testutils.ParcelUtils;
 
 import org.junit.Rule;
 import org.junit.Test;
@@ -200,4 +201,37 @@ public class NetworkTest {
         assertNotEquals(copy.netId, copy.getNetIdForResolv());
         assertNotEquals(mNetwork.getNetIdForResolv(), copy.getNetIdForResolv());
     }
+
+    // Connectivity module was not supported until S
+    @Test @IgnoreUpTo(Build.VERSION_CODES.R)
+    @ConnectivityModuleTest
+    public void testGetNonPrivateDnsBypassingCopy() {
+        final Network bypass = mNetwork.getPrivateDnsBypassingCopy();
+        final Network nonBypass = bypass.getPrivateDnsNonBypassingCopy();
+        assertEquals(mNetwork.netId, nonBypass.netId);
+        assertEquals(nonBypass.netId, nonBypass.getNetIdForResolv());
+        assertEquals(mNetwork.getNetIdForResolv(), nonBypass.getNetIdForResolv());
+        assertNotEquals(mNetwork.getNetIdForResolv(), bypass.getNetIdForResolv());
+    }
+
+    // Only run this test on V and below
+    @Test @IgnoreAfter(Build.VERSION_CODES.VANILLA_ICE_CREAM)
+    @ConnectivityModuleTest
+    public void testParcelingRoundTripBeforeB() {
+        // Before B, the netID for resolv is not parceled.
+        final Network bypass =
+                ParcelUtils.parcelingRoundTrip(mNetwork.getPrivateDnsBypassingCopy());
+        assertEquals(mNetwork.netId, bypass.netId);
+        assertEquals(mNetwork.getNetIdForResolv(), bypass.getNetIdForResolv());
+    }
+
+    // Only run this test on B and after
+    @Test @IgnoreUpTo(Build.VERSION_CODES.VANILLA_ICE_CREAM)
+    @ConnectivityModuleTest
+    public void testParcelingRoundTripFromB() {
+        final Network bypass =
+                ParcelUtils.parcelingRoundTrip(mNetwork.getPrivateDnsBypassingCopy());
+        assertEquals(mNetwork.netId, bypass.netId);
+        assertNotEquals(mNetwork.getNetIdForResolv(), bypass.getNetIdForResolv());
+    }
 }

From 1cb46a87b7c416055154fe4a8b4f7049ab13084c Mon Sep 17 00:00:00 2001
From: Bill Yi <byi@google.com>
Date: Mon, 7 Apr 2025 08:02:16 +0000
Subject: [PATCH 078/377] Import translations. DO NOT MERGE ANYWHERE

Auto-generated-cl: translation import
Change-Id: I14e5b317804177f0d9aaa5c14b889e9532d956b4
---
 service/ServiceConnectivityResources/res/values-bs/strings.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/service/ServiceConnectivityResources/res/values-bs/strings.xml b/service/ServiceConnectivityResources/res/values-bs/strings.xml
index ae401fbb95..84858c8076 100644
--- a/service/ServiceConnectivityResources/res/values-bs/strings.xml
+++ b/service/ServiceConnectivityResources/res/values-bs/strings.xml
@@ -36,7 +36,7 @@
     <string name="network_switch_metered_detail" msgid="1257300152739542096">"Kada <xliff:g id="PREVIOUS_NETWORK">%2$s</xliff:g> nema pristup internetu, uređaj koristi mrežu <xliff:g id="NEW_NETWORK">%1$s</xliff:g>. Moguća je naplata usluge."</string>
     <string name="network_switch_metered_toast" msgid="70691146054130335">"Prebačeno iz mreže <xliff:g id="PREVIOUS_NETWORK">%1$s</xliff:g> u <xliff:g id="NEW_NETWORK">%2$s</xliff:g> mrežu"</string>
   <string-array name="network_switch_type_name">
-    <item msgid="3004933964374161223">"prijenos podataka na mobilnoj mreži"</item>
+    <item msgid="3004933964374161223">"prenos podataka na mobilnoj mreži"</item>
     <item msgid="5624324321165953608">"WiFi"</item>
     <item msgid="5667906231066981731">"Bluetooth"</item>
     <item msgid="346574747471703768">"Ethernet"</item>

From 4de8b4443afecf03bb5af41c44f160d8ff379ed1 Mon Sep 17 00:00:00 2001
From: Yuyang Huang <yuyanghuang@google.com>
Date: Mon, 7 Apr 2025 18:42:43 +0900
Subject: [PATCH 079/377] Increase timeout for
 ApfIntegrationTest#testReadWriteProgram()

This commit increases the timeout for the
ApfIntegrationTest#testReadWriteProgram() test case from 15 minutes to
20 minutes. This change ensures that the test does not timeout on slower
devices.

Bug: 407721406
Flag: EXEMPT bug fix
Test: TH
Change-Id: I8c2b5d36aebc2f2fa66f2d72cccd88bf74f50b68
---
 tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt b/tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt
index 7dbb9b24a9..8e52a42477 100644
--- a/tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt
+++ b/tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt
@@ -434,8 +434,8 @@ class ApfIntegrationTest {
     @SkipPresubmit(reason = "This test takes longer than 1 minute, do not run it on presubmit.")
     // APF integration is mostly broken before V, only run the full read / write test on V+.
     @IgnoreUpTo(Build.VERSION_CODES.UPSIDE_DOWN_CAKE)
-    // Increase timeout for test to 15 minutes to accommodate device with large APF RAM.
-    @Test(timeout = 15 * 60 * 1000)
+    // Increase timeout for test to 20 minutes to accommodate device with large APF RAM.
+    @Test(timeout = 20 * 60 * 1000)
     fun testReadWriteProgram() {
         assumeApfVersionSupportAtLeast(4)
 

From 00abef4936a7bfb5061a5ac2bcbf761651c441b2 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Mon, 7 Apr 2025 09:34:36 -0700
Subject: [PATCH 080/377] Prevent use-after-free

This test could really benefit from using scope guards instead.

Test: TH
Bug: 406263334
Flag: no
Change-Id: I508c9843a8980767b4c25f86a6ca399276cb14c8
---
 tests/cts/net/jni/NativeMultinetworkJni.cpp | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tests/cts/net/jni/NativeMultinetworkJni.cpp b/tests/cts/net/jni/NativeMultinetworkJni.cpp
index 1d848ec0ea..17de7dd9ae 100644
--- a/tests/cts/net/jni/NativeMultinetworkJni.cpp
+++ b/tests/cts/net/jni/NativeMultinetworkJni.cpp
@@ -496,10 +496,10 @@ JNIEXPORT jobject Java_android_net_cts_MultinetworkApiTest_runDatagramCheck(
         freeaddrinfo(res);
         return create_query_test_result(env, 0, 0, errno);
     }
-    freeaddrinfo(res);
 
     if (getsockname(fd, (struct sockaddr *)&src_addr, &src_addrlen) != 0) {
         close(fd);
+        freeaddrinfo(res);
         return create_query_test_result(env, 0, 0, errno);
     }
     sockaddr_ntop((const struct sockaddr *)&src_addr, sizeof(src_addr), addrstr, sizeof(addrstr));
@@ -513,8 +513,10 @@ JNIEXPORT jobject Java_android_net_cts_MultinetworkApiTest_runDatagramCheck(
     } else {
         LOGD("Invalid source address family %d", src_addr.ss_family);
         close(fd);
+        freeaddrinfo(res);
         return create_query_test_result(env, 0, 0, EAFNOSUPPORT);
     }
+    freeaddrinfo(res);
 
     // Don't let reads or writes block indefinitely.
     const struct timeval timeo = { 2, 0 };  // 2 seconds

From 495edd20a8af23e5081e030578e565ae683eed0d Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Fri, 4 Apr 2025 07:50:07 -0700
Subject: [PATCH 081/377] Add support to NdResponder to add custom RA

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: Ic7f2567f15b76478df1c438e756929a93ffd4d43
---
 .../com/android/testutils/NdResponder.kt      | 21 ++++++++++++-------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/NdResponder.kt b/staticlibs/testutils/devicetests/com/android/testutils/NdResponder.kt
index d578b0362c..a4912f5092 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/NdResponder.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/NdResponder.kt
@@ -65,7 +65,7 @@ class NdResponder(
     data class NeighborEntry(
         val macAddr: MacAddress,
         val ipAddr: Inet6Address,
-        val isRouter: Boolean,
+        val ra: RaPkt?, // null if neighbor is not a router.
     )
     private val neighborMap: MutableMap<Inet6Address, NeighborEntry> = ArrayMap()
 
@@ -77,7 +77,14 @@ class NdResponder(
      * @param ip the link-local address of the router.
      */
     fun addRouterEntry(mac: MacAddress, ip: Inet6Address) {
-        neighborMap[ip] = NeighborEntry(mac, ip, true)
+        val ra = RaPkt()
+                .addPioOption(prefix = prefix.toString(), flags = "LA")
+                .addRdnssOption(dns = "2001:4860:4860::8888,2001:4860:4860::8844")
+        addRouterEntry(mac, ip, ra)
+    }
+
+    fun addRouterEntry(mac: MacAddress, ip: Inet6Address, ra: RaPkt) {
+        neighborMap[ip] = NeighborEntry(mac, ip, ra)
     }
 
     /**
@@ -86,7 +93,7 @@ class NdResponder(
      * @param ip the link-local address of the neighbor.
      */
     fun addNeighborEntry(mac: MacAddress, ip: Inet6Address) {
-        neighborMap[ip] = NeighborEntry(mac, ip, false)
+        neighborMap[ip] = NeighborEntry(mac, ip, null)
     }
 
     private fun sendPacket(reader: PollPacketReader, packet: ByteArray) {
@@ -101,13 +108,11 @@ class NdResponder(
 
     private fun replyToRouterSolicitation(reader: PollPacketReader, dstMac: MacAddress) {
         for ((ip, neigh) in neighborMap) {
-            if (!neigh.isRouter) continue
+            val ra = neigh.ra
+            if (ra == null) continue
             // TODO: add prefix to neighborMap
             val ether = EtherPkt(src = neigh.macAddr, dst = dstMac)
             val ip6 = Ip6Pkt(src = neigh.ipAddr.hostAddress, dst = "ff02::1")
-            val ra = RaPkt()
-                    .addPioOption(prefix = prefix.toString(), flags = "LA")
-                    .addRdnssOption(dns = "2001:4860:4860::8888,2001:4860:4860::8844")
             val p = ether / ip6 / ra
             sendPacket(reader, p.build())
         }
@@ -124,7 +129,7 @@ class NdResponder(
 
         val ether = EtherPkt(dst = dstMac, src = neighbor.macAddr)
         val ipv6 = Ip6Pkt(src = neighbor.ipAddr, dst = dstIp)
-        val flags = if (neighbor.isRouter) "RSO" else "SO"
+        val flags = if (neighbor.ra == null) "SO" else "RSO"
         val na = NaPkt(targetIp.hostAddress, flags)
                 .addTllaOption(neighbor.macAddr)
         val p = ether / ipv6 / na

From 313c1057f6cc300d55df4fa3a3c1b7a8884d24e9 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Fri, 4 Apr 2025 15:38:26 -0700
Subject: [PATCH 082/377] Add packet builder support for IPv4 packet

Options and fragments aren't currently supported.

Test: decoded test packet on packetor.com
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: Ia3a094cb1d2b093cae2f372cc84a72ad7e107105
---
 .../android/testutils/PacketBuilderUtils.kt   | 76 +++++++++++++++++++
 1 file changed, 76 insertions(+)

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
index f9b1ff1acd..f760f2aa93 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
@@ -23,6 +23,7 @@ import android.net.IpPrefix
 import android.net.MacAddress
 import com.android.net.module.util.IpUtils
 import java.io.ByteArrayOutputStream
+import java.net.Inet4Address
 import java.net.Inet6Address
 import java.net.InetAddress
 import java.nio.ByteBuffer
@@ -462,6 +463,81 @@ class Ip6Pkt(
     }
 }
 
+/**
+ * Class that facilitates the creation of IPv4 packets.
+ *
+ * Options are not currently supported.
+ */
+class Ip4Pkt(
+        private val src: Inet4Address,
+        private val dst: Inet4Address,
+) : PseudoHeaderPacket {
+    constructor(src: String, dst: String) : this(
+            InetAddress.getByName(src) as Inet4Address,
+            InetAddress.getByName(dst) as Inet4Address,
+    )
+
+    private val tos: Byte = 0
+    private val identification: Short = 0
+    private val flags = 0
+    private val fragoff = 0
+    private val ttl = 255.toByte()
+
+    override fun build(payload: FinalizedPacket?, pseudo: PseudoHeaderPacket?): FinalizedPacket {
+        require(payload != null)
+        require(payload is L4Packet)
+
+        //  0                   1                   2                   3
+        //  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+        // +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+        // |Version|  IHL  |Type of Service|          Total Length         |
+        // +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+        // |         Identification        |Flags|      Fragment Offset    |
+        // +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+        // |  Time to Live |    Protocol   |         Header Checksum       |
+        // +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+        // |                       Source Address                          |
+        // +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+        // |                    Destination Address                        |
+        // +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+        // |                    Options                    |    Padding    |
+        // +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+        val ipv4Header = ByteBuffer.allocate(20)
+                .put(((4 /*version*/ shl 4) or 5 /*IHL*/).toByte())
+                .put(tos)
+                .putShort((20 + payload.bytes.size).toShort())
+                .putShort(identification)
+                .putShort(((flags shl 13) or fragoff).toShort())
+                .put(ttl)
+                .put(payload.proto)
+                .putShort(0 /*csum; to be filled in later*/)
+                .put(src.address)
+                .put(dst.address)
+        ipv4Header.flip()
+
+        val csum = IpUtils.checksum(ipv4Header, 0 /*seed*/, 0 /*start*/, ipv4Header.limit())
+        ipv4Header.position(10)
+        ipv4Header.putShort(csum.toShort())
+
+        val outputStream = ByteArrayOutputStream()
+        outputStream.write(ipv4Header.array())
+        outputStream.write(payload.bytes)
+        return L3Packet(etherType = 0x0800.toShort(), bytes = outputStream.toByteArray())
+    }
+
+    override fun calculatePseudoHeaderCsum(proto: Byte, length: Int): Int {
+        val buffer = ByteBuffer.allocate(12)
+                .put(src.address)
+                .put(dst.address)
+                .put(0)
+                .put(proto)
+                .putShort(length.toShort())
+        buffer.flip()
+        // Note that IpUtils.checksum() flips the result, so it is flipped back here.
+        return IpUtils.checksum(buffer, 0 /*seed*/, 0 /*start*/, buffer.limit()) xor 0xffff
+    }
+}
+
 /**
  * Class that facilitates the creation of ethernet packets.
  *

From 4e8098fcb0348eb4246fda4b004c6436a74aed92 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Mon, 7 Apr 2025 11:01:07 -0700
Subject: [PATCH 083/377] Use scope_guard and unique_fd in
 MultinetworkApiTest_runDatagramCheck

Test: TH
Flag: no
Bug: 1000001
Change-Id: Icaf5cc553ceedc0ed5a0a0e1241c8cf6acf25a91
---
 tests/cts/net/jni/Android.bp                |  3 ++
 tests/cts/net/jni/NativeMultinetworkJni.cpp | 46 ++++++++-------------
 2 files changed, 20 insertions(+), 29 deletions(-)

diff --git a/tests/cts/net/jni/Android.bp b/tests/cts/net/jni/Android.bp
index fbf4f29df5..9ac15881f1 100644
--- a/tests/cts/net/jni/Android.bp
+++ b/tests/cts/net/jni/Android.bp
@@ -26,6 +26,9 @@ cc_defaults {
         "-Wno-format",
         "-Wno-unused-parameter",
     ],
+    header_libs: [
+        "libbase_headers",
+    ],
     shared_libs: [
         "libandroid",
         "libnativehelper_compat_libc++",
diff --git a/tests/cts/net/jni/NativeMultinetworkJni.cpp b/tests/cts/net/jni/NativeMultinetworkJni.cpp
index 17de7dd9ae..d4fa365934 100644
--- a/tests/cts/net/jni/NativeMultinetworkJni.cpp
+++ b/tests/cts/net/jni/NativeMultinetworkJni.cpp
@@ -33,10 +33,15 @@
 
 #include <string>
 
+#include <android-base/scopeguard.h>
+#include <android-base/unique_fd.h>
 #include <android/log.h>
 #include <android/multinetwork.h>
 #include <nativehelper/JNIHelp.h>
 
+using android::base::make_scope_guard;
+using android::base::unique_fd;
+
 #define LOGD(fmt, ...) \
         __android_log_print(ANDROID_LOG_DEBUG, LOG_TAG, fmt, ##__VA_ARGS__)
 
@@ -437,28 +442,25 @@ JNIEXPORT jobject Java_android_net_cts_MultinetworkApiTest_runDatagramCheck(
 
     static const char kPort[] = "443";
     int rval = android_getaddrinfofornetwork(handle, kHostname, kPort, &kHints, &res);
+    auto res_guard = make_scope_guard([res] { freeaddrinfo(res); });
     if (rval != 0) {
         LOGD("android_getaddrinfofornetwork(%llu, %s) returned rval=%d errno=%d",
               handle, kHostname, rval, errno);
-        freeaddrinfo(res);
         return create_query_test_result(env, 0, 0, errno);
     }
 
     // Rely upon getaddrinfo sorting the best destination to the front.
-    int fd = socket(res->ai_family, res->ai_socktype, res->ai_protocol);
-    if (fd < 0) {
+    auto fd = unique_fd(socket(res->ai_family, res->ai_socktype, res->ai_protocol));
+    if (!fd.ok()) {
         LOGD("socket(%d, %d, %d) failed, errno=%d",
               res->ai_family, res->ai_socktype, res->ai_protocol, errno);
-        freeaddrinfo(res);
         return create_query_test_result(env, 0, 0, errno);
     }
 
-    rval = android_setsocknetwork(handle, fd);
+    rval = android_setsocknetwork(handle, fd.get());
     LOGD("android_setprocnetwork(%llu, %d) returned rval=%d errno=%d",
-          handle, fd, rval, errno);
+          handle, fd.get(), rval, errno);
     if (rval != 0) {
-        close(fd);
-        freeaddrinfo(res);
         return create_query_test_result(env, 0, 0, errno);
     }
 
@@ -478,10 +480,8 @@ JNIEXPORT jobject Java_android_net_cts_MultinetworkApiTest_runDatagramCheck(
                 .sin_addr = { .s_addr = INADDR_ANY },
             };
         }
-        if (bind(fd, (sockaddr *)&src_addr, src_addrlen) != 0) {
+        if (bind(fd.get(), (sockaddr *)&src_addr, src_addrlen) != 0) {
             LOGD("Error binding to port %d", src_port);
-            close(fd);
-            freeaddrinfo(res);
             return create_query_test_result(env, 0, 0, errno);
         }
     }
@@ -490,16 +490,12 @@ JNIEXPORT jobject Java_android_net_cts_MultinetworkApiTest_runDatagramCheck(
     sockaddr_ntop(res->ai_addr, res->ai_addrlen, addrstr, sizeof(addrstr));
     LOGD("Attempting connect() to %s ...", addrstr);
 
-    rval = connect(fd, res->ai_addr, res->ai_addrlen);
+    rval = connect(fd.get(), res->ai_addr, res->ai_addrlen);
     if (rval != 0) {
-        close(fd);
-        freeaddrinfo(res);
         return create_query_test_result(env, 0, 0, errno);
     }
 
-    if (getsockname(fd, (struct sockaddr *)&src_addr, &src_addrlen) != 0) {
-        close(fd);
-        freeaddrinfo(res);
+    if (getsockname(fd.get(), (struct sockaddr *)&src_addr, &src_addrlen) != 0) {
         return create_query_test_result(env, 0, 0, errno);
     }
     sockaddr_ntop((const struct sockaddr *)&src_addr, sizeof(src_addr), addrstr, sizeof(addrstr));
@@ -512,16 +508,13 @@ JNIEXPORT jobject Java_android_net_cts_MultinetworkApiTest_runDatagramCheck(
         socket_src_port = ntohs(reinterpret_cast<sockaddr_in*>(&src_addr)->sin_port);
     } else {
         LOGD("Invalid source address family %d", src_addr.ss_family);
-        close(fd);
-        freeaddrinfo(res);
         return create_query_test_result(env, 0, 0, EAFNOSUPPORT);
     }
-    freeaddrinfo(res);
 
     // Don't let reads or writes block indefinitely.
     const struct timeval timeo = { 2, 0 };  // 2 seconds
-    setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &timeo, sizeof(timeo));
-    setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &timeo, sizeof(timeo));
+    setsockopt(fd.get(), SOL_SOCKET, SO_RCVTIMEO, &timeo, sizeof(timeo));
+    setsockopt(fd.get(), SOL_SOCKET, SO_SNDTIMEO, &timeo, sizeof(timeo));
 
     // For reference see:
     //     https://datatracker.ietf.org/doc/html/draft-ietf-quic-invariants
@@ -541,15 +534,14 @@ JNIEXPORT jobject Java_android_net_cts_MultinetworkApiTest_runDatagramCheck(
     int i, errnum = 0;
 
     for (i = 0; i < MAX_RETRIES; i++) {
-        sent = send(fd, quic_packet, sizeof(quic_packet), 0);
+        sent = send(fd.get(), quic_packet, sizeof(quic_packet), 0);
         if (sent < (ssize_t)sizeof(quic_packet)) {
             errnum = errno;
             LOGD("send(QUIC packet) returned sent=%zd, errno=%d", sent, errnum);
-            close(fd);
             return create_query_test_result(env, socket_src_port, i + 1, errnum);
         }
 
-        rcvd = recv(fd, response, sizeof(response), 0);
+        rcvd = recv(fd.get(), response, sizeof(response), 0);
         if (rcvd > 0) {
             break;
         } else {
@@ -563,7 +555,6 @@ JNIEXPORT jobject Java_android_net_cts_MultinetworkApiTest_runDatagramCheck(
         if (rcvd <= 0) {
             LOGD("Does this network block UDP port %s?", kPort);
         }
-        close(fd);
         return create_query_test_result(env, socket_src_port, i + 1,
                 rcvd <= 0 ? errnum : EPROTO);
     }
@@ -571,12 +562,9 @@ JNIEXPORT jobject Java_android_net_cts_MultinetworkApiTest_runDatagramCheck(
     int conn_id_cmp = memcmp(quic_packet + 6, response + 7, 8);
     if (conn_id_cmp != 0) {
         LOGD("sent and received connection IDs do not match");
-        close(fd);
         return create_query_test_result(env, socket_src_port, i + 1, EPROTO);
     }
 
     // TODO: Replace this quick 'n' dirty test with proper QUIC-capable code.
-
-    close(fd);
     return create_query_test_result(env, socket_src_port, i + 1, 0);
 }

From 328cfb505166d59210a8435e8794cb572e08acec Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Fri, 4 Apr 2025 15:43:07 -0700
Subject: [PATCH 084/377] Add packet builder support for UDP packets

UDP packets can be built as:

val p = ether / ipv6 / udp / data
val p2 = ether / ipv4 / udp / data
val p3 = ether / ipv4 / udp / ipv4 / udp / data

This also gets rid of Icmp6Pkt in favor of a function call that
calculates the checksum over an L4 packet.

This does add a bit of duplication: the build() function for RA and NA
packets is identical, and UdpPkt#build() is not far off. However, subtle
differences in L4 packet format (namely the checksum and length
positions) make generalizing this code difficult. This is possible by
passing the checksum position, proto byte, and adding an abstract
function that fills in the L4 length field before performing checksum
calculation. However, this complexity is likely not worth it. If the
repetition becomes obvious once more protocols (such as ICMPv4/6 echo,
etc.) are added, this decision will be revisited.

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: Ia78792418f29a3be091ebdc9bb2c26e45da9f2b1
---
 .../android/testutils/PacketBuilderUtils.kt   | 123 ++++++++++++++----
 1 file changed, 99 insertions(+), 24 deletions(-)

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
index f760f2aa93..87288ca6bb 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
@@ -121,28 +121,13 @@ private inline fun <reified E> enumSetOfFlags(str: String): EnumSet<E>
     return result
 }
 
-/** Base class that holds the common checksum implementation */
-open class Icmp6Pkt : Packet {
-    protected val outputStream = ByteArrayOutputStream()
-
-    override fun build(payload: FinalizedPacket?, pseudo: PseudoHeaderPacket?): FinalizedPacket {
-        // ICMPv6 packets do not carry a payload but require the pseudo-header to calculate their
-        // checksum.
-        require(payload == null)
-        require(pseudo != null)
-
-        val packetBytes = outputStream.toByteArray()
-        val packetBuffer = ByteBuffer.wrap(packetBytes)
-        var csum = pseudo.calculatePseudoHeaderCsum(58 /* proto */, packetBytes.size)
-        csum = IpUtils.checksum(packetBuffer, csum, 0 /*start*/, packetBytes.size)
-
-        // Fixup packetBuffer
-        packetBuffer.position(2)
-        packetBuffer.putShort(csum.toShort())
-
-        // TODO: calculate checksum
-        return L4Packet(proto = 58, bytes = packetBytes)
-    }
+private fun calculatePacketCsum(
+        packetBuffer: ByteBuffer,
+        pseudo: PseudoHeaderPacket,
+        proto: Byte,
+): Short {
+    val csum = pseudo.calculatePseudoHeaderCsum(proto, packetBuffer.limit())
+    return IpUtils.checksum(packetBuffer, csum, 0 /*start*/, packetBuffer.limit()).toShort()
 }
 
 /**
@@ -154,7 +139,7 @@ open class Icmp6Pkt : Packet {
 class NaPkt(
     target: Inet6Address,
     flags: EnumSet<NaFlags>,
-) : Icmp6Pkt() {
+) : Packet {
     /**
      * Convenience constructor accepting parameters as Strings.
      *
@@ -173,6 +158,7 @@ class NaPkt(
         O(0x20),
     }
 
+    val outputStream = ByteArrayOutputStream()
     init {
         val naHeader = ByteBuffer.allocate(24)
         naHeader.put(136.toByte()) // Type = 136 (Neighbor Advertisement)
@@ -205,6 +191,19 @@ class NaPkt(
     fun addTllaOption(lla: String): NaPkt {
         return addTllaOption(MacAddress.fromString(lla))
     }
+
+    override fun build(payload: FinalizedPacket?, pseudo: PseudoHeaderPacket?): FinalizedPacket {
+        require(payload == null)
+        require(pseudo != null)
+
+        val packetBytes = outputStream.toByteArray()
+        val packetBuffer = ByteBuffer.wrap(packetBytes)
+        val proto: Byte = 58
+        val csum = calculatePacketCsum(packetBuffer, pseudo, proto)
+        packetBuffer.position(2)
+        packetBuffer.putShort(csum)
+        return L4Packet(proto = proto, bytes = packetBytes)
+    }
 }
 
 /**
@@ -222,7 +221,7 @@ class RaPkt(
     private val reachableTime: Int,
     private val retransTimer: Int,
     private val flags: EnumSet<RaFlags>,
-) : Icmp6Pkt() {
+) : Packet {
     /**
      * Convenience constructor accepting flags parameter as String
      *
@@ -245,6 +244,7 @@ class RaPkt(
         O(0x40),
     }
 
+    val outputStream = ByteArrayOutputStream()
     init {
         val raHeader = ByteBuffer.allocate(16)
         raHeader.put(134.toByte()) // Type = 134 (Router Advertisement)
@@ -413,6 +413,81 @@ class RaPkt(
     fun addPref64Option(prefix: String, lft: Int = 1800): RaPkt {
         return addPref64Option(IpPrefix(prefix), lft)
     }
+
+    override fun build(payload: FinalizedPacket?, pseudo: PseudoHeaderPacket?): FinalizedPacket {
+        require(payload == null)
+        require(pseudo != null)
+
+        val packetBytes = outputStream.toByteArray()
+        val packetBuffer = ByteBuffer.wrap(packetBytes)
+        val proto: Byte = 58
+        val csum = calculatePacketCsum(packetBuffer, pseudo, proto)
+        packetBuffer.position(2)
+        packetBuffer.putShort(csum)
+        return L4Packet(proto = proto, bytes = packetBytes)
+    }
+}
+
+/** Class that facilitates the creation of generic L5 data packets. */
+class DataPkt(data: ByteArray) : Packet {
+    constructor(data: String) : this(data.toByteArray())
+
+    val outputStream = ByteArrayOutputStream()
+    init {
+        outputStream.write(data)
+    }
+
+    override fun build(payload: FinalizedPacket?, pseudo: PseudoHeaderPacket?): FinalizedPacket {
+        if (payload != null) {
+            outputStream.write(payload.bytes)
+        }
+        return object : FinalizedPacket { override val bytes = outputStream.toByteArray() }
+    }
+}
+
+/**
+ * Class that facilitates the creation of UDP packets.
+ *
+ * Use the {@link DataPkt} for carrying a payload.
+ */
+class UdpPkt(
+        private val srcPort: Short,
+        private val dstPort: Short,
+) : Packet {
+    constructor(srcPort: Int, dstPort: Int) : this(srcPort.toShort(), dstPort.toShort())
+
+    val outputStream = ByteArrayOutputStream()
+    init {
+        val udpHeader = ByteBuffer.allocate(8)
+            .putShort(srcPort)
+            .putShort(dstPort)
+            .putShort(0) // length; to be filled in later.
+            .putShort(0) // checksum; to be filled in later.
+        udpHeader.flip()
+        outputStream.write(udpHeader.array())
+    }
+
+    override fun build(payload: FinalizedPacket?, pseudo: PseudoHeaderPacket?): FinalizedPacket {
+        require(pseudo != null)
+
+        if (payload != null) {
+            outputStream.write(payload.bytes)
+        }
+        val packetBytes = outputStream.toByteArray()
+        val packetBuffer = ByteBuffer.wrap(packetBytes)
+
+        // Insert length into UDP header
+        packetBuffer.position(4)
+        packetBuffer.putShort(packetBytes.size.toShort())
+        packetBuffer.position(0)
+
+        // Insert checksum into UDP header
+        val proto: Byte = 17
+        val csum = calculatePacketCsum(packetBuffer, pseudo, proto)
+        packetBuffer.position(6)
+        packetBuffer.putShort(csum)
+        return L4Packet(proto = proto, bytes = packetBytes)
+    }
 }
 
 /** Class that facilitates the creation of IPv6 packets. */

From c1cf40d38eae3933db6abc400a6d1c046ba5dd67 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Mon, 7 Apr 2025 19:25:05 -0700
Subject: [PATCH 085/377] Move UDP header assembly to build()

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I5e070a57bfa40f95b72549cb02662f6557f78d45
---
 .../com/android/testutils/PacketBuilderUtils.kt       | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
index 87288ca6bb..511e24f2c3 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
@@ -456,20 +456,17 @@ class UdpPkt(
 ) : Packet {
     constructor(srcPort: Int, dstPort: Int) : this(srcPort.toShort(), dstPort.toShort())
 
-    val outputStream = ByteArrayOutputStream()
-    init {
+    override fun build(payload: FinalizedPacket?, pseudo: PseudoHeaderPacket?): FinalizedPacket {
+        require(pseudo != null)
+
         val udpHeader = ByteBuffer.allocate(8)
             .putShort(srcPort)
             .putShort(dstPort)
             .putShort(0) // length; to be filled in later.
             .putShort(0) // checksum; to be filled in later.
         udpHeader.flip()
+        val outputStream = ByteArrayOutputStream()
         outputStream.write(udpHeader.array())
-    }
-
-    override fun build(payload: FinalizedPacket?, pseudo: PseudoHeaderPacket?): FinalizedPacket {
-        require(pseudo != null)
-
         if (payload != null) {
             outputStream.write(payload.bytes)
         }

From 9381c493d94efda4bdc6f54f19f43ec7983217ba Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Mon, 7 Apr 2025 19:29:48 -0700
Subject: [PATCH 086/377] IpUtils.checksum() does not require ByteBuffer
 position reset

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: Ib38c54419675bc41337f24932f0aa1cd7b9eeb4f
---
 .../devicetests/com/android/testutils/PacketBuilderUtils.kt      | 1 -
 1 file changed, 1 deletion(-)

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
index 511e24f2c3..7b210ac288 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
@@ -476,7 +476,6 @@ class UdpPkt(
         // Insert length into UDP header
         packetBuffer.position(4)
         packetBuffer.putShort(packetBytes.size.toShort())
-        packetBuffer.position(0)
 
         // Insert checksum into UDP header
         val proto: Byte = 17

From 937cab001af0b4aaa1cf17ab6cecc475e0b46f97 Mon Sep 17 00:00:00 2001
From: Remi NGUYEN VAN <reminv@google.com>
Date: Fri, 4 Apr 2025 09:32:45 +0900
Subject: [PATCH 087/377] Delete TextStrings, only keep TextEntries

TextStrings was kept for backwards compatibility when the code was used
outside of Android, but is not necessary in the Android version as only
TextEntries are used.

Test: atest
Flag: EXEMPT refactor
Change-Id: If70fe1512570dd55019eac06cfce91639fd04b11
---
 .../connectivity/mdns/MdnsServiceInfo.java    | 32 +-------
 .../connectivity/mdns/util/MdnsUtils.java     |  3 -
 .../com/android/server/NsdServiceTest.java    |  6 --
 .../connectivity/mdns/MdnsRecordTests.java    |  8 --
 .../mdns/MdnsResponseDecoderTests.java        | 26 ++++---
 .../mdns/MdnsServiceInfoTest.java             | 73 +------------------
 6 files changed, 20 insertions(+), 128 deletions(-)

diff --git a/service-t/src/com/android/server/connectivity/mdns/MdnsServiceInfo.java b/service-t/src/com/android/server/connectivity/mdns/MdnsServiceInfo.java
index a16fcf7e08..0bc0c497cc 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MdnsServiceInfo.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MdnsServiceInfo.java
@@ -57,7 +57,6 @@ public class MdnsServiceInfo implements Parcelable {
                             source.readInt(),
                             source.createStringArrayList(),
                             source.createStringArrayList(),
-                            source.createStringArrayList(),
                             source.createTypedArrayList(TextEntry.CREATOR),
                             source.readInt(),
                             source.readParcelable(Network.class.getClassLoader()),
@@ -79,7 +78,6 @@ public class MdnsServiceInfo implements Parcelable {
     private final List<String> ipv4Addresses;
     @NonNull
     private final List<String> ipv6Addresses;
-    final List<String> textStrings;
     @Nullable
     final List<TextEntry> textEntries;
     private final int interfaceIndex;
@@ -104,7 +102,6 @@ public class MdnsServiceInfo implements Parcelable {
             int port,
             @Nullable String ipv4Address,
             @Nullable String ipv6Address,
-            @Nullable List<String> textStrings,
             @Nullable List<TextEntry> textEntries,
             int interfaceIndex) {
         this(
@@ -115,7 +112,6 @@ public class MdnsServiceInfo implements Parcelable {
                 port,
                 List.of(ipv4Address),
                 List.of(ipv6Address),
-                textStrings,
                 textEntries,
                 interfaceIndex,
                 /* network= */ null,
@@ -135,7 +131,6 @@ public class MdnsServiceInfo implements Parcelable {
             int port,
             @NonNull List<String> ipv4Addresses,
             @NonNull List<String> ipv6Addresses,
-            @Nullable List<String> textStrings,
             @Nullable List<TextEntry> textEntries,
             int interfaceIndex,
             @Nullable Network network,
@@ -150,19 +145,13 @@ public class MdnsServiceInfo implements Parcelable {
         this.port = port;
         this.ipv4Addresses = new ArrayList<>(ipv4Addresses);
         this.ipv6Addresses = new ArrayList<>(ipv6Addresses);
-        this.textStrings = new ArrayList<>();
-        if (textStrings != null) {
-            this.textStrings.addAll(textStrings);
-        }
-        this.textEntries = (textEntries == null) ? null : new ArrayList<>(textEntries);
+        this.textEntries = (textEntries == null)
+                ? Collections.emptyList()
+                : new ArrayList<>(textEntries);
 
-        // The module side sends both {@code textStrings} and {@code textEntries} for backward
-        // compatibility. We should prefer only {@code textEntries} if it's not null.
-        List<TextEntry> entries =
-                (this.textEntries != null) ? this.textEntries : parseTextStrings(this.textStrings);
         // The map of attributes is case-insensitive.
         final Map<String, byte[]> attributes = new TreeMap<>(String.CASE_INSENSITIVE_ORDER);
-        for (TextEntry entry : entries) {
+        for (TextEntry entry : this.textEntries) {
             // Per https://datatracker.ietf.org/doc/html/rfc6763#section-6.4, only the first entry
             // of the same key should be accepted:
             // If a client receives a TXT record containing the same key more than once, then the
@@ -175,17 +164,6 @@ public class MdnsServiceInfo implements Parcelable {
         this.expirationTime = Instant.ofEpochSecond(expirationTime.getEpochSecond());
     }
 
-    private static List<TextEntry> parseTextStrings(List<String> textStrings) {
-        List<TextEntry> list = new ArrayList(textStrings.size());
-        for (String textString : textStrings) {
-            TextEntry entry = TextEntry.fromString(textString);
-            if (entry != null) {
-                list.add(entry);
-            }
-        }
-        return Collections.unmodifiableList(list);
-    }
-
     /** Returns the name of this service instance. */
     public String getServiceInstanceName() {
         return serviceInstanceName;
@@ -327,7 +305,6 @@ public class MdnsServiceInfo implements Parcelable {
         out.writeInt(port);
         out.writeStringList(ipv4Addresses);
         out.writeStringList(ipv6Addresses);
-        out.writeStringList(textStrings);
         out.writeTypedList(textEntries);
         out.writeInt(interfaceIndex);
         out.writeParcelable(network, 0);
@@ -344,7 +321,6 @@ public class MdnsServiceInfo implements Parcelable {
                 + ", port: " + port
                 + ", interfaceIndex: " + interfaceIndex
                 + ", network: " + network
-                + ", textStrings: " + textStrings
                 + ", textEntries: " + textEntries
                 + ", expirationTime: " + expirationTime;
     }
diff --git a/service-t/src/com/android/server/connectivity/mdns/util/MdnsUtils.java b/service-t/src/com/android/server/connectivity/mdns/util/MdnsUtils.java
index 996e8a5af9..957fe0fa81 100644
--- a/service-t/src/com/android/server/connectivity/mdns/util/MdnsUtils.java
+++ b/service-t/src/com/android/server/connectivity/mdns/util/MdnsUtils.java
@@ -344,10 +344,8 @@ public class MdnsUtils {
             throw new IllegalStateException(
                     "mDNS response must have non-null service instance name");
         }
-        List<String> textStrings = null;
         List<MdnsServiceInfo.TextEntry> textEntries = null;
         if (response.hasTextRecord()) {
-            textStrings = response.getTextRecord().getStrings();
             textEntries = response.getTextRecord().getEntries();
         }
         Instant now = Instant.now();
@@ -360,7 +358,6 @@ public class MdnsUtils {
                 port,
                 ipv4Addresses,
                 ipv6Addresses,
-                textStrings,
                 textEntries,
                 response.getInterfaceIndex(),
                 response.getNetwork(),
diff --git a/tests/unit/java/com/android/server/NsdServiceTest.java b/tests/unit/java/com/android/server/NsdServiceTest.java
index 979e0a154a..6e8809ff6a 100644
--- a/tests/unit/java/com/android/server/NsdServiceTest.java
+++ b/tests/unit/java/com/android/server/NsdServiceTest.java
@@ -546,7 +546,6 @@ public class NsdServiceTest {
                 12345, /* port */
                 List.of(IPV4_ADDRESS),
                 List.of(IPV6_ADDRESS),
-                List.of(), /* textStrings */
                 List.of(), /* textEntries */
                 interfaceIdx, /* interfaceIndex */
                 null /* network */,
@@ -1025,7 +1024,6 @@ public class NsdServiceTest {
                 PORT,
                 List.of(IPV4_ADDRESS),
                 List.of(IPV6_ADDRESS),
-                List.of() /* textStrings */,
                 List.of() /* textEntries */,
                 1234,
                 network,
@@ -1056,7 +1054,6 @@ public class NsdServiceTest {
                 PORT,
                 List.of(v4Address),
                 List.of(v6Address),
-                List.of() /* textStrings */,
                 List.of() /* textEntries */,
                 1234,
                 network,
@@ -1189,7 +1186,6 @@ public class NsdServiceTest {
                 12345, /* port */
                 List.of(IPV4_ADDRESS),
                 List.of(IPV6_ADDRESS),
-                List.of(), /* textStrings */
                 List.of(), /* textEntries */
                 1234, /* interfaceIndex */
                 network,
@@ -1211,7 +1207,6 @@ public class NsdServiceTest {
                 0, /* port */
                 List.of(), /* ipv4Address */
                 List.of(), /* ipv6Address */
-                null, /* textStrings */
                 null, /* textEntries */
                 1234, /* interfaceIndex */
                 network,
@@ -1333,7 +1328,6 @@ public class NsdServiceTest {
                 PORT,
                 List.of(IPV4_ADDRESS),
                 List.of("2001:db8::1", "2001:db8::2"),
-                List.of() /* textStrings */,
                 List.of(MdnsServiceInfo.TextEntry.fromBytes(new byte[]{
                         'k', 'e', 'y', '=', (byte) 0xFF, (byte) 0xFE})) /* textEntries */,
                 1234,
diff --git a/tests/unit/java/com/android/server/connectivity/mdns/MdnsRecordTests.java b/tests/unit/java/com/android/server/connectivity/mdns/MdnsRecordTests.java
index 784c50282f..aeb1966a3a 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/MdnsRecordTests.java
+++ b/tests/unit/java/com/android/server/connectivity/mdns/MdnsRecordTests.java
@@ -352,14 +352,6 @@ public class MdnsRecordTests {
 
         MdnsTextRecord record = new MdnsTextRecord(name, reader);
 
-        List<String> strings = record.getStrings();
-        assertNotNull(strings);
-        assertEquals(3, strings.size());
-
-        assertEquals("a=hello there", strings.get(0));
-        assertEquals("b=1234567890", strings.get(1));
-        assertEquals("xyz=!@#$", strings.get(2));
-
         List<TextEntry> entries = record.getEntries();
         assertNotNull(entries);
         assertEquals(3, entries.size());
diff --git a/tests/unit/java/com/android/server/connectivity/mdns/MdnsResponseDecoderTests.java b/tests/unit/java/com/android/server/connectivity/mdns/MdnsResponseDecoderTests.java
index ba6406e76b..ad0f7efc8d 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/MdnsResponseDecoderTests.java
+++ b/tests/unit/java/com/android/server/connectivity/mdns/MdnsResponseDecoderTests.java
@@ -37,6 +37,7 @@ import android.util.ArraySet;
 import com.android.net.module.util.HexDump;
 import com.android.server.connectivity.mdns.MdnsResponseTests.MdnsInet4AddressRecord;
 import com.android.server.connectivity.mdns.MdnsResponseTests.MdnsInet6AddressRecord;
+import com.android.server.connectivity.mdns.MdnsServiceInfo.TextEntry;
 import com.android.testutils.DevSdkIgnoreRule;
 import com.android.testutils.DevSdkIgnoreRunner;
 
@@ -267,15 +268,16 @@ public class MdnsResponseDecoderTests {
         assertEquals(0, serviceWeight);
 
         MdnsTextRecord textRecord = response.getTextRecord();
-        List<String> textStrings = textRecord.getStrings();
-        assertEquals(7, textStrings.size());
-        assertEquals("id=970bf547b753fc63c2d2a36bb896aba8", textStrings.get(0));
-        assertEquals("ve=02", textStrings.get(1));
-        assertEquals("md=Chromecast", textStrings.get(2));
-        assertEquals("ic=/setup/icon.png", textStrings.get(3));
-        assertEquals("fn=Johnny's Chromecast", textStrings.get(4));
-        assertEquals("ca=5", textStrings.get(5));
-        assertEquals("st=0", textStrings.get(6));
+        List<TextEntry> textEntries = textRecord.getEntries();
+        assertEquals(List.of(
+                new TextEntry("id", "970bf547b753fc63c2d2a36bb896aba8"),
+                new TextEntry("ve", "02"),
+                new TextEntry("md", "Chromecast"),
+                new TextEntry("ic", "/setup/icon.png"),
+                new TextEntry("fn", "Johnny's Chromecast"),
+                new TextEntry("ca", "5"),
+                new TextEntry("st", "0")
+        ), textEntries);
     }
 
     private void verifyResponse(ArraySet<MdnsResponse> responseArraySet) {
@@ -581,9 +583,9 @@ public class MdnsResponseDecoderTests {
                 decoder, makeResponsePacket(DATAIN_TEXT_2), List.of(response));
         assertEquals(1, updatedResponses.size());
         assertEquals(List.of(
-                new MdnsServiceInfo.TextEntry("a", "hello there"),
-                new MdnsServiceInfo.TextEntry("b", "1234567890"),
-                new MdnsServiceInfo.TextEntry("xyz", "!@#$")),
+                new TextEntry("a", "hello there"),
+                new TextEntry("b", "1234567890"),
+                new TextEntry("xyz", "!@#$")),
                 updatedResponses.valueAt(0).getTextRecord().getEntries());
     }
 
diff --git a/tests/unit/java/com/android/server/connectivity/mdns/MdnsServiceInfoTest.java b/tests/unit/java/com/android/server/connectivity/mdns/MdnsServiceInfoTest.java
index 4ce8ba6360..d3989e3123 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/MdnsServiceInfoTest.java
+++ b/tests/unit/java/com/android/server/connectivity/mdns/MdnsServiceInfoTest.java
@@ -37,13 +37,12 @@ import org.junit.runner.RunWith;
 
 import java.time.Instant;
 import java.util.List;
-import java.util.Map;
 
 @RunWith(DevSdkIgnoreRunner.class)
 @DevSdkIgnoreRule.IgnoreUpTo(SC_V2)
 public class MdnsServiceInfoTest {
     @Test
-    public void constructor_createWithOnlyTextStrings_correctAttributes() {
+    public void constructor_createWithTextEntries_correctAttributes() {
         MdnsServiceInfo info =
                 new MdnsServiceInfo(
                         "my-mdns-service",
@@ -53,26 +52,6 @@ public class MdnsServiceInfoTest {
                         12345,
                         "192.168.1.1",
                         "2001::1",
-                        List.of("vn=Google Inc.", "mn=Google Nest Hub Max"),
-                        /* textEntries= */ null,
-                        INTERFACE_INDEX_UNSPECIFIED);
-
-        assertTrue(info.getAttributeByKey("vn").equals("Google Inc."));
-        assertTrue(info.getAttributeByKey("mn").equals("Google Nest Hub Max"));
-    }
-
-    @Test
-    public void constructor_createWithOnlyTextEntries_correctAttributes() {
-        MdnsServiceInfo info =
-                new MdnsServiceInfo(
-                        "my-mdns-service",
-                        new String[] {"_googlecast", "_tcp"},
-                        List.of(),
-                        new String[] {"my-host", "local"},
-                        12345,
-                        "192.168.1.1",
-                        "2001::1",
-                        /* textStrings= */ null,
                         List.of(MdnsServiceInfo.TextEntry.fromString("vn=Google Inc."),
                                 MdnsServiceInfo.TextEntry.fromString("mn=Google Nest Hub Max")),
                         INTERFACE_INDEX_UNSPECIFIED);
@@ -81,48 +60,6 @@ public class MdnsServiceInfoTest {
         assertTrue(info.getAttributeByKey("mn").equals("Google Nest Hub Max"));
     }
 
-    @Test
-    public void constructor_createWithBothTextStringsAndTextEntries_acceptsOnlyTextEntries() {
-        MdnsServiceInfo info =
-                new MdnsServiceInfo(
-                        "my-mdns-service",
-                        new String[] {"_googlecast", "_tcp"},
-                        List.of(),
-                        new String[] {"my-host", "local"},
-                        12345,
-                        "192.168.1.1",
-                        "2001::1",
-                        List.of("vn=Alphabet Inc.", "mn=Google Nest Hub Max", "id=12345"),
-                        List.of(
-                                MdnsServiceInfo.TextEntry.fromString("vn=Google Inc."),
-                                MdnsServiceInfo.TextEntry.fromString("mn=Google Nest Hub Max")),
-                        INTERFACE_INDEX_UNSPECIFIED);
-
-        assertEquals(Map.of("vn", "Google Inc.", "mn", "Google Nest Hub Max"),
-                info.getAttributes());
-    }
-
-    @Test
-    public void constructor_createWithDuplicateKeys_acceptsTheFirstOne() {
-        MdnsServiceInfo info =
-                new MdnsServiceInfo(
-                        "my-mdns-service",
-                        new String[] {"_googlecast", "_tcp"},
-                        List.of(),
-                        new String[] {"my-host", "local"},
-                        12345,
-                        "192.168.1.1",
-                        "2001::1",
-                        List.of("vn=Alphabet Inc.", "mn=Google Nest Hub Max", "id=12345"),
-                        List.of(MdnsServiceInfo.TextEntry.fromString("vn=Google Inc."),
-                                MdnsServiceInfo.TextEntry.fromString("mn=Google Nest Hub Max"),
-                                MdnsServiceInfo.TextEntry.fromString("mn=Google WiFi Router")),
-                        INTERFACE_INDEX_UNSPECIFIED);
-
-        assertEquals(Map.of("vn", "Google Inc.", "mn", "Google Nest Hub Max"),
-                info.getAttributes());
-    }
-
     @Test
     public void constructor_createWithUppercaseKeys_correctAttributes() {
         MdnsServiceInfo info =
@@ -134,8 +71,7 @@ public class MdnsServiceInfoTest {
                         12345,
                         "192.168.1.1",
                         "2001::1",
-                        List.of("KEY=Value"),
-                        /* textEntries= */ null,
+                        List.of(MdnsServiceInfo.TextEntry.fromString("KEY=Value")),
                         INTERFACE_INDEX_UNSPECIFIED);
 
         assertEquals("Value", info.getAttributeByKey("key"));
@@ -155,7 +91,6 @@ public class MdnsServiceInfoTest {
                         12345,
                         "192.168.1.1",
                         "2001::1",
-                        List.of(),
                         /* textEntries= */ null,
                         INTERFACE_INDEX_UNSPECIFIED);
 
@@ -173,7 +108,6 @@ public class MdnsServiceInfoTest {
                         12345,
                         "192.168.1.1",
                         "2001::1",
-                        List.of(),
                         /* textEntries= */ null,
                         /* interfaceIndex= */ 20);
 
@@ -191,7 +125,6 @@ public class MdnsServiceInfoTest {
                         12345,
                         "192.168.1.1",
                         "2001::1",
-                        List.of(),
                         /* textEntries= */ null,
                         /* interfaceIndex= */ 20);
 
@@ -207,7 +140,6 @@ public class MdnsServiceInfoTest {
                         12345,
                         List.of("192.168.1.1"),
                         List.of("2001::1"),
-                        List.of(),
                         /* textEntries= */ null,
                         /* interfaceIndex= */ 20,
                         network,
@@ -228,7 +160,6 @@ public class MdnsServiceInfoTest {
                         12345,
                         List.of("192.168.1.1", "192.168.1.2"),
                         List.of("2001::1", "2001::2"),
-                        List.of("vn=Alphabet Inc.", "mn=Google Nest Hub Max", "id=12345"),
                         List.of(
                                 MdnsServiceInfo.TextEntry.fromString("vn=Google Inc."),
                                 MdnsServiceInfo.TextEntry.fromString("mn=Google Nest Hub Max"),

From f958d71ceb9012862770cfdc0526d385bd2de33a Mon Sep 17 00:00:00 2001
From: Yuyang Huang <yuyanghuang@google.com>
Date: Tue, 8 Apr 2025 13:01:45 +0900
Subject: [PATCH 088/377] Prevent ApfIntegrationTest from calling
 LowPowerStandby APIs from pre U

This commit ensures that ApfIntegrationTest does not call low power
standby APIs on Android versions prior to U, as those APIs are only
available on Android U and later.

Bug: 409115206
Flag: EXEMPT bug fix
Test: manual verify on S cuttlefish
Change-Id: Id4d17e9708b0a75cf6b4f68907465af37bad264b
---
 .../net/src/android/net/cts/ApfIntegrationTest.kt | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt b/tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt
index 984dfc26f6..52777fd0ec 100644
--- a/tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt
+++ b/tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt
@@ -73,6 +73,7 @@ import com.android.compatibility.common.util.SystemUtil.runShellCommand
 import com.android.compatibility.common.util.SystemUtil.runShellCommandOrThrow
 import com.android.compatibility.common.util.VsrTest
 import com.android.internal.util.HexDump
+import com.android.modules.utils.build.SdkLevel
 import com.android.net.module.util.NetworkStackConstants.ETHER_ADDR_LEN
 import com.android.net.module.util.NetworkStackConstants.ETHER_DST_ADDR_OFFSET
 import com.android.net.module.util.NetworkStackConstants.ETHER_HEADER_LEN
@@ -119,6 +120,8 @@ private const val TIMEOUT_MS = 2000L
 private const val RCV_BUFFER_SIZE = 1480
 private const val PING_HEADER_LENGTH = 8
 
+open class FromU<Type>(val value: Type)
+
 @AppModeFull(reason = "CHANGE_NETWORK_STATE permission can't be granted to instant apps")
 @RunWith(DevSdkIgnoreRunner::class)
 @RequiresDevice
@@ -133,7 +136,7 @@ class ApfIntegrationTest {
         private val powerManager = context.getSystemService(PowerManager::class.java)!!
         private val wakeLock = powerManager.newWakeLock(PowerManager.PARTIAL_WAKE_LOCK, TAG)
         private var isLowPowerStandbyOriginalEnabled: Boolean = false
-        private var originalPolicy: PowerManager.LowPowerStandbyPolicy? = null
+        private var originalPolicy: FromU<PowerManager.LowPowerStandbyPolicy?>? = null
 
         fun turnScreenOff() {
             if (!wakeLock.isHeld()) wakeLock.acquire()
@@ -171,10 +174,13 @@ class ApfIntegrationTest {
         }
 
         private fun disableLowPowerStandby() {
+            if (!SdkLevel.isAtLeastU()) {
+                return
+            }
             runAsShell(permission.DEVICE_POWER) {
                 if (powerManager.isLowPowerStandbySupported) {
                     isLowPowerStandbyOriginalEnabled = powerManager.isLowPowerStandbyEnabled
-                    originalPolicy = powerManager.lowPowerStandbyPolicy
+                    originalPolicy = FromU(powerManager.lowPowerStandbyPolicy)
                     powerManager.isLowPowerStandbyEnabled = false
                     Log.i(TAG, "Low power standby is supported, disabling it temporary.")
                 }
@@ -182,10 +188,13 @@ class ApfIntegrationTest {
         }
 
         private fun restoreLowPowerStandby() {
+            if (!SdkLevel.isAtLeastU()) {
+                return
+            }
             runAsShell(permission.DEVICE_POWER) {
                 if (powerManager.isLowPowerStandbySupported) {
                     powerManager.isLowPowerStandbyEnabled = isLowPowerStandbyOriginalEnabled
-                    powerManager.lowPowerStandbyPolicy = originalPolicy
+                    powerManager.lowPowerStandbyPolicy = originalPolicy?.value
                     Log.i(TAG, "Reset Low power standby to original state.")
                 }
             }

From d3db165d9e899e3378b278e3cf4b324bfd8352c1 Mon Sep 17 00:00:00 2001
From: Chalard Jean <jchalard@google.com>
Date: Thu, 27 Mar 2025 16:27:58 +0900
Subject: [PATCH 089/377] Only set the carrier service package on supported
 devices

Not all U devices support this. It's only supported by U QPR1+.

Bug: 404415649
Test: NetworkAgentTest
Flag: EXEMPT bugfix
Change-Id: I66d30b5f0be5628561bfeb1f90f5318954544e31
---
 .../android/testutils/CarrierConfigRule.kt    | 28 +++++++++++++------
 .../src/android/net/cts/NetworkAgentTest.kt   |  6 ++--
 2 files changed, 21 insertions(+), 13 deletions(-)

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/CarrierConfigRule.kt b/staticlibs/testutils/devicetests/com/android/testutils/CarrierConfigRule.kt
index 076398e2f8..0d70d24e3d 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/CarrierConfigRule.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/CarrierConfigRule.kt
@@ -25,7 +25,6 @@ import android.content.Intent
 import android.content.IntentFilter
 import android.content.pm.PackageManager
 import android.os.ConditionVariable
-import android.os.ParcelFileDescriptor
 import android.os.PersistableBundle
 import android.os.Process
 import android.telephony.CarrierConfigManager
@@ -38,6 +37,7 @@ import android.util.Log
 import androidx.test.platform.app.InstrumentationRegistry
 import com.android.modules.utils.build.SdkLevel
 import com.android.testutils.runAsShell
+import com.android.testutils.runCommandInShell
 import com.android.testutils.tryTest
 import java.security.MessageDigest
 import kotlin.test.assertEquals
@@ -135,11 +135,6 @@ class CarrierConfigRule : TestRule {
         }
     }
 
-    private fun runShellCommand(cmd: String) {
-        val fd: ParcelFileDescriptor = uiAutomation.executeShellCommand(cmd)
-        fd.close() // Don't care about the output.
-    }
-
     /**
      * Converts a byte array into a String of hexadecimal characters.
      *
@@ -234,12 +229,27 @@ class CarrierConfigRule : TestRule {
      */
     fun dropCarrierPrivilege(subId: Int) = setHoldCarrierPrivilege(false, subId)
 
+    /**
+     * Setting carrier service package was added in U QPR1, so check for that.
+     *
+     * In T and below, return false. In V and above, return true as this must work.
+     * In U, test for the command presence. That means the test can be disabled by
+     * removing that command in QPR1+, but this would indicate malicious intent.
+     */
+    fun isSettingCarrierServicePackageSupported(): Boolean {
+        if (SdkLevel.isAtLeastV()) return true
+        // A T device with this command present should not be held accountable to have it work
+        if (!SdkLevel.isAtLeastU()) return false
+        return !runCommandInShell("cmd phone set-carrier-service-package-override")
+                .startsWith("Unknown command")
+    }
+
     /**
      * Sets the carrier service package override for the given subscription ID. A null argument will
      * clear any previously-set override.
      */
     fun setCarrierServicePackageOverride(subId: Int, pkg: String?) {
-        if (!SdkLevel.isAtLeastU()) {
+        if (!isSettingCarrierServicePackageSupported()) {
             throw UnsupportedOperationException(
                 "Setting carrier service package override requires at least U SDK"
             )
@@ -275,10 +285,10 @@ class CarrierConfigRule : TestRule {
                 if (null == pkg) {
                     // There is a bug in clear-carrier-service-package-override where not adding
                     // the -s argument will use the wrong slot index : b/299604822
-                    runShellCommand("cmd phone clear-carrier-service-package-override" +
+                    runCommandInShell("cmd phone clear-carrier-service-package-override" +
                             " -s $subId")
                 } else {
-                    runShellCommand("cmd phone set-carrier-service-package-override $pkg" +
+                    runCommandInShell("cmd phone set-carrier-service-package-override $pkg" +
                             " -s $subId")
                 }
             }
diff --git a/tests/cts/net/src/android/net/cts/NetworkAgentTest.kt b/tests/cts/net/src/android/net/cts/NetworkAgentTest.kt
index 02a5d1f654..7c75211151 100644
--- a/tests/cts/net/src/android/net/cts/NetworkAgentTest.kt
+++ b/tests/cts/net/src/android/net/cts/NetworkAgentTest.kt
@@ -183,7 +183,6 @@ private const val DEFAULT_TIMEOUT_MS = 5000L
 private const val QUEUE_NETWORK_AGENT_EVENTS_IN_SYSTEM_SERVER =
     "queue_network_agent_events_in_system_server"
 
-
 // When waiting for a NetworkCallback to determine there was no timeout, waiting is the
 // only possible thing (the relevant handler is the one in the real ConnectivityService,
 // and then there is the Binder call), so have a short timeout for this as it will be
@@ -244,7 +243,6 @@ class NetworkAgentTest {
             QUEUE_NETWORK_AGENT_EVENTS_IN_SYSTEM_SERVER
         )
 
-
     @Before
     fun setUp() {
         instrumentation.getUiAutomation().adoptShellPermissionIdentity()
@@ -777,9 +775,9 @@ class NetworkAgentTest {
                     expectUidsPresent = false
             )
 
-            // The tools to set the carrier service package override do not exist before U,
+            // The tools to set the carrier service package override do not exist before U QPR1,
             // so there is no way to test the rest of this test on < U.
-            if (!SdkLevel.isAtLeastU()) return@tryTest
+            if (!carrierConfigRule.isSettingCarrierServicePackageSupported()) return@tryTest
             // Acquiring carrier privilege is necessary to override the carrier service package.
             val defaultSlotIndex = SubscriptionManager.getSlotIndex(defaultSubId)
             carrierConfigRule.acquireCarrierPrivilege(defaultSubId)

From f41687cae13d6b424e6c1603784b7f9b745839d5 Mon Sep 17 00:00:00 2001
From: Xiao Ma <xiaom@google.com>
Date: Mon, 31 Mar 2025 18:40:42 +0900
Subject: [PATCH 090/377] De-duplicate the lp func with the default lp.

Flag: EXEMPT test-only change
Bug: 368416967
Test: atest ConnectivityCoverageTests
Change-Id: I59436a257bea3b0e50b2b532b64f21ca5102f610
---
 .../connectivityservice/CSCaptivePortalAppTest.kt  | 14 ++------------
 .../connectivityservice/CSLocalAgentTests.kt       | 10 +---------
 .../connectivityservice/CSSatelliteNetworkTest.kt  | 12 +-----------
 3 files changed, 4 insertions(+), 32 deletions(-)

diff --git a/tests/unit/java/com/android/server/connectivityservice/CSCaptivePortalAppTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSCaptivePortalAppTest.kt
index ae544d5ee1..a75803fc3f 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSCaptivePortalAppTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSCaptivePortalAppTest.kt
@@ -23,9 +23,6 @@ import android.content.pm.PackageManager.PERMISSION_GRANTED
 import android.net.CaptivePortal
 import android.net.ConnectivityManager.ACTION_CAPTIVE_PORTAL_SIGN_IN
 import android.net.ConnectivityManager.EXTRA_CAPTIVE_PORTAL
-import android.net.IpPrefix
-import android.net.LinkAddress
-import android.net.LinkProperties
 import android.net.NetworkCapabilities
 import android.net.NetworkCapabilities.NET_CAPABILITY_CAPTIVE_PORTAL
 import android.net.NetworkCapabilities.NET_CAPABILITY_INTERNET
@@ -36,7 +33,6 @@ import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_VCN_MANAGED
 import android.net.NetworkCapabilities.TRANSPORT_WIFI
 import android.net.NetworkRequest
 import android.net.NetworkStack
-import android.net.RouteInfo
 import android.os.Build
 import android.os.Bundle
 import androidx.test.filters.SmallTest
@@ -62,12 +58,6 @@ private fun nc(transport: Int, vararg caps: Int) = NetworkCapabilities.Builder()
     addCapability(NET_CAPABILITY_NOT_VCN_MANAGED)
 }.build()
 
-private fun lp(iface: String) = LinkProperties().apply {
-    interfaceName = iface
-    addLinkAddress(LinkAddress(LOCAL_IPV4_ADDRESS, 32))
-    addRoute(RouteInfo(IpPrefix("0.0.0.0/0"), null, null))
-}
-
 @DevSdkIgnoreRunner.MonitorThreadLeak
 @RunWith(DevSdkIgnoreRunner::class)
 @SmallTest
@@ -101,8 +91,8 @@ class CSCaptivePortalAppTest : CSTest() {
     private fun createWifiAgent(): CSAgentWrapper {
         return Agent(
             score = keepScore(),
-            lp = lp(WIFI_IFACE),
-                nc = nc(TRANSPORT_WIFI, NET_CAPABILITY_INTERNET)
+            lp = defaultLp().apply { interfaceName = WIFI_IFACE },
+            nc = nc(TRANSPORT_WIFI, NET_CAPABILITY_INTERNET)
         )
     }
 
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSLocalAgentTests.kt b/tests/unit/java/com/android/server/connectivityservice/CSLocalAgentTests.kt
index 5a7eda8459..6fd40e8864 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSLocalAgentTests.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSLocalAgentTests.kt
@@ -16,9 +16,6 @@
 
 package com.android.server
 
-import android.net.IpPrefix
-import android.net.LinkAddress
-import android.net.LinkProperties
 import android.net.LocalNetworkConfig
 import android.net.MulticastRoutingConfig
 import android.net.MulticastRoutingConfig.CONFIG_FORWARD_NONE
@@ -36,7 +33,6 @@ import android.net.NetworkCapabilities.TRANSPORT_WIFI
 import android.net.NetworkRequest
 import android.net.NetworkScore
 import android.net.NetworkScore.KEEP_CONNECTED_LOCAL_NETWORK
-import android.net.RouteInfo
 import android.net.connectivity.ConnectivityCompatChanges.ENABLE_MATCH_LOCAL_NETWORK
 import android.net.connectivity.ConnectivityCompatChanges.ENABLE_MATCH_NON_THREAD_LOCAL_NETWORKS
 import android.os.Build
@@ -72,11 +68,7 @@ private fun nc(transport: Int, vararg caps: Int) = NetworkCapabilities.Builder()
     addCapability(NET_CAPABILITY_NOT_VCN_MANAGED)
 }.build()
 
-private fun lp(iface: String) = LinkProperties().apply {
-    interfaceName = iface
-    addLinkAddress(LinkAddress(LOCAL_IPV4_ADDRESS, 32))
-    addRoute(RouteInfo(IpPrefix("0.0.0.0/0"), null, null))
-}
+private fun lp(iface: String) = defaultLp().apply { interfaceName = iface }
 
 @DevSdkIgnoreRunner.MonitorThreadLeak
 @RunWith(DevSdkIgnoreRunner::class)
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSSatelliteNetworkTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSSatelliteNetworkTest.kt
index a6181d9caf..92dd45eb59 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSSatelliteNetworkTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSSatelliteNetworkTest.kt
@@ -17,9 +17,6 @@
 package com.android.server
 
 import android.net.INetd
-import android.net.IpPrefix
-import android.net.LinkAddress
-import android.net.LinkProperties
 import android.net.NativeNetworkConfig
 import android.net.NativeNetworkType
 import android.net.NetworkCapabilities
@@ -30,7 +27,6 @@ import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_ROAMING
 import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_SUSPENDED
 import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_VCN_MANAGED
 import android.net.NetworkCapabilities.TRANSPORT_SATELLITE
-import android.net.RouteInfo
 import android.net.UidRange
 import android.net.UidRangeParcel
 import android.net.VpnManager
@@ -255,7 +251,7 @@ class CSSatelliteNetworkTest : CSTest() {
     private fun createSatelliteAgent(name: String, restricted: Boolean = true): CSAgentWrapper {
         return Agent(
             score = keepScore(),
-            lp = lp(name),
+            lp = defaultLp().apply { interfaceName = name },
             nc = satelliteNc(restricted)
         )
     }
@@ -293,10 +289,4 @@ class CSSatelliteNetworkTest : CSTest() {
                 }
                 removeCapability(NET_CAPABILITY_NOT_BANDWIDTH_CONSTRAINED)
             }.build()
-
-    private fun lp(iface: String) = LinkProperties().apply {
-        interfaceName = iface
-        addLinkAddress(LinkAddress(LOCAL_IPV4_ADDRESS, 32))
-        addRoute(RouteInfo(IpPrefix("0.0.0.0/0"), null, null))
-    }
 }

From 428d25ceacf8d1dff4113088bf5e192d70bdc367 Mon Sep 17 00:00:00 2001
From: Yuyang Huang <yuyanghuang@google.com>
Date: Tue, 8 Apr 2025 18:21:12 +0900
Subject: [PATCH 091/377] Correct race condition in RealtimeSchedulerTest

This commit corrects a race condition in the RealtimeSchedulerTest. The
fix ensures that when the TestHandler processes a message, it first adds
the message to the executionTimes before calling cv.open(). This change
guarantees the correct order of operations and prevents potential
synchronization issues.

Test: TH
Bug: 403413950
Flag: EXEMPT bugfix
Change-Id: I16dee5475db315b1b40d0779db4ff31407bf54b5
---
 .../src/com/android/net/module/util/RealtimeSchedulerTest.kt  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/staticlibs/tests/unit/src/com/android/net/module/util/RealtimeSchedulerTest.kt b/staticlibs/tests/unit/src/com/android/net/module/util/RealtimeSchedulerTest.kt
index 30b530f3d0..fb7f3d9cad 100644
--- a/staticlibs/tests/unit/src/com/android/net/module/util/RealtimeSchedulerTest.kt
+++ b/staticlibs/tests/unit/src/com/android/net/module/util/RealtimeSchedulerTest.kt
@@ -46,10 +46,10 @@ class RealtimeSchedulerTest {
     private class TestHandler(looper: Looper) : Handler(looper) {
         override fun handleMessage(msg: Message) {
             val pair = msg.obj as Pair<ConditionVariable, MutableList<Long>>
-            val cv = pair.first
-            cv.open()
             val executionTimes = pair.second
             executionTimes.add(SystemClock.elapsedRealtime())
+            val cv = pair.first
+            cv.open()
         }
     }
     private val thread = HandlerThread(RealtimeSchedulerTest::class.simpleName).apply { start() }

From f01fa8ab350d956b22eb24c8f1e8eceb2afdb6da Mon Sep 17 00:00:00 2001
From: Jacque Li <jacqueli@google.com>
Date: Fri, 4 Apr 2025 09:51:13 -0400
Subject: [PATCH 092/377] Remove extraneous uid check to localNetBlockMap

Bug:406956423
Flag: EXEMPT refactor
Change-Id: I6531e1600a43be93a0dc62d7898077c28aabc6ee
---
 .../com/android/server/connectivity/PermissionMonitor.java    | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/service/src/com/android/server/connectivity/PermissionMonitor.java b/service/src/com/android/server/connectivity/PermissionMonitor.java
index 5de5f61ff1..bb0ee83076 100755
--- a/service/src/com/android/server/connectivity/PermissionMonitor.java
+++ b/service/src/com/android/server/connectivity/PermissionMonitor.java
@@ -319,9 +319,7 @@ public class PermissionMonitor {
         if (hasSdkSandbox(uid)){
             // SDKs in the SDK RT cannot hold runtime permissions
             final int sdkSandboxUid = sProcessShim.toSdkSandboxUid(uid);
-            if (!mBpfNetMaps.isUidBlockedFromUsingLocalNetwork(sdkSandboxUid)) {
-                mBpfNetMaps.addUidToLocalNetBlockMap(sdkSandboxUid);
-            }
+            mBpfNetMaps.addUidToLocalNetBlockMap(sdkSandboxUid);
         }
     }
 

From b4d727e0ec137696806bad62383a4b74b9574679 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Tue, 8 Apr 2025 12:43:48 -0700
Subject: [PATCH 093/377] mdnsd_netbpfload: reduce spam on failure
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Test: TreeHugger
Bug: 408073256
Flag: EXEMPT mainline
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I698a4211cb32a11465de9e64932220a2bf464075
---
 bpf/dns_helper/DnsBpfHelper.cpp | 10 ++++++++--
 bpf/netd/BpfHandler.cpp         | 12 +++++++++---
 2 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/bpf/dns_helper/DnsBpfHelper.cpp b/bpf/dns_helper/DnsBpfHelper.cpp
index cf2fa2b736..20add47b60 100644
--- a/bpf/dns_helper/DnsBpfHelper.cpp
+++ b/bpf/dns_helper/DnsBpfHelper.cpp
@@ -42,10 +42,16 @@ static inline void waitForNetProgsLoaded() {
   // infinite loop until success with 5/10/20/40/60/60/60... delay
   for (int delay = 5;; delay *= 2) {
     if (delay > 60) delay = 60;
-    if (base::WaitForProperty("init.svc.mdnsd_netbpfload", "stopped", std::chrono::seconds(delay))
-      && mainlineNetBpfLoadDone()) return;
+    if (base::WaitForProperty("init.svc.mdnsd_netbpfload", "stopped", std::chrono::seconds(delay)))
+      break;
     LOG(WARNING) << "Waited " << delay << "s for init.svc.mdnsd_netbpfload=stopped, still waiting.";
   }
+  if (!mainlineNetBpfLoadDone()) {
+    LOG(ERROR) << "FATAL: init.svc.mdnsd_netbpfload=stopped, yet !mainlineNetBpfLoadDone";
+    // mdnsd_netbpfload is marked 'reboot_on_failure', init should start a reboot very soon now,
+    // spamming logs with an abort is pointless
+    for (;;);
+  }
 }
 
 base::Result<void> DnsBpfHelper::init() {
diff --git a/bpf/netd/BpfHandler.cpp b/bpf/netd/BpfHandler.cpp
index 680c05eb00..38d3db5b57 100644
--- a/bpf/netd/BpfHandler.cpp
+++ b/bpf/netd/BpfHandler.cpp
@@ -214,11 +214,17 @@ static inline void waitForNetProgsLoaded() {
     // infinite loop until success with 5/10/20/40/60/60/60... delay
     for (int delay = 5;; delay *= 2) {
         if (delay > 60) delay = 60;
-        if (WaitForProperty("init.svc.mdnsd_netbpfload", "stopped", std::chrono::seconds(delay))
-            && mainlineNetBpfLoadDone())
-            return;
+        if (WaitForProperty("init.svc.mdnsd_netbpfload", "stopped", std::chrono::seconds(delay)))
+            break;
         ALOGW("Waited %ds for init.svc.mdnsd_netbpfload=stopped, still waiting...", delay);
     }
+    if (!mainlineNetBpfLoadDone()) {
+        ALOGE("FATAL: init.svc.mdnsd_netbpfload=stopped, yet !mainlineNetBpfLoadDone");
+        // mdnsd_netbpfload is marked 'reboot_on_failure', init should start a reboot very soon now,
+        // spamming logs with an abort is pointless
+        for (;;);
+    }
+    return;
 }
 
 static inline void waitForBpf() {

From fa1a969fe928a2662aa50dab5601a64ebed52b6f Mon Sep 17 00:00:00 2001
From: Melisa CZ <melisacz@google.com>
Date: Fri, 28 Mar 2025 09:18:45 -0700
Subject: [PATCH 094/377] bpf: Filter localhost packages if sent/received by
 sdksandbox process

Added a BPF_PERMISSION_SDKSANDBOX_LOCALHOST that is only checked for
sdksandbox processes.

NO_IFTTT= change made in aosp/3470371

Bug: 326383676
Test: connectivity_native_test
Flag: EXEMPT go/connectivity-mainline-trunk-stable
Change-Id: I5ece6eadbc7e546a47b3a858420f1a09cc92066d
---
 bpf/progs/netd.c | 31 ++++++++++++++++++-------------
 bpf/progs/netd.h | 14 ++++++++++++++
 2 files changed, 32 insertions(+), 13 deletions(-)

diff --git a/bpf/progs/netd.c b/bpf/progs/netd.c
index 60c5a1c2ea..7525f20e92 100644
--- a/bpf/progs/netd.c
+++ b/bpf/progs/netd.c
@@ -433,6 +433,20 @@ static __always_inline inline BpfConfig getConfig(uint32_t configKey) {
     return *config;
 }
 
+static __always_inline inline uint8_t get_uid_permissions(uint32_t uid) {
+    /*
+     * A given app is guaranteed to have the same app ID in all the profiles in
+     * which it is installed, and install permission is granted to an app for all
+     * users at install time so we only check the appId part of a request uid at
+     * run time. See UserHandle#isSameApp for detail.
+     */
+    uint32_t appId = uid % AID_USER_OFFSET; // == PER_USER_RANGE == 100000
+
+    uint8_t *permissions = bpf_uid_permission_map_lookup_elem(&appId);
+    // if UID not in map, then default to just INTERNET permission.
+    return permissions ? *permissions : BPF_PERMISSION_INTERNET;
+}
+
 static __always_inline inline bool ingress_should_discard(struct __sk_buff* skb,
                                                           const struct kver_uint kver) {
     // Require 4.19, since earlier kernels don't have bpf_skb_load_bytes_relative() which
@@ -496,8 +510,9 @@ static __always_inline inline int bpf_owner_match(struct __sk_buff* skb, uint32_
         }
     }
 
-    if (SDK_LEVEL_IS_AT_LEAST(lvl, 25Q2) && skb->ifindex == 1) {
-        // TODO: sdksandbox localhost restrictions
+    if (SDK_LEVEL_IS_AT_LEAST(lvl, 25Q2) && skb->ifindex == 1 && is_sdksandbox_uid(uid)) {
+        // check if the UID is allowed localhost connections
+        if (!(get_uid_permissions(uid) & BPF_PERMISSION_SDKSANDBOX_LOCALHOST)) return DROP;
     }
 
     return PASS;
@@ -759,17 +774,7 @@ DEFINE_XTBPF_PROG("skfilter/denylist/xtbpf", xt_bpf_denylist_prog)
 }
 
 static __always_inline inline uint8_t get_app_permissions() {
-    uint64_t gid_uid = bpf_get_current_uid_gid();
-    /*
-     * A given app is guaranteed to have the same app ID in all the profiles in
-     * which it is installed, and install permission is granted to app for all
-     * user at install time so we only check the appId part of a request uid at
-     * run time. See UserHandle#isSameApp for detail.
-     */
-    uint32_t appId = (gid_uid & 0xffffffff) % AID_USER_OFFSET;  // == PER_USER_RANGE == 100000
-    uint8_t* permissions = bpf_uid_permission_map_lookup_elem(&appId);
-    // if UID not in map, then default to just INTERNET permission.
-    return permissions ? *permissions : BPF_PERMISSION_INTERNET;
+    return get_uid_permissions(bpf_get_current_uid_gid() & 0xffffffff);
 }
 
 static __always_inline inline int inet_socket_create(struct bpf_sock* sk,
diff --git a/bpf/progs/netd.h b/bpf/progs/netd.h
index aa5f9cc9bf..9d80c69e03 100644
--- a/bpf/progs/netd.h
+++ b/bpf/progs/netd.h
@@ -215,10 +215,16 @@ enum UidOwnerMatchType : uint32_t {
 };
 // LINT.ThenChange(../framework/src/android/net/BpfNetMapsConstants.java)
 
+// LINT.IfChange(bpf_permission)
+// The BpfPermissionMatch values should match the traffic permissions defined in NetworkPermissions:
+// BPF_PERMISSION_<X> should have the same value that TRAFFIC_PERMISSION_<X>
 enum BpfPermissionMatch : uint8_t {
     BPF_PERMISSION_INTERNET = 1 << 2,
     BPF_PERMISSION_UPDATE_DEVICE_STATS = 1 << 3,
+    BPF_PERMISSION_SDKSANDBOX_LOCALHOST = 1 << 4,
 };
+// LINT.ThenChange(packages/modules/Connectivity/service/src/com/android/server/connectivity/NetworkPermissions.java)
+
 // In production we use two identical stats maps to record per uid stats and
 // do swap and clean based on the configuration specified here. The statsMapType
 // value in configuration map specified which map is currently in use.
@@ -293,3 +299,11 @@ static inline bool is_system_uid(uint32_t uid) {
     // MAX_SYSTEM_UID is AID_NOBODY == 9999, while AID_APP_START == 10000
     return ((uid % AID_USER_OFFSET) < AID_APP_START);
 }
+
+static inline bool is_sdksandbox_uid(uint32_t uid) {
+    uint32_t appid = uid % AID_USER_OFFSET;
+    // AID_SDK_SANDBOX_PROCESS_START = 20000
+    // AID_SDK_SANDBOX_PROCESS_END = 29999
+    return appid >= AID_SDK_SANDBOX_PROCESS_START &&
+           appid <= AID_SDK_SANDBOX_PROCESS_END;
+}

From a118d863789bfb63f361d6cd6a1024c0b0ef8c57 Mon Sep 17 00:00:00 2001
From: Xiao Ma <xiaom@google.com>
Date: Mon, 31 Mar 2025 19:06:14 +0900
Subject: [PATCH 095/377] De-duplicate the nc func in the CS unit test.

Flag: EXEMPT test-only change
Bug: 368416967
Test: atest ConnectivityCoverageTests
Change-Id: Idc02d6fce816ccf7aa3512d5b8f1f7a55cf1a676
---
 .../CSActiveNetworkInfoTest.kt                  | 10 +---------
 .../CSCaptivePortalAppTest.kt                   | 17 -----------------
 .../connectivityservice/CSLocalAgentTests.kt    | 16 ----------------
 .../server/connectivityservice/base/CSTest.kt   |  7 +++++++
 .../connectivityservice/base/CSTestHelpers.kt   |  1 +
 5 files changed, 9 insertions(+), 42 deletions(-)

diff --git a/tests/unit/java/com/android/server/connectivityservice/CSActiveNetworkInfoTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSActiveNetworkInfoTest.kt
index 360a298949..1516938cb2 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSActiveNetworkInfoTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSActiveNetworkInfoTest.kt
@@ -18,9 +18,7 @@ package com.android.server
 
 import android.net.INetd.PERMISSION_INTERNET
 import android.net.INetd.PERMISSION_NONE
-import android.net.NetworkCapabilities
 import android.net.NetworkCapabilities.NET_CAPABILITY_INTERNET
-import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_VCN_MANAGED
 import android.net.NetworkCapabilities.TRANSPORT_WIFI
 import android.net.NetworkInfo.DetailedState.BLOCKED
 import android.net.NetworkInfo.DetailedState.CONNECTED
@@ -37,12 +35,6 @@ import org.mockito.ArgumentMatchers.anyBoolean
 import org.mockito.ArgumentMatchers.anyInt
 import org.mockito.Mockito.doReturn
 
-private fun nc() = NetworkCapabilities.Builder()
-        .addTransportType(TRANSPORT_WIFI)
-        .addCapability(NET_CAPABILITY_INTERNET)
-        .addCapability(NET_CAPABILITY_NOT_VCN_MANAGED)
-        .build()
-
 @RunWith(DevSdkIgnoreRunner::class)
 @SmallTest
 @IgnoreUpTo(Build.VERSION_CODES.UPSIDE_DOWN_CAKE)
@@ -56,7 +48,7 @@ class CSActiveNetworkInfoTest : CSTest() {
         deps.setChangeIdEnabled(changeEnabled, NETWORK_BLOCKED_WITHOUT_INTERNET_PERMISSION)
         doReturn(permissions).`when`(bpfNetMaps).getNetPermForUid(anyInt())
 
-        val agent = Agent(nc = nc())
+        val agent = Agent(nc = nc(TRANSPORT_WIFI, NET_CAPABILITY_INTERNET))
         agent.connect()
 
         val networkInfo = cm.activeNetworkInfo
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSCaptivePortalAppTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSCaptivePortalAppTest.kt
index a75803fc3f..90a63b2d24 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSCaptivePortalAppTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSCaptivePortalAppTest.kt
@@ -23,13 +23,8 @@ import android.content.pm.PackageManager.PERMISSION_GRANTED
 import android.net.CaptivePortal
 import android.net.ConnectivityManager.ACTION_CAPTIVE_PORTAL_SIGN_IN
 import android.net.ConnectivityManager.EXTRA_CAPTIVE_PORTAL
-import android.net.NetworkCapabilities
 import android.net.NetworkCapabilities.NET_CAPABILITY_CAPTIVE_PORTAL
 import android.net.NetworkCapabilities.NET_CAPABILITY_INTERNET
-import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_RESTRICTED
-import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_ROAMING
-import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_SUSPENDED
-import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_VCN_MANAGED
 import android.net.NetworkCapabilities.TRANSPORT_WIFI
 import android.net.NetworkRequest
 import android.net.NetworkStack
@@ -46,18 +41,6 @@ import org.mockito.ArgumentMatchers.anyInt
 import org.mockito.Mockito.never
 import org.mockito.Mockito.verify
 
-private fun nc(transport: Int, vararg caps: Int) = NetworkCapabilities.Builder().apply {
-    addTransportType(transport)
-    caps.forEach {
-        addCapability(it)
-    }
-    // Useful capabilities for everybody
-    addCapability(NET_CAPABILITY_NOT_RESTRICTED)
-    addCapability(NET_CAPABILITY_NOT_SUSPENDED)
-    addCapability(NET_CAPABILITY_NOT_ROAMING)
-    addCapability(NET_CAPABILITY_NOT_VCN_MANAGED)
-}.build()
-
 @DevSdkIgnoreRunner.MonitorThreadLeak
 @RunWith(DevSdkIgnoreRunner::class)
 @SmallTest
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSLocalAgentTests.kt b/tests/unit/java/com/android/server/connectivityservice/CSLocalAgentTests.kt
index 6fd40e8864..92c91eae32 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSLocalAgentTests.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSLocalAgentTests.kt
@@ -23,10 +23,6 @@ import android.net.NetworkCapabilities
 import android.net.NetworkCapabilities.NET_CAPABILITY_DUN
 import android.net.NetworkCapabilities.NET_CAPABILITY_INTERNET
 import android.net.NetworkCapabilities.NET_CAPABILITY_LOCAL_NETWORK
-import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_RESTRICTED
-import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_ROAMING
-import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_SUSPENDED
-import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_VCN_MANAGED
 import android.net.NetworkCapabilities.TRANSPORT_CELLULAR
 import android.net.NetworkCapabilities.TRANSPORT_THREAD
 import android.net.NetworkCapabilities.TRANSPORT_WIFI
@@ -56,18 +52,6 @@ private const val TIMEOUT_MS = 200L
 private const val MEDIUM_TIMEOUT_MS = 1_000L
 private const val LONG_TIMEOUT_MS = 5_000
 
-private fun nc(transport: Int, vararg caps: Int) = NetworkCapabilities.Builder().apply {
-    addTransportType(transport)
-    caps.forEach {
-        addCapability(it)
-    }
-    // Useful capabilities for everybody
-    addCapability(NET_CAPABILITY_NOT_RESTRICTED)
-    addCapability(NET_CAPABILITY_NOT_SUSPENDED)
-    addCapability(NET_CAPABILITY_NOT_ROAMING)
-    addCapability(NET_CAPABILITY_NOT_VCN_MANAGED)
-}.build()
-
 private fun lp(iface: String) = defaultLp().apply { interfaceName = iface }
 
 @DevSdkIgnoreRunner.MonitorThreadLeak
diff --git a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
index f8620a7c79..b7e023af12 100644
--- a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
@@ -604,4 +604,11 @@ open class CSTest {
     fun keepScore() = FromS(
         NetworkScore.Builder().setKeepConnectedReason(KEEP_CONNECTED_FOR_TEST).build()
     )
+
+    fun nc(transport: Int, vararg caps: Int) = defaultNc().apply {
+        addTransportType(transport)
+        caps.forEach {
+            addCapability(it)
+        }
+    }
 }
diff --git a/tests/unit/java/com/android/server/connectivityservice/base/CSTestHelpers.kt b/tests/unit/java/com/android/server/connectivityservice/base/CSTestHelpers.kt
index f28f063bb8..9e5ca68b21 100644
--- a/tests/unit/java/com/android/server/connectivityservice/base/CSTestHelpers.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/base/CSTestHelpers.kt
@@ -78,6 +78,7 @@ internal fun emptyAgentConfig(legacyType: Int) = NetworkAgentConfig.Builder()
 
 internal fun defaultNc() = NetworkCapabilities.Builder()
         // Add sensible defaults for agents that don't want to care
+        .addCapability(NetworkCapabilities.NET_CAPABILITY_NOT_RESTRICTED)
         .addCapability(NetworkCapabilities.NET_CAPABILITY_NOT_SUSPENDED)
         .addCapability(NetworkCapabilities.NET_CAPABILITY_NOT_ROAMING)
         .addCapability(NetworkCapabilities.NET_CAPABILITY_NOT_VCN_MANAGED)

From dd9c3d3beb4ae91ec58f28e8cee937940bbdc949 Mon Sep 17 00:00:00 2001
From: Xiao Ma <xiaom@google.com>
Date: Mon, 31 Mar 2025 23:10:37 +0900
Subject: [PATCH 096/377] De-duplicate the createWifiAgent func in the CS unit
 test.

Flag: EXEMPT test-only change
Bug: 368416967
Test: atest ConnectivityCoverageTests
Change-Id: Id51f39c1f2043474632b07a462fc23238115a33f
---
 .../connectivityservice/CSCaptivePortalAppTest.kt    | 10 +---------
 .../server/connectivityservice/CSLocalAgentTests.kt  | 12 ++----------
 .../server/connectivityservice/base/CSTest.kt        |  9 +++++++++
 3 files changed, 12 insertions(+), 19 deletions(-)

diff --git a/tests/unit/java/com/android/server/connectivityservice/CSCaptivePortalAppTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSCaptivePortalAppTest.kt
index 90a63b2d24..a3019bb45e 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSCaptivePortalAppTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSCaptivePortalAppTest.kt
@@ -56,7 +56,7 @@ class CSCaptivePortalAppTest : CSTest() {
         val captivePortalRequest = NetworkRequest.Builder()
                 .addCapability(NET_CAPABILITY_CAPTIVE_PORTAL).build()
         cm.registerNetworkCallback(captivePortalRequest, captivePortalCallback)
-        val wifiAgent = createWifiAgent()
+        val wifiAgent = createAgent(WIFI_IFACE, TRANSPORT_WIFI, NET_CAPABILITY_INTERNET)
         wifiAgent.connectWithCaptivePortal(TEST_REDIRECT_URL)
         captivePortalCallback.expectAvailableCallbacksUnvalidated(wifiAgent)
         val signInIntent = startCaptivePortalApp(wifiAgent)
@@ -71,14 +71,6 @@ class CSCaptivePortalAppTest : CSTest() {
         verify(wifiAgent.networkMonitor, never()).forceReevaluation(anyInt())
     }
 
-    private fun createWifiAgent(): CSAgentWrapper {
-        return Agent(
-            score = keepScore(),
-            lp = defaultLp().apply { interfaceName = WIFI_IFACE },
-            nc = nc(TRANSPORT_WIFI, NET_CAPABILITY_INTERNET)
-        )
-    }
-
     private fun startCaptivePortalApp(networkAgent: CSAgentWrapper): Intent {
         val network = networkAgent.network
         cm.startCaptivePortalApp(network)
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSLocalAgentTests.kt b/tests/unit/java/com/android/server/connectivityservice/CSLocalAgentTests.kt
index 92c91eae32..cecc177485 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSLocalAgentTests.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSLocalAgentTests.kt
@@ -204,19 +204,11 @@ class CSLocalAgentTests : CSTest() {
     }
 
     private fun createWifiAgent(name: String): CSAgentWrapper {
-        return Agent(
-                score = keepScore(),
-                lp = lp(name),
-                nc = nc(TRANSPORT_WIFI, NET_CAPABILITY_INTERNET)
-        )
+        return createAgent(name, TRANSPORT_WIFI, NET_CAPABILITY_INTERNET)
     }
 
     private fun createCellAgent(name: String): CSAgentWrapper {
-        return Agent(
-                score = keepScore(),
-                lp = lp(name),
-                nc = nc(TRANSPORT_CELLULAR, NET_CAPABILITY_INTERNET)
-        )
+        return createAgent(name, TRANSPORT_CELLULAR, NET_CAPABILITY_INTERNET)
     }
 
     private fun sendLocalNetworkConfig(
diff --git a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
index b7e023af12..c236ea5673 100644
--- a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
@@ -611,4 +611,13 @@ open class CSTest {
             addCapability(it)
         }
     }
+
+    // Create a network agent with the given parameters.
+    fun createAgent(interfaceName: String, transport: Int, vararg caps: Int): CSAgentWrapper {
+        return Agent(
+                score = keepScore(),
+                lp = defaultLp().apply { this.interfaceName = interfaceName },
+                nc = nc(transport, *caps)
+        )
+    }
 }

From 198b3218e727baeed59fe9812d2a35307f3ed164 Mon Sep 17 00:00:00 2001
From: Kangping Dong <wgtdkp@google.com>
Date: Tue, 8 Apr 2025 10:09:01 +0800
Subject: [PATCH 097/377] [Thread] enable/disable Thread via DeviceConfig flags

Flag: EXEMPT See b/407643308
Bug: 407643308

Change-Id: Ia40b562ab41210c8f9b90742420a2f2c32c9071b
---
 thread/service/Android.bp                     |   1 +
 .../android/server/thread/ClockSource.java    |  29 +++
 .../android/server/thread/FeatureFlags.java   |  21 +-
 .../ThreadNetworkControllerService.java       | 105 ++++++++--
 .../thread/ThreadPersistentSettings.java      |  32 ++-
 thread/tests/unit/Android.bp                  |   1 +
 .../ThreadNetworkControllerServiceTest.java   | 198 ++++++++++--------
 .../thread/ThreadPersistentSettingsTest.java  |  45 ++--
 8 files changed, 295 insertions(+), 137 deletions(-)
 create mode 100644 thread/service/java/com/android/server/thread/ClockSource.java

diff --git a/thread/service/Android.bp b/thread/service/Android.bp
index 1f4e601ce6..25c77eee82 100644
--- a/thread/service/Android.bp
+++ b/thread/service/Android.bp
@@ -34,6 +34,7 @@ java_library {
     min_sdk_version: "30",
     srcs: [":service-thread-sources"],
     libs: [
+        "framework-configinfrastructure.stubs.module_lib",
         "framework-connectivity-pre-jarjar",
         "framework-connectivity-t-pre-jarjar",
         "framework-location.stubs.module_lib",
diff --git a/thread/service/java/com/android/server/thread/ClockSource.java b/thread/service/java/com/android/server/thread/ClockSource.java
new file mode 100644
index 0000000000..5c6cf7fa68
--- /dev/null
+++ b/thread/service/java/com/android/server/thread/ClockSource.java
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.server.thread;
+
+import android.os.SystemClock;
+
+import java.time.Clock;
+import java.time.DateTimeException;
+
+/** A mockable class for providing {@link Clock}. */
+public class ClockSource {
+    public Clock currentNetworkTimeClock() throws DateTimeException {
+        return SystemClock.currentNetworkTimeClock();
+    }
+}
diff --git a/thread/service/java/com/android/server/thread/FeatureFlags.java b/thread/service/java/com/android/server/thread/FeatureFlags.java
index 29bcedd0b3..6591750a1b 100644
--- a/thread/service/java/com/android/server/thread/FeatureFlags.java
+++ b/thread/service/java/com/android/server/thread/FeatureFlags.java
@@ -17,14 +17,17 @@ package com.android.server.thread;
 import com.android.net.module.util.DeviceConfigUtils;
 
 public class FeatureFlags {
-    // The namespace for Thread Network feature flags
-    private static final String NAMESPACE_THREAD_NETWORK = "thread_network";
+    /** The namespace for Thread Network feature flags. */
+    public static final String NAMESPACE_THREAD_NETWORK = "thread_network";
 
     // The prefix for TREL feature flags
     private static final String TREL_FEATURE_PREFIX = "TrelFeature__";
 
     // The feature flag for TREL enabled state
-    private static final String TREL_ENABLED_FLAG = TREL_FEATURE_PREFIX + "enabled";
+    private static final String KEY_TREL_ENABLED_FLAG = TREL_FEATURE_PREFIX + "enabled";
+
+    private static final String KEY_THREAD_DEFAULT_ENABLED =
+            "ThreadEnablementFeature__default_enabled";
 
     private static boolean isFeatureEnabled(String flag, boolean defaultValue) {
         return DeviceConfigUtils.getDeviceConfigPropertyBoolean(
@@ -32,6 +35,16 @@ public class FeatureFlags {
     }
 
     public static boolean isTrelEnabled() {
-        return isFeatureEnabled(TREL_ENABLED_FLAG, false);
+        return isFeatureEnabled(KEY_TREL_ENABLED_FLAG, false);
+    }
+
+    /**
+     * Returns {@code true} if Thread is by default enabled in {@code DeviceConfig}.
+     *
+     * <p>It returns the {@code fallbackValue} if the {@code DeviceConfig} value is not found on
+     * this device.
+     */
+    public static boolean isThreadDefaultEnabled(boolean fallbackValue) {
+        return isFeatureEnabled(KEY_THREAD_DEFAULT_ENABLED, fallbackValue);
     }
 }
diff --git a/thread/service/java/com/android/server/thread/ThreadNetworkControllerService.java b/thread/service/java/com/android/server/thread/ThreadNetworkControllerService.java
index e99c88ee46..c3992ddbb4 100644
--- a/thread/service/java/com/android/server/thread/ThreadNetworkControllerService.java
+++ b/thread/service/java/com/android/server/thread/ThreadNetworkControllerService.java
@@ -117,12 +117,13 @@ import android.os.IBinder;
 import android.os.Looper;
 import android.os.ParcelFileDescriptor;
 import android.os.RemoteException;
-import android.os.SystemClock;
 import android.os.UserManager;
+import android.provider.DeviceConfig;
 import android.util.SparseArray;
 
 import com.android.connectivity.resources.R;
 import com.android.internal.annotations.VisibleForTesting;
+import com.android.modules.utils.HandlerExecutor;
 import com.android.net.module.util.IIpv4PrefixRequest;
 import com.android.net.module.util.RoutingCoordinatorManager;
 import com.android.net.module.util.SharedLog;
@@ -192,6 +193,7 @@ final class ThreadNetworkControllerService extends IThreadNetworkController.Stub
 
     private final Context mContext;
     private final Handler mHandler;
+    private final ClockSource mClockSource;
     private final MockableSystemProperties mSystemProperties;
 
     // Below member fields can only be accessed from the handler thread (`mHandler`). In
@@ -230,6 +232,7 @@ final class ThreadNetworkControllerService extends IThreadNetworkController.Stub
     private final UserManager mUserManager;
     private boolean mUserRestricted;
     private boolean mForceStopOtDaemonEnabled;
+    private boolean mThreadDefaultEnabled;
 
     private InfraLinkState mInfraLinkState;
 
@@ -237,6 +240,7 @@ final class ThreadNetworkControllerService extends IThreadNetworkController.Stub
     ThreadNetworkControllerService(
             Context context,
             Handler handler,
+            ClockSource clockSource,
             MockableSystemProperties systemProperties,
             NetworkProvider networkProvider,
             Supplier<IOtDaemon> otDaemonSupplier,
@@ -252,6 +256,7 @@ final class ThreadNetworkControllerService extends IThreadNetworkController.Stub
             Map<Network, LinkProperties> networkToLinkProperties) {
         mContext = context;
         mHandler = handler;
+        mClockSource = clockSource;
         mSystemProperties = systemProperties;
         mNetworkProvider = networkProvider;
         mOtDaemonSupplier = otDaemonSupplier;
@@ -290,6 +295,7 @@ final class ThreadNetworkControllerService extends IThreadNetworkController.Stub
         return new ThreadNetworkControllerService(
                 context,
                 handler,
+                new ClockSource(),
                 new MockableSystemProperties(),
                 networkProvider,
                 () -> IOtDaemon.Stub.asInterface(ServiceManagerWrapper.waitForService("ot_daemon")),
@@ -493,17 +499,21 @@ final class ThreadNetworkControllerService extends IThreadNetworkController.Stub
     private void initializeInternal() {
         checkOnHandlerThread();
 
+        mUserRestricted = isThreadUserRestricted();
+        mThreadDefaultEnabled = evaluateThreadDefaultEnabled();
+        registerUserRestrictionsReceiver();
+        registerDeviceConfigListener();
+
         LOG.v(
                 "Initializing Thread system service: Thread is "
                         + (shouldEnableThread() ? "enabled" : "disabled"));
+
         try {
             mTunIfController.createTunInterface();
         } catch (IOException e) {
             throw new IllegalStateException("Failed to create Thread tunnel interface", e);
         }
         mConnectivityManager.registerNetworkProvider(mNetworkProvider);
-        mUserRestricted = isThreadUserRestricted();
-        registerUserRestrictionsReceiver();
 
         if (isBorderRouterMode()) {
             requestUpstreamNetwork();
@@ -512,6 +522,7 @@ final class ThreadNetworkControllerService extends IThreadNetworkController.Stub
             cancelRequestUpstreamNetwork();
             unregisterThreadNetworkCallback();
         }
+
         maybeInitializeOtDaemon();
     }
 
@@ -773,6 +784,50 @@ final class ThreadNetworkControllerService extends IThreadNetworkController.Stub
         return mUserManager.hasUserRestriction(DISALLOW_THREAD_NETWORK);
     }
 
+    private void registerDeviceConfigListener() {
+        DeviceConfig.addOnPropertiesChangedListener(
+                FeatureFlags.NAMESPACE_THREAD_NETWORK,
+                new HandlerExecutor(mHandler),
+                this::onDeviceConfigChanged);
+    }
+
+    private void onDeviceConfigChanged(DeviceConfig.Properties properties) {
+        boolean newThreadDefaultEnabled = evaluateThreadDefaultEnabled();
+        if (mThreadDefaultEnabled == newThreadDefaultEnabled) {
+            return;
+        }
+        LOG.i(
+                "Thread default_enabled in DeviceConfig changed: "
+                        + mThreadDefaultEnabled
+                        + " -> "
+                        + newThreadDefaultEnabled);
+        mThreadDefaultEnabled = newThreadDefaultEnabled;
+
+        final boolean shouldEnableThread = shouldEnableThread();
+        final IOperationReceiver receiver =
+                new IOperationReceiver.Stub() {
+                    @Override
+                    public void onSuccess() {
+                        LOG.v(
+                                (shouldEnableThread ? "Enabled" : "Disabled")
+                                        + " Thread due to DeviceConfig change");
+                    }
+
+                    @Override
+                    public void onError(int errorCode, String errorMessage) {
+                        LOG.e(
+                                "Failed to "
+                                        + (shouldEnableThread ? "enable" : "disable")
+                                        + " Thread for DeviceConfig change");
+                    }
+                };
+
+        // Do not save the DeviceConfig flag to persistent settings so that the user
+        // configuration won't be overwritten
+        setEnabledInternal(
+                shouldEnableThread, false /* persist */, new OperationReceiverWrapper(receiver));
+    }
+
     /**
      * Returns {@code true} if Thread should be enabled based on current settings, runtime user
      * restriction state.
@@ -780,7 +835,14 @@ final class ThreadNetworkControllerService extends IThreadNetworkController.Stub
     private boolean shouldEnableThread() {
         return !mForceStopOtDaemonEnabled
                 && !mUserRestricted
-                && mPersistentSettings.get(ThreadPersistentSettings.KEY_THREAD_ENABLED);
+                && mPersistentSettings.getBoolean(
+                        ThreadPersistentSettings.KEY_THREAD_ENABLED, mThreadDefaultEnabled);
+    }
+
+    /** Returns {@code true} if Thread is by default enabled on this device. */
+    private boolean evaluateThreadDefaultEnabled() {
+        return FeatureFlags.isThreadDefaultEnabled(
+                mResources.get().getBoolean(R.bool.config_thread_default_enabled));
     }
 
     private void requestUpstreamNetwork() {
@@ -1061,7 +1123,8 @@ final class ThreadNetworkControllerService extends IThreadNetworkController.Stub
                                 supportedChannelMask,
                                 preferredChannelMask,
                                 new Random(),
-                                new SecureRandom());
+                                new SecureRandom(),
+                                mClockSource);
 
                 receiver.onSuccess(dataset);
             }
@@ -1078,11 +1141,12 @@ final class ThreadNetworkControllerService extends IThreadNetworkController.Stub
             int supportedChannelMask,
             int preferredChannelMask,
             Random random,
-            SecureRandom secureRandom) {
+            SecureRandom secureRandom,
+            ClockSource clockSource) {
         boolean authoritative = false;
         Instant now = Instant.now();
         try {
-            Clock clock = SystemClock.currentNetworkTimeClock();
+            Clock clock = clockSource.currentNetworkTimeClock();
             now = clock.instant();
             authoritative = true;
         } catch (DateTimeException e) {
@@ -1761,10 +1825,23 @@ final class ThreadNetworkControllerService extends IThreadNetworkController.Stub
                 // This is thrown when the client is dead, do nothing
             }
 
-            try {
-                getOtDaemon().registerStateCallback(this, callbackMetadata.id);
-            } catch (RemoteException | ThreadNetworkException e) {
-                LOG.e("otDaemon.registerStateCallback failed", e);
+            maybeRegisterStateCallback(callbackMetadata.id);
+        }
+
+        private void maybeRegisterStateCallback(long listenerId) {
+            // Do not start ot-daemon if Thread is disabled. Going forward, this check will be added
+            // into getOtDaemon()
+            if (shouldEnableThread()) {
+                try {
+                    getOtDaemon().registerStateCallback(this, listenerId);
+                } catch (RemoteException | ThreadNetworkException e) {
+                    LOG.e("otDaemon.registerStateCallback failed", e);
+                }
+            } else {
+                OtDaemonState state = new OtDaemonState();
+                state.activeDatasetTlvs = new byte[0];
+                state.pendingDatasetTlvs = new byte[0];
+                onStateChanged(state, listenerId);
             }
         }
 
@@ -1794,11 +1871,7 @@ final class ThreadNetworkControllerService extends IThreadNetworkController.Stub
                 mOpDatasetCallbacks.remove(callback);
             }
 
-            try {
-                getOtDaemon().registerStateCallback(this, callbackMetadata.id);
-            } catch (RemoteException | ThreadNetworkException e) {
-                LOG.e("otDaemon.registerStateCallback failed", e);
-            }
+            maybeRegisterStateCallback(callbackMetadata.id);
         }
 
         public void unregisterDatasetCallback(IOperationalDatasetCallback callback) {
diff --git a/thread/service/java/com/android/server/thread/ThreadPersistentSettings.java b/thread/service/java/com/android/server/thread/ThreadPersistentSettings.java
index fd6dec728c..ead5611c5b 100644
--- a/thread/service/java/com/android/server/thread/ThreadPersistentSettings.java
+++ b/thread/service/java/com/android/server/thread/ThreadPersistentSettings.java
@@ -120,9 +120,9 @@ public class ThreadPersistentSettings {
         mAtomicFile = atomicFile;
         mResources = resources;
 
-        mDefaultValues.put(
-                KEY_THREAD_ENABLED.key,
-                mResources.get().getBoolean(R.bool.config_thread_default_enabled));
+        // The Thread default enabled state is deferred to upper layer
+        mDefaultValues.put(KEY_THREAD_ENABLED.key, null);
+
         mDefaultValues.put(
                 KEY_CONFIG_BORDER_ROUTER_ENABLED.key,
                 mResources.get().getBoolean(R.bool.config_thread_border_router_default_enabled));
@@ -161,6 +161,9 @@ public class ThreadPersistentSettings {
         Object value;
         synchronized (mLock) {
             if (defaultValue == null) {
+                if (!key.equals(KEY_COUNTRY_CODE.key)) {
+                    throw new IllegalStateException("Unexpected null defaultValue for " + key);
+                }
                 value = mSettings.getString(key, null);
             } else if (defaultValue instanceof Boolean) {
                 value = mSettings.getBoolean(key, (Boolean) defaultValue);
@@ -192,6 +195,29 @@ public class ThreadPersistentSettings {
         return getObject(key.key, defaultValue);
     }
 
+    /**
+     * Returns a {@code boolean} settings value or {@code defaultValue} if the {@code key} is
+     * missing in the persistent settings.
+     *
+     * <p>This API is useful for allowing caller to provide a custom default value which is not
+     * determined when the system initializes.
+     */
+    public boolean getBoolean(Key<Boolean> key, boolean defaultValue) {
+        synchronized (mLock) {
+            return mSettings.getBoolean(key.key, defaultValue);
+        }
+    }
+
+    /**
+     * Returns {@code true} if a value for the given {@code key} has been saved to this settings.
+     */
+    @VisibleForTesting
+    <T> boolean containsKey(Key<T> key) {
+        synchronized (mLock) {
+            return mSettings.containsKey(key.key);
+        }
+    }
+
     /**
      * Store a {@link ThreadConfiguration} to the persistent settings.
      *
diff --git a/thread/tests/unit/Android.bp b/thread/tests/unit/Android.bp
index 53b1eca63b..bc4afae15a 100644
--- a/thread/tests/unit/Android.bp
+++ b/thread/tests/unit/Android.bp
@@ -21,6 +21,7 @@ package {
 
 android_test {
     name: "ThreadNetworkUnitTests",
+    defaults: ["modules-utils-testable-device-config-defaults"],
     min_sdk_version: "33",
     sdk_version: "module_current",
     manifest: "AndroidManifest.xml",
diff --git a/thread/tests/unit/src/com/android/server/thread/ThreadNetworkControllerServiceTest.java b/thread/tests/unit/src/com/android/server/thread/ThreadNetworkControllerServiceTest.java
index a73390c670..000e0a77ea 100644
--- a/thread/tests/unit/src/com/android/server/thread/ThreadNetworkControllerServiceTest.java
+++ b/thread/tests/unit/src/com/android/server/thread/ThreadNetworkControllerServiceTest.java
@@ -17,8 +17,6 @@
 package com.android.server.thread;
 
 import static android.Manifest.permission.NETWORK_SETTINGS;
-import static android.Manifest.permission.WRITE_ALLOWLISTED_DEVICE_CONFIG;
-import static android.Manifest.permission.WRITE_DEVICE_CONFIG;
 import static android.net.NetworkCapabilities.NET_CAPABILITY_INTERNET;
 import static android.net.NetworkCapabilities.NET_CAPABILITY_NOT_VPN;
 import static android.net.NetworkCapabilities.TRANSPORT_ETHERNET;
@@ -38,7 +36,6 @@ import static com.android.server.thread.ThreadNetworkControllerService.getMeshco
 import static com.android.server.thread.ThreadNetworkCountryCode.DEFAULT_COUNTRY_CODE;
 import static com.android.server.thread.ThreadPersistentSettings.KEY_THREAD_ENABLED;
 import static com.android.server.thread.openthread.IOtDaemon.ErrorCode.OT_ERROR_INVALID_STATE;
-import static com.android.testutils.TestPermissionUtil.runAsShell;
 
 import static com.google.common.io.BaseEncoding.base16;
 import static com.google.common.truth.Truth.assertThat;
@@ -86,7 +83,6 @@ import android.os.Handler;
 import android.os.IBinder;
 import android.os.ParcelFileDescriptor;
 import android.os.RemoteException;
-import android.os.SystemClock;
 import android.os.UserManager;
 import android.os.test.TestLooper;
 import android.provider.DeviceConfig;
@@ -97,7 +93,7 @@ import androidx.test.core.app.ApplicationProvider;
 import androidx.test.filters.SmallTest;
 
 import com.android.connectivity.resources.R;
-import com.android.dx.mockito.inline.extended.ExtendedMockito;
+import com.android.modules.utils.testing.TestableDeviceConfig;
 import com.android.net.module.util.RoutingCoordinatorManager;
 import com.android.server.connectivity.ConnectivityResources;
 import com.android.server.connectivity.MockableSystemProperties;
@@ -106,7 +102,6 @@ import com.android.server.thread.openthread.IOtStatusReceiver;
 import com.android.server.thread.openthread.MeshcopTxtAttributes;
 import com.android.server.thread.openthread.testing.FakeOtDaemon;
 
-import org.junit.After;
 import org.junit.Before;
 import org.junit.Rule;
 import org.junit.Test;
@@ -119,12 +114,10 @@ import org.mockito.InOrder;
 import org.mockito.Mock;
 import org.mockito.Mockito;
 import org.mockito.MockitoAnnotations;
-import org.mockito.MockitoSession;
 
 import java.time.Clock;
 import java.time.DateTimeException;
 import java.time.Instant;
-import java.time.ZoneId;
 import java.util.Arrays;
 import java.util.Collection;
 import java.util.List;
@@ -180,6 +173,8 @@ public final class ThreadNetworkControllerServiceTest {
     private static final String TEST_MODEL_NAME = "test model";
     private static final LinkAddress TEST_NAT64_CIDR = new LinkAddress("192.168.255.0/24");
 
+    @Mock private ClockSource mMockClockSource;
+    @Mock private Clock mMockNetworkTimeClock;
     @Mock private MockableSystemProperties mMockSystemProperties;
     @Mock private ConnectivityManager mMockConnectivityManager;
     @Mock private RoutingCoordinatorManager mMockRoutingCoordinatorManager;
@@ -202,7 +197,11 @@ public final class ThreadNetworkControllerServiceTest {
     @Captor private ArgumentCaptor<ActiveOperationalDataset> mActiveDatasetCaptor;
 
     @Rule(order = 1)
-    public final TemporaryFolder tempFolder = new TemporaryFolder();
+    public final TemporaryFolder mTempFolder = new TemporaryFolder();
+
+    @Rule(order = 2)
+    public final TestableDeviceConfig.TestableDeviceConfigRule mDeviceConfig =
+            new TestableDeviceConfig.TestableDeviceConfigRule();
 
     private final boolean mIsBorderRouterEnabled;
 
@@ -263,14 +262,18 @@ public final class ThreadNetworkControllerServiceTest {
                 .thenReturn(new String[] {});
         when(mResources.getBoolean(eq(R.bool.config_thread_country_code_enabled))).thenReturn(true);
 
-        final AtomicFile storageFile = new AtomicFile(tempFolder.newFile("thread_settings.xml"));
+        final AtomicFile storageFile = new AtomicFile(mTempFolder.newFile("thread_settings.xml"));
         mPersistentSettings = new ThreadPersistentSettings(storageFile, mConnectivityResources);
         mPersistentSettings.initialize();
 
+        when(mMockClockSource.currentNetworkTimeClock()).thenReturn(mMockNetworkTimeClock);
+        when(mMockNetworkTimeClock.instant()).thenReturn(Instant.ofEpochMilli(0));
+
         mService =
                 new ThreadNetworkControllerService(
                         mContext,
                         handler,
+                        mMockClockSource,
                         mMockSystemProperties,
                         networkProvider,
                         () -> mFakeOtDaemon,
@@ -287,14 +290,6 @@ public final class ThreadNetworkControllerServiceTest {
         mService.setTestNetworkAgent(mMockNetworkAgent);
     }
 
-    @After
-    public void tearDown() throws Exception {
-        runAsShell(
-                WRITE_DEVICE_CONFIG,
-                WRITE_ALLOWLISTED_DEVICE_CONFIG,
-                () -> DeviceConfig.deleteProperty("thread_network", "TrelFeature__enabled"));
-    }
-
     @Test
     public void initialize_tunInterfaceAndNsdPublisherSetToOtDaemon() throws Exception {
         when(mMockTunIfController.getTunFd()).thenReturn(mMockTunFd);
@@ -382,12 +377,7 @@ public final class ThreadNetworkControllerServiceTest {
 
     @Test
     public void initialize_trelFeatureDisabled_trelDisabledAtOtDaemon() throws Exception {
-        runAsShell(
-                WRITE_DEVICE_CONFIG,
-                WRITE_ALLOWLISTED_DEVICE_CONFIG,
-                () ->
-                        DeviceConfig.setProperty(
-                                "thread_network", "TrelFeature__enabled", "false", false));
+        DeviceConfig.setProperty("thread_network", "TrelFeature__enabled", "false", false);
 
         mService.initialize();
         mTestLooper.dispatchAll();
@@ -397,12 +387,8 @@ public final class ThreadNetworkControllerServiceTest {
 
     @Test
     public void initialize_trelFeatureEnabled_setTrelEnabledAtOtDamon() throws Exception {
-        runAsShell(
-                WRITE_DEVICE_CONFIG,
-                WRITE_ALLOWLISTED_DEVICE_CONFIG,
-                () ->
-                        DeviceConfig.setProperty(
-                                "thread_network", "TrelFeature__enabled", "true", false));
+        DeviceConfig.setProperty("thread_network", "TrelFeature__enabled", "true", false);
+
         mService.initialize();
         mTestLooper.dispatchAll();
 
@@ -620,7 +606,7 @@ public final class ThreadNetworkControllerServiceTest {
         mTestLooper.dispatchAll();
 
         assertThat(mFakeOtDaemon.getEnabledState()).isEqualTo(STATE_DISABLED);
-        assertThat(mPersistentSettings.get(KEY_THREAD_ENABLED)).isTrue();
+        assertThat(mPersistentSettings.containsKey(KEY_THREAD_ENABLED)).isFalse();
     }
 
     @Test
@@ -652,6 +638,73 @@ public final class ThreadNetworkControllerServiceTest {
         assertThat(failure.getErrorCode()).isEqualTo(ERROR_FAILED_PRECONDITION);
     }
 
+    @Test
+    public void deviceConfig_initWithThreadDefaultDisabled_otDaemonNotStarted() {
+        DeviceConfig.setProperty(
+                "thread_network", "ThreadEnablementFeature__default_enabled", "false", false);
+
+        mService.initialize();
+        mTestLooper.dispatchAll();
+
+        assertThat(mFakeOtDaemon.isInitialized()).isFalse();
+    }
+
+    @Test
+    public void deviceConfig_initWithThreadDefaultEnabled_threadIsEnabled() {
+        DeviceConfig.setProperty(
+                "thread_network", "ThreadEnablementFeature__default_enabled", "true", false);
+
+        mService.initialize();
+        mTestLooper.dispatchAll();
+
+        assertThat(mFakeOtDaemon.getEnabledState()).isEqualTo(STATE_ENABLED);
+    }
+
+    @Test
+    public void deviceConfig_threadDefaultEnabledBecomesTrue_stateIsEnabledButNotPersisted() {
+        DeviceConfig.setProperty(
+                "thread_network", "ThreadEnablementFeature__default_enabled", "false", false);
+        mService.initialize();
+        mTestLooper.dispatchAll();
+
+        DeviceConfig.setProperty(
+                "thread_network", "ThreadEnablementFeature__default_enabled", "true", true);
+        mTestLooper.dispatchAll();
+
+        assertThat(mFakeOtDaemon.getEnabledState()).isEqualTo(STATE_ENABLED);
+        assertThat(mPersistentSettings.containsKey(KEY_THREAD_ENABLED)).isFalse();
+    }
+
+    @Test
+    public void deviceConfig_threadThreadEnabledBecomesFalse_stateIsDisabledButNotPersisted() {
+        DeviceConfig.setProperty(
+                "thread_network", "ThreadEnablementFeature__default_enabled", "true", false);
+        mService.initialize();
+        mTestLooper.dispatchAll();
+
+        DeviceConfig.setProperty(
+                "thread_network", "ThreadEnablementFeature__default_enabled", "false", false);
+        mTestLooper.dispatchAll();
+
+        assertThat(mFakeOtDaemon.getEnabledState()).isEqualTo(STATE_DISABLED);
+        assertThat(mPersistentSettings.containsKey(KEY_THREAD_ENABLED)).isFalse();
+    }
+
+    @Test
+    public void deviceConfig_threadDefaultDisabledButUserSetEnabled_stateIsEnabledAndPersisted() {
+        DeviceConfig.setProperty(
+                "thread_network", "ThreadEnablementFeature__default_enabled", "false", false);
+        mService.initialize();
+        mTestLooper.dispatchAll();
+
+        mService.setEnabled(true, newOperationReceiver(new CompletableFuture<Void>()));
+        mTestLooper.dispatchAll();
+
+        assertThat(mFakeOtDaemon.getEnabledState()).isEqualTo(STATE_ENABLED);
+        assertThat(mPersistentSettings.containsKey(KEY_THREAD_ENABLED)).isTrue();
+        assertThat(mPersistentSettings.getBoolean(KEY_THREAD_ENABLED, false)).isTrue();
+    }
+
     private AtomicReference<BroadcastReceiver> captureBroadcastReceiver(String action) {
         AtomicReference<BroadcastReceiver> receiverRef = new AtomicReference<>();
 
@@ -688,19 +741,12 @@ public final class ThreadNetworkControllerServiceTest {
     public void
             createRandomizedDataset_noNetworkTimeClock_datasetActiveTimestampIsNotAuthoritative()
                     throws Exception {
-        MockitoSession session =
-                ExtendedMockito.mockitoSession().mockStatic(SystemClock.class).startMocking();
-        final IActiveOperationalDatasetReceiver mockReceiver =
-                ExtendedMockito.mock(IActiveOperationalDatasetReceiver.class);
+        var mockReceiver = mock(IActiveOperationalDatasetReceiver.class);
 
-        try {
-            ExtendedMockito.when(SystemClock.currentNetworkTimeClock())
-                    .thenThrow(new DateTimeException("fake throw"));
-            mService.createRandomizedDataset(DEFAULT_NETWORK_NAME, mockReceiver);
-            mTestLooper.dispatchAll();
-        } finally {
-            session.finishMocking();
-        }
+        when(mMockClockSource.currentNetworkTimeClock())
+                .thenThrow(new DateTimeException("fake throw"));
+        mService.createRandomizedDataset(DEFAULT_NETWORK_NAME, mockReceiver);
+        mTestLooper.dispatchAll();
 
         verify(mockReceiver, never()).onError(anyInt(), anyString());
         verify(mockReceiver, times(1)).onSuccess(mActiveDatasetCaptor.capture());
@@ -710,20 +756,11 @@ public final class ThreadNetworkControllerServiceTest {
 
     @Test
     public void createRandomizedDataset_zeroNanoseconds_returnsZeroTicks() throws Exception {
-        Instant now = Instant.ofEpochSecond(0, 0);
-        Clock clock = Clock.fixed(now, ZoneId.systemDefault());
-        MockitoSession session =
-                ExtendedMockito.mockitoSession().mockStatic(SystemClock.class).startMocking();
-        final IActiveOperationalDatasetReceiver mockReceiver =
-                ExtendedMockito.mock(IActiveOperationalDatasetReceiver.class);
+        when(mMockNetworkTimeClock.instant()).thenReturn(Instant.ofEpochSecond(0, 0));
+        var mockReceiver = mock(IActiveOperationalDatasetReceiver.class);
 
-        try {
-            ExtendedMockito.when(SystemClock.currentNetworkTimeClock()).thenReturn(clock);
-            mService.createRandomizedDataset(DEFAULT_NETWORK_NAME, mockReceiver);
-            mTestLooper.dispatchAll();
-        } finally {
-            session.finishMocking();
-        }
+        mService.createRandomizedDataset(DEFAULT_NETWORK_NAME, mockReceiver);
+        mTestLooper.dispatchAll();
 
         verify(mockReceiver, never()).onError(anyInt(), anyString());
         verify(mockReceiver, times(1)).onSuccess(mActiveDatasetCaptor.capture());
@@ -736,20 +773,13 @@ public final class ThreadNetworkControllerServiceTest {
         // The nanoseconds to ticks conversion is rounded in the current implementation.
         // 32767.5 / 32768 * 1000000000 = 999984741.2109375, using 999984741 to
         // produce the maximum ticks.
-        Instant now = Instant.ofEpochSecond(0, 999984741);
-        Clock clock = Clock.fixed(now, ZoneId.systemDefault());
-        MockitoSession session =
-                ExtendedMockito.mockitoSession().mockStatic(SystemClock.class).startMocking();
-        final IActiveOperationalDatasetReceiver mockReceiver =
-                ExtendedMockito.mock(IActiveOperationalDatasetReceiver.class);
+        Instant maxNanos = Instant.ofEpochSecond(0, 999984741);
+        when(mMockNetworkTimeClock.instant()).thenReturn(maxNanos);
 
-        try {
-            ExtendedMockito.when(SystemClock.currentNetworkTimeClock()).thenReturn(clock);
-            mService.createRandomizedDataset(DEFAULT_NETWORK_NAME, mockReceiver);
-            mTestLooper.dispatchAll();
-        } finally {
-            session.finishMocking();
-        }
+        var mockReceiver = mock(IActiveOperationalDatasetReceiver.class);
+
+        mService.createRandomizedDataset(DEFAULT_NETWORK_NAME, mockReceiver);
+        mTestLooper.dispatchAll();
 
         verify(mockReceiver, never()).onError(anyInt(), anyString());
         verify(mockReceiver, times(1)).onSuccess(mActiveDatasetCaptor.capture());
@@ -760,19 +790,11 @@ public final class ThreadNetworkControllerServiceTest {
     @Test
     public void createRandomizedDataset_hasNetworkTimeClock_datasetActiveTimestampIsAuthoritative()
             throws Exception {
-        MockitoSession session =
-                ExtendedMockito.mockitoSession().mockStatic(SystemClock.class).startMocking();
-        final IActiveOperationalDatasetReceiver mockReceiver =
-                ExtendedMockito.mock(IActiveOperationalDatasetReceiver.class);
+        when(mMockClockSource.currentNetworkTimeClock()).thenReturn(mMockNetworkTimeClock);
+        var mockReceiver = mock(IActiveOperationalDatasetReceiver.class);
 
-        try {
-            ExtendedMockito.when(SystemClock.currentNetworkTimeClock())
-                    .thenReturn(Clock.systemUTC());
-            mService.createRandomizedDataset(DEFAULT_NETWORK_NAME, mockReceiver);
-            mTestLooper.dispatchAll();
-        } finally {
-            session.finishMocking();
-        }
+        mService.createRandomizedDataset(DEFAULT_NETWORK_NAME, mockReceiver);
+        mTestLooper.dispatchAll();
 
         verify(mockReceiver, never()).onError(anyInt(), anyString());
         verify(mockReceiver, times(1)).onSuccess(mActiveDatasetCaptor.capture());
@@ -804,8 +826,7 @@ public final class ThreadNetworkControllerServiceTest {
     @Test
     public void createRandomizedDataset_otDaemonRemoteFailure_returnsPreconditionError()
             throws Exception {
-        final IActiveOperationalDatasetReceiver mockReceiver =
-                mock(IActiveOperationalDatasetReceiver.class);
+        var mockReceiver = mock(IActiveOperationalDatasetReceiver.class);
         mFakeOtDaemon.setChannelMasksReceiverOtError(OT_ERROR_INVALID_STATE);
         when(mockReceiver.asBinder()).thenReturn(mIBinder);
 
@@ -993,6 +1014,17 @@ public final class ThreadNetworkControllerServiceTest {
         assertThat(upstreamNetworkRequest.hasCapability(NET_CAPABILITY_INTERNET)).isTrue();
     }
 
+    @Test
+    public void initialize_ThreadDisabledInResources_disabledButNotPersisted() throws Exception {
+        when(mResources.getBoolean(eq(R.bool.config_thread_default_enabled))).thenReturn(false);
+
+        mService.initialize();
+        mTestLooper.dispatchAll();
+
+        assertThat(mFakeOtDaemon.getEnabledState()).isEqualTo(STATE_DISABLED);
+        assertThat(mPersistentSettings.containsKey(KEY_THREAD_ENABLED)).isFalse();
+    }
+
     @Test
     public void setTestNetworkAsUpstream_upstreamNetworkRequestAlwaysDisallowsVpn() {
         mService.initialize();
diff --git a/thread/tests/unit/src/com/android/server/thread/ThreadPersistentSettingsTest.java b/thread/tests/unit/src/com/android/server/thread/ThreadPersistentSettingsTest.java
index 15f3d0b146..e1f6015429 100644
--- a/thread/tests/unit/src/com/android/server/thread/ThreadPersistentSettingsTest.java
+++ b/thread/tests/unit/src/com/android/server/thread/ThreadPersistentSettingsTest.java
@@ -21,6 +21,7 @@ import static com.android.server.thread.ThreadPersistentSettings.KEY_THREAD_ENAB
 
 import static com.google.common.truth.Truth.assertThat;
 
+import static org.junit.Assert.assertThrows;
 import static org.mockito.Mockito.eq;
 import static org.mockito.Mockito.validateMockitoUsage;
 import static org.mockito.Mockito.when;
@@ -83,64 +84,46 @@ public class ThreadPersistentSettingsTest {
     }
 
     @Test
-    public void initialize_readsFromFile() throws Exception {
-        byte[] data = createXmlForParsing(KEY_THREAD_ENABLED, false);
+    public void initialize_threadEnabledInFile_enabledValueIsUsed() throws Exception {
+        byte[] data = createXmlForParsing(KEY_THREAD_ENABLED, true);
         setupAtomicFileForRead(data);
 
         mThreadPersistentSettings.initialize();
 
-        assertThat(mThreadPersistentSettings.get(KEY_THREAD_ENABLED)).isFalse();
+        assertThat(mThreadPersistentSettings.getBoolean(KEY_THREAD_ENABLED, false)).isTrue();
     }
 
     @Test
-    public void initialize_ThreadDisabledInResources_returnsThreadDisabled() throws Exception {
-        when(mResources.getBoolean(eq(R.bool.config_thread_default_enabled))).thenReturn(false);
-        mThreadPersistentSettings =
-                new ThreadPersistentSettings(mAtomicFile, mConnectivityResources);
-
+    public void getBoolean_threadEnabledNotSet_defaultValueIsUsed() {
         mThreadPersistentSettings.initialize();
 
-        assertThat(mThreadPersistentSettings.get(KEY_THREAD_ENABLED)).isFalse();
+        assertThat(mThreadPersistentSettings.getBoolean(KEY_THREAD_ENABLED, true)).isTrue();
+        assertThat(mThreadPersistentSettings.getBoolean(KEY_THREAD_ENABLED, false)).isFalse();
     }
 
     @Test
-    public void initialize_ThreadEnabledInResources_returnsThreadEnabled() throws Exception {
-        when(mResources.getBoolean(eq(R.bool.config_thread_default_enabled))).thenReturn(true);
-        mThreadPersistentSettings =
-                new ThreadPersistentSettings(mAtomicFile, mConnectivityResources);
-
+    public void get_getThreadEnabled_throwsIllegalStateException() {
         mThreadPersistentSettings.initialize();
 
-        assertThat(mThreadPersistentSettings.get(KEY_THREAD_ENABLED)).isTrue();
-    }
-
-    @Test
-    public void initialize_ThreadDisabledInResourcesButEnabledInXml_returnsThreadEnabled()
-            throws Exception {
-        when(mResources.getBoolean(eq(R.bool.config_thread_default_enabled))).thenReturn(false);
-        setupAtomicFileForRead(createXmlForParsing(KEY_THREAD_ENABLED, true));
-        mThreadPersistentSettings =
-                new ThreadPersistentSettings(mAtomicFile, mConnectivityResources);
-
-        mThreadPersistentSettings.initialize();
-
-        assertThat(mThreadPersistentSettings.get(KEY_THREAD_ENABLED)).isTrue();
+        assertThrows(
+                IllegalStateException.class,
+                () -> mThreadPersistentSettings.get(KEY_THREAD_ENABLED));
     }
 
     @Test
     public void put_ThreadFeatureEnabledTrue_returnsTrue() throws Exception {
         mThreadPersistentSettings.put(KEY_THREAD_ENABLED, true);
 
-        assertThat(mThreadPersistentSettings.get(KEY_THREAD_ENABLED)).isTrue();
+        assertThat(mThreadPersistentSettings.getBoolean(KEY_THREAD_ENABLED, false)).isTrue();
     }
 
     @Test
     public void put_ThreadFeatureEnabledFalse_returnsFalse() throws Exception {
         mThreadPersistentSettings.put(KEY_THREAD_ENABLED, false);
 
-        assertThat(mThreadPersistentSettings.get(KEY_THREAD_ENABLED)).isFalse();
+        assertThat(mThreadPersistentSettings.getBoolean(KEY_THREAD_ENABLED, true)).isFalse();
         mThreadPersistentSettings.initialize();
-        assertThat(mThreadPersistentSettings.get(KEY_THREAD_ENABLED)).isFalse();
+        assertThat(mThreadPersistentSettings.getBoolean(KEY_THREAD_ENABLED, true)).isFalse();
     }
 
     @Test

From 4a45dcfb42c56a452593eaecb5cb3162a812248b Mon Sep 17 00:00:00 2001
From: "Liana Kazanova (xWF)" <lkazanova@google.com>
Date: Wed, 9 Apr 2025 09:57:36 -0700
Subject: [PATCH 098/377] Revert "bpf: Filter localhost packages if
 sent/received by sdksandbox process"

This reverts commit fa1a969fe928a2662aa50dab5601a64ebed52b6f.

Reason for revert: DroidMonitor: Reverting due to http://b/409466372 - verifying through ABTD before revert submission. This is part of the standard investigation process, and does not mean your CL will be reverted.

Change-Id: I0f3b6c0b304a2abded39155f2de8f60c34713a3a
---
 bpf/progs/netd.c | 31 +++++++++++++------------------
 bpf/progs/netd.h | 14 --------------
 2 files changed, 13 insertions(+), 32 deletions(-)

diff --git a/bpf/progs/netd.c b/bpf/progs/netd.c
index 7525f20e92..60c5a1c2ea 100644
--- a/bpf/progs/netd.c
+++ b/bpf/progs/netd.c
@@ -433,20 +433,6 @@ static __always_inline inline BpfConfig getConfig(uint32_t configKey) {
     return *config;
 }
 
-static __always_inline inline uint8_t get_uid_permissions(uint32_t uid) {
-    /*
-     * A given app is guaranteed to have the same app ID in all the profiles in
-     * which it is installed, and install permission is granted to an app for all
-     * users at install time so we only check the appId part of a request uid at
-     * run time. See UserHandle#isSameApp for detail.
-     */
-    uint32_t appId = uid % AID_USER_OFFSET; // == PER_USER_RANGE == 100000
-
-    uint8_t *permissions = bpf_uid_permission_map_lookup_elem(&appId);
-    // if UID not in map, then default to just INTERNET permission.
-    return permissions ? *permissions : BPF_PERMISSION_INTERNET;
-}
-
 static __always_inline inline bool ingress_should_discard(struct __sk_buff* skb,
                                                           const struct kver_uint kver) {
     // Require 4.19, since earlier kernels don't have bpf_skb_load_bytes_relative() which
@@ -510,9 +496,8 @@ static __always_inline inline int bpf_owner_match(struct __sk_buff* skb, uint32_
         }
     }
 
-    if (SDK_LEVEL_IS_AT_LEAST(lvl, 25Q2) && skb->ifindex == 1 && is_sdksandbox_uid(uid)) {
-        // check if the UID is allowed localhost connections
-        if (!(get_uid_permissions(uid) & BPF_PERMISSION_SDKSANDBOX_LOCALHOST)) return DROP;
+    if (SDK_LEVEL_IS_AT_LEAST(lvl, 25Q2) && skb->ifindex == 1) {
+        // TODO: sdksandbox localhost restrictions
     }
 
     return PASS;
@@ -774,7 +759,17 @@ DEFINE_XTBPF_PROG("skfilter/denylist/xtbpf", xt_bpf_denylist_prog)
 }
 
 static __always_inline inline uint8_t get_app_permissions() {
-    return get_uid_permissions(bpf_get_current_uid_gid() & 0xffffffff);
+    uint64_t gid_uid = bpf_get_current_uid_gid();
+    /*
+     * A given app is guaranteed to have the same app ID in all the profiles in
+     * which it is installed, and install permission is granted to app for all
+     * user at install time so we only check the appId part of a request uid at
+     * run time. See UserHandle#isSameApp for detail.
+     */
+    uint32_t appId = (gid_uid & 0xffffffff) % AID_USER_OFFSET;  // == PER_USER_RANGE == 100000
+    uint8_t* permissions = bpf_uid_permission_map_lookup_elem(&appId);
+    // if UID not in map, then default to just INTERNET permission.
+    return permissions ? *permissions : BPF_PERMISSION_INTERNET;
 }
 
 static __always_inline inline int inet_socket_create(struct bpf_sock* sk,
diff --git a/bpf/progs/netd.h b/bpf/progs/netd.h
index 9d80c69e03..aa5f9cc9bf 100644
--- a/bpf/progs/netd.h
+++ b/bpf/progs/netd.h
@@ -215,16 +215,10 @@ enum UidOwnerMatchType : uint32_t {
 };
 // LINT.ThenChange(../framework/src/android/net/BpfNetMapsConstants.java)
 
-// LINT.IfChange(bpf_permission)
-// The BpfPermissionMatch values should match the traffic permissions defined in NetworkPermissions:
-// BPF_PERMISSION_<X> should have the same value that TRAFFIC_PERMISSION_<X>
 enum BpfPermissionMatch : uint8_t {
     BPF_PERMISSION_INTERNET = 1 << 2,
     BPF_PERMISSION_UPDATE_DEVICE_STATS = 1 << 3,
-    BPF_PERMISSION_SDKSANDBOX_LOCALHOST = 1 << 4,
 };
-// LINT.ThenChange(packages/modules/Connectivity/service/src/com/android/server/connectivity/NetworkPermissions.java)
-
 // In production we use two identical stats maps to record per uid stats and
 // do swap and clean based on the configuration specified here. The statsMapType
 // value in configuration map specified which map is currently in use.
@@ -299,11 +293,3 @@ static inline bool is_system_uid(uint32_t uid) {
     // MAX_SYSTEM_UID is AID_NOBODY == 9999, while AID_APP_START == 10000
     return ((uid % AID_USER_OFFSET) < AID_APP_START);
 }
-
-static inline bool is_sdksandbox_uid(uint32_t uid) {
-    uint32_t appid = uid % AID_USER_OFFSET;
-    // AID_SDK_SANDBOX_PROCESS_START = 20000
-    // AID_SDK_SANDBOX_PROCESS_END = 29999
-    return appid >= AID_SDK_SANDBOX_PROCESS_START &&
-           appid <= AID_SDK_SANDBOX_PROCESS_END;
-}

From 6ee60756851d80fb60df81a51af6f2c5ee8519dd Mon Sep 17 00:00:00 2001
From: Remi NGUYEN VAN <reminv@google.com>
Date: Wed, 9 Apr 2025 15:08:07 +0900
Subject: [PATCH 099/377] Print module version in CtsNetTestCases conndiag

Bundle the version of the tethering APEX in the build branch into
CtsNetTestCases as a resource, and include it in the failure header on
test failure.

This should make it easy to identify what version of the module matches
the built test when investigating test failures.

Test: atest
Flag: TEST_ONLY
Change-Id: I15a53b3d7649ebde9706b10ee504d08aa78ee7de
---
 Tethering/apex/Android.bp                     | 18 ++++++++
 .../ConnectivityDiagnosticsCollector.kt       |  2 +
 .../com/android/testutils/VersionUtil.kt      | 44 +++++++++++++++++++
 tests/cts/net/Android.bp                      |  1 +
 4 files changed, 65 insertions(+)
 create mode 100644 staticlibs/testutils/devicetests/com/android/testutils/VersionUtil.kt

diff --git a/Tethering/apex/Android.bp b/Tethering/apex/Android.bp
index 531489ddb6..5bdf98d3a1 100644
--- a/Tethering/apex/Android.bp
+++ b/Tethering/apex/Android.bp
@@ -218,3 +218,21 @@ systemserverclasspath_fragment {
     standalone_contents: ["service-connectivity"],
     apex_available: ["com.android.tethering"],
 }
+
+// Extract the version number of the module from the manifest.json, and zip it as a raw resource for
+// usage in android_test "resource_zips" build rules.
+// The manifest.json is updated with new module versions in release branches when versions are cut.
+java_genrule {
+    name: "connectivity-module-version-as-resource-zip",
+    srcs: [
+        "manifest.json",
+    ],
+    out: ["connectivity-module-version-as-resource.zip"],
+    tools: ["soong_zip"],
+
+    cmd: "mkdir -p $(genDir)/res/raw && " +
+        // The manifest has a line with '"version": 361099999'. Grep for the line, then for the int.
+        "grep -Eo '\"version\": *[0-9]+' $(in) | grep -Eo '[0-9]+' > " +
+        "$(genDir)/res/raw/target_module_version && " +
+        "$(location soong_zip) -o $(out) -C $(genDir)/res -D $(genDir)/res",
+}
diff --git a/staticlibs/testutils/devicetests/com/android/testutils/ConnectivityDiagnosticsCollector.kt b/staticlibs/testutils/devicetests/com/android/testutils/ConnectivityDiagnosticsCollector.kt
index 1db57655ad..3c3cdedf88 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/ConnectivityDiagnosticsCollector.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/ConnectivityDiagnosticsCollector.kt
@@ -43,6 +43,7 @@ import android.util.Log
 import androidx.annotation.RequiresApi
 import androidx.test.platform.app.InstrumentationRegistry
 import com.android.modules.utils.build.SdkLevel.isAtLeastS
+import com.android.testutils.com.android.testutils.getTargetModuleVersion
 import java.io.ByteArrayOutputStream
 import java.io.CharArrayWriter
 import java.io.File
@@ -339,6 +340,7 @@ class ConnectivityDiagnosticsCollector : BaseMetricListener() {
             headerObj.put("shellPermissionsUnavailable", true)
         }
         failureHeader = headerObj.apply {
+            put("targetModuleVersion", getTargetModuleVersion())
             put("time", DateTimeFormatter.ISO_OFFSET_DATE_TIME.format(ZonedDateTime.now()))
             put(
                 "wifiEnabled",
diff --git a/staticlibs/testutils/devicetests/com/android/testutils/VersionUtil.kt b/staticlibs/testutils/devicetests/com/android/testutils/VersionUtil.kt
new file mode 100644
index 0000000000..3129c76114
--- /dev/null
+++ b/staticlibs/testutils/devicetests/com/android/testutils/VersionUtil.kt
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+@file:JvmName("VersionUtil")
+
+package com.android.testutils.com.android.testutils
+
+import androidx.test.platform.app.InstrumentationRegistry
+
+/**
+ * Value for [getTargetModuleVersion] that indicates that no manifest is available in the test.
+ */
+const val MODULE_VERSION_NO_MANIFEST = -1
+
+/**
+ * Get the version of the module targeted by the current test.
+ *
+ * <p>This reads the value of the target_module_version resource from the resources of the test
+ * package. That resource must be configured in build rules (via "resources" or "resource_zips") for
+ * the test.
+ */
+fun getTargetModuleVersion(): Int {
+    val ctx = InstrumentationRegistry.getInstrumentation().context
+    val res = ctx.resources
+    val resId = res.getIdentifier("target_module_version", "raw", ctx.packageName)
+    if (resId == 0) {
+        return MODULE_VERSION_NO_MANIFEST
+    }
+    return res.openRawResource(resId).reader().use {
+        it.readText().trim(' ', '\n').toInt()
+    }
+}
diff --git a/tests/cts/net/Android.bp b/tests/cts/net/Android.bp
index 1ba581a8d4..50b131e9bf 100644
--- a/tests/cts/net/Android.bp
+++ b/tests/cts/net/Android.bp
@@ -101,6 +101,7 @@ android_test {
         "mcts-tethering",
         "general-tests",
     ],
+    resource_zips: [":connectivity-module-version-as-resource-zip"],
 }
 
 java_defaults {

From 9af93249bdcabaee793bcb7b69d30a6b7c911bfb Mon Sep 17 00:00:00 2001
From: Sandro Montanari <sandrom@google.com>
Date: Thu, 10 Apr 2025 12:30:05 +0000
Subject: [PATCH 100/377] Remove unused DataStore class

Bug: 407940468
Test: atest NetworkSecurityUnitTests
Flag: com.android.net.ct.flags.certificate_transparency_service
Change-Id: I8338087263c3f61bad061ac7687cd20d51685e67
---
 .../com/android/server/net/ct/DataStore.java  | 116 ------------------
 1 file changed, 116 deletions(-)
 delete mode 100644 networksecurity/service/src/com/android/server/net/ct/DataStore.java

diff --git a/networksecurity/service/src/com/android/server/net/ct/DataStore.java b/networksecurity/service/src/com/android/server/net/ct/DataStore.java
deleted file mode 100644
index bd17199cdb..0000000000
--- a/networksecurity/service/src/com/android/server/net/ct/DataStore.java
+++ /dev/null
@@ -1,116 +0,0 @@
-/*
- * Copyright (C) 2024 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package com.android.server.net.ct;
-
-import android.util.Log;
-
-import java.io.File;
-import java.io.FileInputStream;
-import java.io.FileOutputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.OutputStream;
-import java.util.Optional;
-import java.util.Properties;
-import java.util.Set;
-
-/** Class to persist data needed by CT. */
-class DataStore extends Properties {
-
-    private static final String TAG = "CertificateTransparency";
-
-    private static final long MAX_FILE_SIZE = 20 * 1024; // 20KB
-    private static final int MAX_KEY_SIZE = 50;
-    private final File mPropertyFile;
-
-    DataStore(File file) {
-        super();
-        mPropertyFile = file;
-    }
-
-    void load() {
-        if (!mPropertyFile.exists()) {
-            return;
-        }
-
-        if (!validatePropertyFile()) {
-            Log.e(TAG, "Invalid property file, not load it!");
-            delete();
-            return;
-        }
-
-        try (InputStream in = new FileInputStream(mPropertyFile)) {
-            load(in);
-            if (!validateProperties()) {
-                Log.e(TAG, "Invalid property store, clear it!");
-                delete();
-                return;
-            }
-        } catch (IOException | IllegalArgumentException e) {
-            Log.e(TAG, "Error loading property store", e);
-            delete();
-        }
-    }
-
-    private boolean validateProperties() {
-        Set<String> keys = stringPropertyNames();
-        for (String key : keys) {
-            if (key.length() > MAX_KEY_SIZE) {
-                Log.e(TAG, "Unexpected Property: " + key);
-                return false;
-            }
-        }
-        return true;
-    }
-
-    private boolean validatePropertyFile() {
-        if (mPropertyFile.length() > MAX_FILE_SIZE) {
-            Log.e(TAG, "Property file size exceeds " + MAX_FILE_SIZE + "!");
-            return false;
-        }
-        return true;
-    }
-
-    void store() {
-        try (FileOutputStream out = new FileOutputStream(mPropertyFile)) {
-            store(out, "");
-            out.getFD().sync();
-        } catch (IOException e) {
-            Log.e(TAG, "Error storing property store", e);
-        }
-    }
-
-    boolean delete() {
-        clear();
-        return mPropertyFile.delete();
-    }
-
-    long getPropertyLong(String key, long defaultValue) {
-        return Optional.ofNullable(getProperty(key)).map(Long::parseLong).orElse(defaultValue);
-    }
-
-    Object setPropertyLong(String key, long value) {
-        return setProperty(key, Long.toString(value));
-    }
-
-    int getPropertyInt(String key, int defaultValue) {
-        return Optional.ofNullable(getProperty(key)).map(Integer::parseInt).orElse(defaultValue);
-    }
-
-    Object setPropertyInt(String key, int value) {
-        return setProperty(key, Integer.toString(value));
-    }
-}

From 8995a1fb73cf6cd2c0d54569f241b2f423bd15ef Mon Sep 17 00:00:00 2001
From: Cole Faust <colefaust@google.com>
Date: Fri, 11 Apr 2025 13:58:06 -0700
Subject: [PATCH 101/377] Fix/Suppress issues for errorprone update

When updating errorprone to 2.27.0, it finds new issues that cause the build to fail.

Flag: EXEMPT refactor
Bug: 253827323
Test: RUN_ERROR_PRONE=true m javac-check
Change-Id: I9c70d64e1f1e43be3bc1d9af8413548d10c8d490
---
 .../java/com/android/server/net/NetworkStatsServiceTest.java    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/unit/java/com/android/server/net/NetworkStatsServiceTest.java b/tests/unit/java/com/android/server/net/NetworkStatsServiceTest.java
index 66af56ba56..1ce8ffcce5 100644
--- a/tests/unit/java/com/android/server/net/NetworkStatsServiceTest.java
+++ b/tests/unit/java/com/android/server/net/NetworkStatsServiceTest.java
@@ -604,7 +604,7 @@ public class NetworkStatsServiceTest extends NetworkStatsBaseTest {
 
         @Override
         public boolean isDebuggable() {
-            return mIsDebuggable == Boolean.TRUE;
+            return Objects.equals(mIsDebuggable, Boolean.TRUE);
         }
 
         @Override

From 259c0b4f664c508a4608f41440f1469e0c0a84d4 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Thu, 10 Apr 2025 15:55:30 -0700
Subject: [PATCH 102/377] Move ProcfsParsingUtils to staticlibs

net-utils-device-common says:

This library shouldn't be used anymore (no class should be added), and
per-user libraries like net-utils-service-connectivity or
net-utils-framework-wifi should be used instead.

Therefore, this patch adds a new net-utils-networkstack.

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I8073ea019a9c306ce75424303e8a30bb39580b29
---
 staticlibs/Android.bp                         |  21 ++
 .../net/module/util/ProcfsParsingUtils.java   | 355 ++++++++++++++++++
 2 files changed, 376 insertions(+)
 create mode 100644 staticlibs/device/com/android/net/module/util/ProcfsParsingUtils.java

diff --git a/staticlibs/Android.bp b/staticlibs/Android.bp
index abfc4473d4..484b93d401 100644
--- a/staticlibs/Android.bp
+++ b/staticlibs/Android.bp
@@ -81,6 +81,27 @@ java_library {
     },
 }
 
+// Contains staticlibs classes for use by NetworkStack
+java_library {
+    name: "net-utils-networkstack",
+    srcs: [
+        "device/com/android/net/module/util/ProcfsParsingUtils.java",
+        "framework/com/android/net/module/util/HexDump.java",
+    ],
+    sdk_version: "module_current",
+    min_sdk_version: "30",
+    target_sdk_version: "30",
+    visibility: [
+        "//packages/modules/Connectivity/tests:__subpackages__",
+        "//packages/modules/NetworkStack:__subpackages__",
+    ],
+    libs: [
+        "androidx.annotation_annotation",
+        "framework-annotations-lib",
+        "framework-connectivity.stubs.module_lib",
+    ],
+}
+
 java_library {
     name: "net-utils-dnspacket-common",
     srcs: [
diff --git a/staticlibs/device/com/android/net/module/util/ProcfsParsingUtils.java b/staticlibs/device/com/android/net/module/util/ProcfsParsingUtils.java
new file mode 100644
index 0000000000..44fc94121b
--- /dev/null
+++ b/staticlibs/device/com/android/net/module/util/ProcfsParsingUtils.java
@@ -0,0 +1,355 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.android.net.module.util;
+
+import android.annotation.NonNull;
+import android.net.InetAddresses;
+import android.net.MacAddress;
+import android.util.Log;
+
+import com.android.internal.annotations.VisibleForTesting;
+
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.net.Inet4Address;
+import java.net.Inet6Address;
+import java.net.InetAddress;
+import java.net.UnknownHostException;
+import java.nio.ByteBuffer;
+import java.nio.ByteOrder;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Paths;
+import java.util.ArrayList;
+import java.util.List;
+
+public final class ProcfsParsingUtils {
+    public static final String TAG = ProcfsParsingUtils.class.getSimpleName();
+
+    private static final Inet4Address IPV4_ADDR_ALL_HOST_MULTICAST =
+            (Inet4Address) InetAddresses.parseNumericAddress("224.0.0.1");
+
+    private static final String IPV6_CONF_PATH = "/proc/sys/net/ipv6/conf/";
+    private static final String IPV6_ANYCAST_PATH = "/proc/net/anycast6";
+    private static final String ETHER_MCAST_PATH = "/proc/net/dev_mcast";
+    private static final String IPV4_MCAST_PATH = "/proc/net/igmp";
+    private static final String IPV6_MCAST_PATH = "/proc/net/igmp6";
+    private static final String IPV4_DEFAULT_TTL_PATH = "/proc/sys/net/ipv4/ip_default_ttl";
+
+    private ProcfsParsingUtils() {
+    }
+
+    /**
+     * Reads the contents of a text file line by line.
+     *
+     * @param filePath The absolute path to the file to read.
+     * @return A List of Strings where each String represents a line from the file.
+     *         If an error occurs during reading, an empty list is returned, and an error is logged.
+     */
+    private static List<String> readFile(final String filePath) {
+        final List<String> lines = new ArrayList<>();
+        try (BufferedReader reader =
+                     Files.newBufferedReader(Paths.get(filePath), StandardCharsets.UTF_8)) {
+            String line;
+            while ((line = reader.readLine()) != null) {
+                lines.add(line);
+            }
+        } catch (IOException e) {
+            Log.wtf(TAG, "failed to read " + filePath, e);
+        }
+
+        return lines;
+    }
+
+    /**
+     * Parses the Neighbor Discovery traffic class from a list of strings.
+     *
+     * This function expects a list containing a single string representing the ND traffic class.
+     * If the list is empty or contains multiple lines, it assumes a default traffic class of 0.
+     *
+     * @param lines A list of strings, ideally containing one line with the ND traffic class.
+     * @return The parsed ND traffic class as an integer, or 0 if the input is invalid.
+     */
+    @VisibleForTesting
+    public static int parseNdTrafficClass(final List<String> lines) {
+        if (lines.size() != 1) {
+            return 0;   // default
+        }
+
+        return Integer.parseInt(lines.get(0));
+    }
+
+    /**
+     * Parses the default TTL value from the procfs file lines.
+     */
+    @VisibleForTesting
+    public static int parseDefaultTtl(final List<String> lines) {
+        if (lines.size() != 1) {
+            return 64;  // default ttl value as per rfc1700
+        }
+        try {
+            // ttl must be in the range [1, 255]
+            return Math.max(1, Math.min(255, Integer.parseInt(lines.get(0))));
+        } catch (NumberFormatException e) {
+            Log.e(TAG, "failed to parse default ttl.", e);
+            return 64; // default ttl value as per rfc1700
+        }
+    }
+
+    /**
+     * Parses anycast6 addresses associated with a specific interface from a list of strings.
+     *
+     * This function searches the input list for a line containing the specified interface name.
+     * If found, it extracts the IPv6 address from that line and
+     * converts it into an `Inet6Address` object.
+     *
+     * @param lines   A list of strings where each line is expected to contain
+     *                interface and address information.
+     * @param ifname  The name of the network interface to search for.
+     * @return        A list of The `Inet6Address` representing the anycast address
+     *                associated with the specified interface,
+     *                If an error occurs during parsing, an empty list is returned.
+     */
+    @VisibleForTesting
+    public static List<Inet6Address> parseAnycast6Addresses(
+            @NonNull List<String> lines, @NonNull String ifname) {
+        final List<Inet6Address> addresses = new ArrayList<>();
+        try {
+            for (String line : lines) {
+                final String[] fields = line.split("\\s+");
+                if (!fields[1].equals(ifname)) {
+                    continue;
+                }
+
+                final byte[] addr = HexDump.hexStringToByteArray(fields[2]);
+                addresses.add((Inet6Address) InetAddress.getByAddress(addr));
+            }
+        } catch (UnknownHostException e) {
+            Log.wtf("failed to convert to Inet6Address.", e);
+            addresses.clear();
+        }
+        return addresses;
+    }
+
+    /**
+     * Parses Ethernet multicast MAC addresses with a specific interface from a list of strings.
+     *
+     * @param lines A list of strings, each containing interface and MAC address information.
+     * @param ifname The name of the network interface for which to extract multicast addresses.
+     * @return A list of MacAddress objects representing the parsed multicast addresses.
+     */
+    @VisibleForTesting
+    public static List<MacAddress> parseEtherMulticastAddresses(
+            @NonNull List<String> lines, @NonNull String ifname) {
+        final List<MacAddress> addresses = new ArrayList<>();
+        for (String line: lines) {
+            final String[] fields = line.split("\\s+");
+            if (!fields[1].equals(ifname)) {
+                continue;
+            }
+
+            final byte[] addr = HexDump.hexStringToByteArray(fields[4]);
+            addresses.add(MacAddress.fromBytes(addr));
+        }
+
+        return addresses;
+    }
+
+    /**
+     * Parses IPv6 multicast addresses associated with a specific interface from a list of strings.
+     *
+     * @param lines A list of strings, each containing interface and IPv6 address information.
+     * @param ifname The name of the network interface for which to extract multicast addresses.
+     * @return A list of Inet6Address objects representing the parsed IPv6 multicast addresses.
+     *         If an error occurs during parsing, an empty list is returned.
+     */
+    @VisibleForTesting
+    public static List<Inet6Address> parseIPv6MulticastAddresses(
+            @NonNull List<String> lines, @NonNull String ifname) {
+        final List<Inet6Address> addresses = new ArrayList<>();
+        try {
+            for (String line: lines) {
+                final String[] fields = line.split("\\s+");
+                if (!fields[1].equals(ifname)) {
+                    continue;
+                }
+
+                final byte[] addr = HexDump.hexStringToByteArray(fields[2]);
+                addresses.add((Inet6Address) InetAddress.getByAddress(addr));
+            }
+        } catch (UnknownHostException e) {
+            Log.wtf(TAG, "failed to convert to Inet6Address.", e);
+            addresses.clear();
+        }
+
+        return addresses;
+    }
+
+    /**
+     * Parses IPv4 multicast addresses associated with a specific interface from a list of strings.
+     *
+     * @param lines A list of strings, each containing interface and IPv4 address information.
+     * @param ifname The name of the network interface for which to extract multicast addresses.
+     * @param endian The byte order of the address, almost always use native order.
+     * @return A list of Inet4Address objects representing the parsed IPv4 multicast addresses.
+     *         If an error occurs during parsing,
+     *         a list contains IPv4 all host (224.0.0.1) is returned.
+     */
+    @VisibleForTesting
+    public static List<Inet4Address> parseIPv4MulticastAddresses(
+            @NonNull List<String> lines, @NonNull String ifname, @NonNull ByteOrder endian) {
+        final List<Inet4Address> ipAddresses = new ArrayList<>();
+
+        try {
+            String name = "";
+            // parse output similar to `ip maddr` command (iproute2/ip/ipmaddr.c#read_igmp())
+            for (String line : lines) {
+                final String[] parts = line.trim().split("\\s+");
+                if (!line.startsWith("\t")) {
+                    name = parts[1];
+                    if (name.endsWith(":")) {
+                        name = name.substring(0, name.length() - 1);
+                    }
+                    continue;
+                }
+
+                if (!name.equals(ifname)) {
+                    continue;
+                }
+
+                final String hexIp = parts[0];
+                final byte[] ipArray = HexDump.hexStringToByteArray(hexIp);
+                final byte[] convertArray =
+                    (endian == ByteOrder.LITTLE_ENDIAN)
+                        ? convertIPv4BytesToBigEndian(ipArray) : ipArray;
+                final Inet4Address ipv4Address =
+                        (Inet4Address) InetAddress.getByAddress(convertArray);
+
+                ipAddresses.add(ipv4Address);
+            }
+        } catch (Exception e) {
+            Log.wtf(TAG, "failed to convert to Inet4Address.", e);
+            // always return IPv4 all host address (224.0.0.1) if any error during parsing.
+            // this aligns with kernel behavior, it will join 224.0.0.1 when the interface is up.
+            ipAddresses.clear();
+            ipAddresses.add(IPV4_ADDR_ALL_HOST_MULTICAST);
+        }
+
+        return ipAddresses;
+    }
+
+    /**
+     * Converts an IPv4 address from little-endian byte order to big-endian byte order.
+     *
+     * @param bytes The IPv4 address in little-endian byte order.
+     * @return The IPv4 address in big-endian byte order.
+     */
+    private static byte[] convertIPv4BytesToBigEndian(byte[] bytes) {
+        final ByteBuffer buffer = ByteBuffer.wrap(bytes);
+        buffer.order(ByteOrder.LITTLE_ENDIAN);
+        final ByteBuffer bigEndianBuffer = ByteBuffer.allocate(4);
+        bigEndianBuffer.order(ByteOrder.BIG_ENDIAN);
+        bigEndianBuffer.putInt(buffer.getInt());
+        return bigEndianBuffer.array();
+    }
+
+    /**
+     * Returns the default TTL value for IPv4 packets.
+     */
+    public static int getIpv4DefaultTtl() {
+        return parseDefaultTtl(readFile(IPV4_DEFAULT_TTL_PATH));
+    }
+
+    /**
+     * Returns the default HopLimit value for IPv6 packets.
+     */
+    public static int getIpv6DefaultHopLimit(@NonNull String ifname) {
+        final String hopLimitPath = IPV6_CONF_PATH + ifname + "/hop_limit";
+        return parseDefaultTtl(readFile(hopLimitPath));
+    }
+
+    /**
+     * Returns the traffic class for the specified interface.
+     * The function loads the existing traffic class from the file
+     * `/proc/sys/net/ipv6/conf/{ifname}/ndisc_tclass`. If the file does not exist, the
+     * function returns 0.
+     *
+     * @param ifname The name of the interface.
+     * @return The traffic class for the interface.
+     */
+    public static int getNdTrafficClass(final String ifname) {
+        final String ndTcPath = IPV6_CONF_PATH + ifname + "/ndisc_tclass";
+        final List<String> lines = readFile(ndTcPath);
+        return parseNdTrafficClass(lines);
+    }
+
+    /**
+     * The function loads the existing IPv6 anycast address from the file `/proc/net/anycast6`.
+     * If the file does not exist or the interface is not found, the function
+     * returns an empty list.
+     *
+     * @param ifname The name of the interface.
+     * @return A list of the IPv6 anycast addresses for the interface.
+     */
+    public static List<Inet6Address> getAnycast6Addresses(@NonNull String ifname) {
+        final List<String> lines = readFile(IPV6_ANYCAST_PATH);
+        return parseAnycast6Addresses(lines, ifname);
+    }
+
+    /**
+     * The function loads the existing Ethernet multicast addresses from
+     * the file `/proc/net/dev_mcast`.
+     * If the file does not exist or the interface is not found, the function returns empty list.
+     *
+     * @param ifname The name of the interface.
+     * @return A list of MacAddress objects representing the multicast addresses
+     *         found for the interface.
+     *         If the file cannot be read or there are no addresses, an empty list is returned.
+     */
+    public static List<MacAddress> getEtherMulticastAddresses(@NonNull String ifname) {
+        final List<String> lines = readFile(ETHER_MCAST_PATH);
+        return parseEtherMulticastAddresses(lines, ifname);
+    }
+
+    /**
+     * The function loads the existing IPv6 multicast addresses from the file `/proc/net/igmp6`.
+     * If the file does not exist or the interface is not found, the function returns empty list.
+     *
+     * @param ifname The name of the network interface to query.
+     * @return A list of Inet6Address objects representing the IPv6 multicast addresses
+     *         found for the interface.
+     *         If the file cannot be read or there are no addresses, an empty list is returned.
+     */
+    public static List<Inet6Address> getIpv6MulticastAddresses(@NonNull String ifname) {
+        final List<String> lines = readFile(IPV6_MCAST_PATH);
+        return parseIPv6MulticastAddresses(lines, ifname);
+    }
+
+    /**
+     * The function loads the existing IPv4 multicast addresses from the file `/proc/net/igmp6`.
+     * If the file does not exist or the interface is not found, the function returns empty list.
+     *
+     * @param ifname The name of the network interface to query.
+     * @return A list of Inet4Address objects representing the IPv4 multicast addresses
+     *         found for the interface.
+     *         If the file cannot be read or there are no addresses, an empty list is returned.
+     */
+    public static List<Inet4Address> getIPv4MulticastAddresses(@NonNull String ifname) {
+        final List<String> lines = readFile(IPV4_MCAST_PATH);
+        // follow the same pattern as NetlinkMonitor#handlePacket() for device's endian order
+        return parseIPv4MulticastAddresses(lines, ifname, ByteOrder.nativeOrder());
+    }
+}

From 1586ffbeb14f65b44ac2e32f9bcebbefa70ceae2 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Fri, 11 Apr 2025 15:11:01 -0700
Subject: [PATCH 103/377] Add support for setting hop limit

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I7ee5b0f31b4db633451a0ddee5d92e45e5947f84
---
 .../devicetests/com/android/testutils/PacketBuilderUtils.kt  | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
index 7b210ac288..b0b6f569c7 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
@@ -490,15 +490,16 @@ class UdpPkt(
 class Ip6Pkt(
         private val src: Inet6Address,
         private val dst: Inet6Address,
+        private val hlim: Byte = 255.toByte(),
 ) : PseudoHeaderPacket {
-    constructor(src: String, dst: String) : this(
+    constructor(src: String, dst: String, hlim: Int = 255) : this(
             InetAddress.getByName(src) as Inet6Address,
             InetAddress.getByName(dst) as Inet6Address,
+            hlim.toByte(),
     )
 
     private val tc = 0
     private val flowlabel = 0
-    private val hlim = 255.toByte()
 
     override fun build(payload: FinalizedPacket?, pseudo: PseudoHeaderPacket?): FinalizedPacket {
         require(payload != null)

From 59f53ac46f5ea7f2bbd55e5704685970b149d7a1 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Fri, 11 Apr 2025 15:06:42 -0700
Subject: [PATCH 104/377] Add (very) basic Clat Test

This test brings up a tap interface and starts clat on it by responding
with an RA including a PREF64 option.

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: Idf8e58d56a322185c97495585ecddf2432f1c820
---
 tests/integration/Android.bp                  |   1 +
 tests/integration/src/android/net/ClatTest.kt | 206 ++++++++++++++++++
 2 files changed, 207 insertions(+)
 create mode 100644 tests/integration/src/android/net/ClatTest.kt

diff --git a/tests/integration/Android.bp b/tests/integration/Android.bp
index 6c3b7a0710..b9f67e1181 100644
--- a/tests/integration/Android.bp
+++ b/tests/integration/Android.bp
@@ -51,6 +51,7 @@ android_test {
         "kotlin-reflect",
         "mockito-target-extended-minus-junit4",
         "net-tests-utils",
+        "net-utils-networkstack",
         "service-connectivity-pre-jarjar",
         "service-connectivity-tiramisu-pre-jarjar",
         "services.net",
diff --git a/tests/integration/src/android/net/ClatTest.kt b/tests/integration/src/android/net/ClatTest.kt
new file mode 100644
index 0000000000..fb2fad8c5f
--- /dev/null
+++ b/tests/integration/src/android/net/ClatTest.kt
@@ -0,0 +1,206 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License
+ */
+
+package android.net
+
+import android.Manifest.permission.CHANGE_NETWORK_STATE
+import android.net.NetworkCapabilities.NET_CAPABILITY_INTERNET
+import android.net.NetworkCapabilities.NET_CAPABILITY_TRUSTED
+import android.net.NetworkCapabilities.TRANSPORT_ETHERNET
+import android.net.NetworkCapabilities.TRANSPORT_TEST
+import android.net.TestNetworkManager.TestInterfaceRequest
+import android.os.Build
+import android.os.Handler
+import android.os.HandlerThread
+import android.platform.test.annotations.AppModeFull
+import android.system.Os
+import android.system.OsConstants.AF_INET
+import android.system.OsConstants.IPPROTO_UDP
+import android.system.OsConstants.SOCK_DGRAM
+import androidx.test.platform.app.InstrumentationRegistry
+import com.android.net.module.util.ProcfsParsingUtils
+import com.android.testutils.AutoCloseTestInterfaceRule
+import com.android.testutils.DataPkt
+import com.android.testutils.DevSdkIgnoreRule
+import com.android.testutils.DevSdkIgnoreRunner
+import com.android.testutils.EtherPkt
+import com.android.testutils.EthernetTestInterface
+import com.android.testutils.Ip6Pkt
+import com.android.testutils.NdResponder
+import com.android.testutils.RaPkt
+import com.android.testutils.RecorderCallback.CallbackEntry.LinkPropertiesChanged
+import com.android.testutils.TestableNetworkCallback
+import com.android.testutils.UdpPkt
+import com.android.testutils.runAsShell
+import com.google.common.truth.Truth.assertThat
+import java.io.FileDescriptor
+import java.net.Inet4Address
+import java.net.Inet6Address
+import java.net.InetAddress
+import java.net.InetSocketAddress
+import java.nio.ByteBuffer
+import kotlin.test.fail
+import org.junit.After
+import org.junit.Before
+import org.junit.Rule
+import org.junit.Test
+import org.junit.runner.RunWith
+
+private const val TAG = "ClatTest"
+private const val TIMEOUT_MS = 2000L
+
+private val REQUEST: NetworkRequest = NetworkRequest.Builder()
+        .addTransportType(TRANSPORT_ETHERNET)
+        .addTransportType(TRANSPORT_TEST)
+        .removeCapability(NET_CAPABILITY_INTERNET)
+        .removeCapability(NET_CAPABILITY_TRUSTED)
+        .build()
+private val ROUTER_MAC = MacAddress.fromString("01:02:03:04:05:06")
+private val ROUTER_V6 = InetAddress.getByName("fe80::0102:03ff:fe04:0506") as Inet6Address
+
+// For ByteArray.toHexString
+@kotlin.ExperimentalStdlibApi
+@AppModeFull(reason = "Instant apps can't access EthernetManager")
+@RunWith(DevSdkIgnoreRunner::class)
+@DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.S_V2)
+class ClatTest {
+    private val context = InstrumentationRegistry.getInstrumentation().context
+    private val cm = context.getSystemService(ConnectivityManager::class.java)!!
+    private val handlerThread = HandlerThread("$TAG thread").apply { start() }
+    private val handler = Handler(handlerThread.looper)
+    private val registeredCallbacks = ArrayList<TestableNetworkCallback>()
+
+    // Cannot be initialized before setUp as eventuallyExpect<LinkPropertiesChanged>() can fail.
+    private lateinit var lp: LinkProperties
+    private lateinit var network: Network
+    private var socket: FileDescriptor? = null
+
+    @get:Rule
+    val testInterfaceRule = AutoCloseTestInterfaceRule(context)
+
+    private val iface: EthernetTestInterface
+    init {
+        val req = TestInterfaceRequest.Builder().setTap().build()
+        val tap = testInterfaceRule.createTestInterface(req)
+        iface = EthernetTestInterface(context, handler, tap)
+    }
+
+    private val localMac = iface.testIface.macAddress!!
+
+    // Available after provisioning.
+    private lateinit var clatV6Addr: Inet6Address
+
+    private val ndResponder = NdResponder(iface.packetReader).apply {
+        val ra = RaPkt()
+                .addPioOption(prefix = prefix.toString(), flags = "LA")
+                .addRdnssOption(dns = "2001:4860:4860::8888,2001:4860:4860::8844")
+                .addPref64Option(prefix = "64:ff9b::/96")
+        addRouterEntry(ROUTER_MAC, ROUTER_V6, ra)
+        start()
+    }
+
+    private fun requestNetwork(request: NetworkRequest): TestableNetworkCallback {
+        val cb = TestableNetworkCallback()
+        runAsShell(CHANGE_NETWORK_STATE) {
+            cm.requestNetwork(request, cb, handler)
+            registeredCallbacks.add(cb)
+        }
+        return cb
+    }
+
+    @Before
+    fun setUp() {
+        val cb = requestNetwork(REQUEST)
+        // b/233534110: eventuallyExpect<LinkPropertiesChanged>() does not advance ReadHead, use
+        // eventuallyExpect(LinkProperties::class) instead.
+        cb.eventuallyExpect(LinkPropertiesChanged::class)
+        val linkPropertiesChanged = cb.eventuallyExpect(LinkPropertiesChanged::class)
+        network = linkPropertiesChanged.network
+        lp = linkPropertiesChanged.lp
+        assertThat(lp.getStackedLinks()).isNotEmpty()
+
+        clatV6Addr = ProcfsParsingUtils.getAnycast6Addresses(iface.name).get(0)
+    }
+
+    @After
+    fun tearDown() {
+        if (socket != null) {
+            Os.close(socket)
+        }
+        for (cb in registeredCallbacks) {
+            cm.unregisterNetworkCallback(cb)
+        }
+        // TODO: AutoCloseTestInterfaceRule should destroy associated EthernetTestInterface.
+        iface.destroy()
+        handlerThread.quitSafely()
+        handlerThread.join()
+    }
+
+    fun LinkProperties.getInet4Address(): Inet4Address {
+        val las = getAllLinkAddresses()
+        for (la in las) {
+            if (la.isIpv4()) return la.address as Inet4Address
+        }
+        // If the v4- interface is present, this cannot happen.
+        fail("LinkProperties did not include an IPv4 address")
+    }
+
+    fun expectPacket(expectedPacket: ByteArray) {
+        val p = iface.packetReader.poll(TIMEOUT_MS) {
+            it.contentEquals(expectedPacket)
+        }
+        assertThat(p).isNotNull()
+    }
+
+    @Test
+    fun testClatEgress() {
+        socket = Os.socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP)
+        network.bindSocket(socket)
+        Os.connect(socket, InetAddress.getByName("1.2.3.4"), 12345)
+        val sockaddr = Os.getsockname(socket) as InetSocketAddress
+        val localPort = sockaddr.port
+        val buf = ByteBuffer.wrap("test data".toByteArray())
+        Os.write(socket, buf)
+
+        val ether = EtherPkt(dst = ROUTER_MAC, src = localMac)
+        val ipv6 = Ip6Pkt(src = clatV6Addr.hostAddress!!, dst = "64:ff9b::1.2.3.4", hlim = 64)
+        val udp = UdpPkt(srcPort = localPort, dstPort = 12345)
+        val payload = DataPkt(buf.array())
+        val pkt = ether / ipv6 / udp / payload
+        expectPacket(pkt.build())
+    }
+
+    @Test
+    fun testClatIngress() {
+        socket = Os.socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP)
+        network.bindSocket(socket)
+        Os.bind(socket, lp.getInet4Address(), 0)
+        val sockaddr = Os.getsockname(socket) as InetSocketAddress
+        val localPort = sockaddr.port
+
+        val ether = EtherPkt(dst = localMac, src = ROUTER_MAC)
+        val ipv6 = Ip6Pkt(src = "64:ff9b::1.2.3.4", dst = clatV6Addr.hostAddress!!)
+        val udp = UdpPkt(srcPort = 12345, dstPort = localPort)
+        val data = "more test data"
+        val payload = DataPkt(data)
+        val pkt = ether / ipv6 / udp / payload
+        iface.packetReader.sendResponse(ByteBuffer.wrap(pkt.build()))
+
+        val buf = ByteBuffer.allocate(data.length)
+        Os.read(socket, buf)
+        assertThat(buf.array()).isEqualTo(data.toByteArray())
+    }
+}

From f39b748cbfd844474fd00e3349f57427275e51f4 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Tue, 8 Apr 2025 12:16:28 -0700
Subject: [PATCH 105/377] Expose backtrace() in PollPacketReader

Figuring out what packets were received is useful for debugging.

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I3184845b76e33da186f39a2344548c2d16715173
---
 .../com/android/testutils/PollPacketReader.java           | 8 ++++++++
 .../hostdevice/com/android/net/module/util/TrackRecord.kt | 4 ++--
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/PollPacketReader.java b/staticlibs/testutils/devicetests/com/android/testutils/PollPacketReader.java
index dbc7eb0c00..b90696659c 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/PollPacketReader.java
+++ b/staticlibs/testutils/devicetests/com/android/testutils/PollPacketReader.java
@@ -29,6 +29,7 @@ import java.io.FileOutputStream;
 import java.io.IOException;
 import java.nio.ByteBuffer;
 import java.util.Arrays;
+import java.util.List;
 import java.util.function.Predicate;
 
 import kotlin.Lazy;
@@ -110,6 +111,13 @@ public class PollPacketReader extends PacketReader {
         return mReadHead.getValue().poll(timeoutMs, filter::test);
     }
 
+    /**
+     * Get all packets received since before the start of the last poll operation.
+     */
+    public List<byte[]> backtrace() {
+        return mReadHead.getValue().backtrace();
+    }
+
     /**
      * Get the {@link ArrayTrackRecord} that records all packets received by the reader since its
      * creation.
diff --git a/staticlibs/testutils/hostdevice/com/android/net/module/util/TrackRecord.kt b/staticlibs/testutils/hostdevice/com/android/net/module/util/TrackRecord.kt
index f24e4f184d..8051558f1c 100644
--- a/staticlibs/testutils/hostdevice/com/android/net/module/util/TrackRecord.kt
+++ b/staticlibs/testutils/hostdevice/com/android/net/module/util/TrackRecord.kt
@@ -278,8 +278,8 @@ class ArrayTrackRecord<E> : TrackRecord<E> {
         }
 
         /**
-         * Returns a list of events that were observed since the last time poll() was called on this
-         * ReadHead.
+         * Returns a list of events that were observed since before the last poll() operation on
+         * this ReadHead.
          *
          * @return list of events since poll() was called.
          */

From 97e690169779f9790aa8d6026fca6bdc3d61e1b3 Mon Sep 17 00:00:00 2001
From: Chalard Jean <jchalard@google.com>
Date: Fri, 11 Apr 2025 14:56:35 +0900
Subject: [PATCH 106/377] Fix a bug where non-VPN networks would update VPN
 uids.

Previously, non VPNs would not be created when updateVpnUids()
is called inside handleRegisterNetworkAgent. Because the network
is not created, netd would refuse to set the UIDs with an error.
Now that networks are created immediately with the
QUEUE_NETWORK_AGENT_EVENTS_IN_SYSTEM_SERVER flag,
the network is created and netd does set the UID for any
network as if they were a VPN. This results in the UID having
the wrong default network, which in turns prevents it from
accessing Internet.

Test: new test in this patch
Bug: 408717088
Flag: EXEMPT bugfix
Change-Id: If68ea7d60919c0c7e177480f6167196381e00f35
---
 .../android/server/ConnectivityService.java   |  2 +-
 .../connectivityservice/CSNetworkAgentTest.kt | 92 +++++++++++++++++++
 2 files changed, 93 insertions(+), 1 deletion(-)
 create mode 100644 tests/unit/java/com/android/server/connectivityservice/CSNetworkAgentTest.kt

diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index 4021a82eff..647455611c 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -9573,7 +9573,7 @@ public class ConnectivityService extends IConnectivityManager.Stub {
         nai.notifyRegistered(networkMonitor);
         NetworkInfo networkInfo = nai.networkInfo;
         updateNetworkInfo(nai, networkInfo);
-        updateVpnUids(nai, null, nai.networkCapabilities);
+        if (nai.isVPN()) updateVpnUids(nai, null, nai.networkCapabilities);
         nai.processEnqueuedMessages(mTrackerHandler::handleMessage);
     }
 
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSNetworkAgentTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSNetworkAgentTest.kt
new file mode 100644
index 0000000000..547a4cccf2
--- /dev/null
+++ b/tests/unit/java/com/android/server/connectivityservice/CSNetworkAgentTest.kt
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.server
+
+import android.net.NativeNetworkConfig
+import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_VPN
+import android.net.NetworkCapabilities.TRANSPORT_VPN
+import android.net.NetworkCapabilities.TRANSPORT_WIFI
+import android.net.VpnManager
+import android.net.VpnTransportInfo
+import android.net.netd.aidl.NativeUidRangeConfig
+import android.os.Build
+import android.os.Process
+import android.util.Range
+import com.android.testutils.ConnectivityModuleTest
+import com.android.testutils.DevSdkIgnoreRule
+import com.android.testutils.DevSdkIgnoreRunner
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.mockito.ArgumentMatchers.anyInt
+import org.mockito.ArgumentMatchers.argThat
+import org.mockito.Mockito.inOrder
+import org.mockito.Mockito.never
+
+@DevSdkIgnoreRunner.MonitorThreadLeak
+@RunWith(DevSdkIgnoreRunner::class)
+@DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.S)
+class CSNetworkAgentTest : CSTest() {
+    @Test fun testVpnUidAgent() = testUidAgent(
+        TRANSPORT_VPN,
+        expectAddUidRanges = true
+    )
+    @ConnectivityModuleTest
+    @Test fun testWifiUidAgent() = testUidAgent(TRANSPORT_WIFI, expectAddUidRanges = false)
+
+    fun testUidAgent(transport: Int, expectAddUidRanges: Boolean) {
+        val netdInOrder = inOrder(netd)
+        val uid = Process.myUid()
+
+        val nc = defaultNc()
+            .addTransportType(transport)
+            .setUids(setOf(Range(uid, uid)))
+        if (TRANSPORT_VPN == transport) {
+            nc.removeCapability(NET_CAPABILITY_NOT_VPN)
+            nc.setTransportInfo(
+                VpnTransportInfo(
+                    VpnManager.TYPE_VPN_SERVICE,
+                    "MySession12345",
+                    true /* bypassable */,
+                    false /* longLivedTcpConnectionsExpensive */
+                )
+            )
+        }
+        val agent = Agent(nc)
+        agent.connect()
+
+        netdInOrder.verify(netd).networkCreate(argThat { it: NativeNetworkConfig ->
+            it.netId == agent.network.netId
+        })
+        if (deps.isAtLeastU()) {
+          // The call to setNetworkAllowlist was added in U.
+          netdInOrder.verify(netd).setNetworkAllowlist(any())
+        }
+        if (expectAddUidRanges) {
+            netdInOrder.verify(netd).networkAddUidRangesParcel(argThat { it: NativeUidRangeConfig ->
+                it.netId == agent.network.netId &&
+                        it.uidRanges.size == 1 &&
+                        it.uidRanges[0].start == uid &&
+                        it.uidRanges[0].stop == uid &&
+                        it.subPriority == 0 // VPN priority
+            })
+        } else {
+            netdInOrder.verify(netd, never()).networkAddUidRangesParcel(any())
+        }
+        // The old method should never be called in any case
+        netdInOrder.verify(netd, never()).networkAddUidRanges(anyInt(), any())
+    }
+}

From dc958e902df37a63761769408a681e48a7d83682 Mon Sep 17 00:00:00 2001
From: Chalard Jean <jchalard@google.com>
Date: Fri, 11 Apr 2025 14:53:15 +0900
Subject: [PATCH 107/377] Have updateVpnUids do nothing if the network is not a
 VPN

Test: CsNetworkAgentTest
Flag: EXEMPT no-op rename
Change-Id: Idd60b0c924c0389bfdcc22d8283b39d087370b14
---
 .../src/com/android/server/ConnectivityService.java | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index 647455611c..11c6f1fb7f 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -9573,7 +9573,7 @@ public class ConnectivityService extends IConnectivityManager.Stub {
         nai.notifyRegistered(networkMonitor);
         NetworkInfo networkInfo = nai.networkInfo;
         updateNetworkInfo(nai, networkInfo);
-        if (nai.isVPN()) updateVpnUids(nai, null, nai.networkCapabilities);
+        maybeUpdateVpnUids(nai, null, nai.networkCapabilities);
         nai.processEnqueuedMessages(mTrackerHandler::handleMessage);
     }
 
@@ -10590,7 +10590,7 @@ public class ConnectivityService extends IConnectivityManager.Stub {
         updateNetworkPermissions(nai, newNc);
         final NetworkCapabilities prevNc = nai.getAndSetNetworkCapabilities(newNc);
 
-        updateVpnUids(nai, prevNc, newNc);
+        maybeUpdateVpnUids(nai, prevNc, newNc);
         updateAllowedUids(nai, prevNc, newNc);
         nai.updateScoreForNetworkAgentUpdate();
 
@@ -10942,8 +10942,9 @@ public class ConnectivityService extends IConnectivityManager.Stub {
         }
     }
 
-    private void updateVpnUids(@NonNull NetworkAgentInfo nai, @Nullable NetworkCapabilities prevNc,
-            @Nullable NetworkCapabilities newNc) {
+    private void maybeUpdateVpnUids(@NonNull NetworkAgentInfo nai,
+            @Nullable NetworkCapabilities prevNc, @Nullable NetworkCapabilities newNc) {
+        if (!nai.isVPN()) return;
         Set<UidRange> prevRanges = null == prevNc ? null : prevNc.getUidRanges();
         Set<UidRange> newRanges = null == newNc ? null : newNc.getUidRanges();
         if (null == prevRanges) prevRanges = new ArraySet<>();
@@ -12325,9 +12326,7 @@ public class ConnectivityService extends IConnectivityManager.Stub {
             if (!mQueueNetworkAgentEventsInSystemServer) {
                 networkAgent.disconnect();
             }
-            if (networkAgent.isVPN()) {
-                updateVpnUids(networkAgent, networkAgent.networkCapabilities, null);
-            }
+            maybeUpdateVpnUids(networkAgent, networkAgent.networkCapabilities, null);
             disconnectAndDestroyNetwork(networkAgent);
             if (networkAgent.isVPN()) {
                 // As the active or bound network changes for apps, broadcast the default proxy, as

From 4aaf2865e4b36c301c368f8394153b302d65169d Mon Sep 17 00:00:00 2001
From: Kangping Dong <wgtdkp@google.com>
Date: Sun, 13 Apr 2025 21:00:44 -0700
Subject: [PATCH 108/377] Revert "[Thread] enable/disable Thread via
 DeviceConfig flags"

This reverts commit 198b3218e727baeed59fe9812d2a35307f3ed164.

Reason for revert: we need only the settings changes (ag/32820024 and ag/32819994) to hide the settings toggle but don't need to make it default disabled as it makes no differences

Change-Id: I40dcea50eb3bbe16c9ffdb89c6182b976f819ece
---
 thread/service/Android.bp                     |   1 -
 .../android/server/thread/ClockSource.java    |  29 ---
 .../android/server/thread/FeatureFlags.java   |  21 +-
 .../ThreadNetworkControllerService.java       | 105 ++--------
 .../thread/ThreadPersistentSettings.java      |  32 +--
 thread/tests/unit/Android.bp                  |   1 -
 .../ThreadNetworkControllerServiceTest.java   | 198 ++++++++----------
 .../thread/ThreadPersistentSettingsTest.java  |  45 ++--
 8 files changed, 137 insertions(+), 295 deletions(-)
 delete mode 100644 thread/service/java/com/android/server/thread/ClockSource.java

diff --git a/thread/service/Android.bp b/thread/service/Android.bp
index 25c77eee82..1f4e601ce6 100644
--- a/thread/service/Android.bp
+++ b/thread/service/Android.bp
@@ -34,7 +34,6 @@ java_library {
     min_sdk_version: "30",
     srcs: [":service-thread-sources"],
     libs: [
-        "framework-configinfrastructure.stubs.module_lib",
         "framework-connectivity-pre-jarjar",
         "framework-connectivity-t-pre-jarjar",
         "framework-location.stubs.module_lib",
diff --git a/thread/service/java/com/android/server/thread/ClockSource.java b/thread/service/java/com/android/server/thread/ClockSource.java
deleted file mode 100644
index 5c6cf7fa68..0000000000
--- a/thread/service/java/com/android/server/thread/ClockSource.java
+++ /dev/null
@@ -1,29 +0,0 @@
-/*
- * Copyright (C) 2025 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package com.android.server.thread;
-
-import android.os.SystemClock;
-
-import java.time.Clock;
-import java.time.DateTimeException;
-
-/** A mockable class for providing {@link Clock}. */
-public class ClockSource {
-    public Clock currentNetworkTimeClock() throws DateTimeException {
-        return SystemClock.currentNetworkTimeClock();
-    }
-}
diff --git a/thread/service/java/com/android/server/thread/FeatureFlags.java b/thread/service/java/com/android/server/thread/FeatureFlags.java
index 6591750a1b..29bcedd0b3 100644
--- a/thread/service/java/com/android/server/thread/FeatureFlags.java
+++ b/thread/service/java/com/android/server/thread/FeatureFlags.java
@@ -17,17 +17,14 @@ package com.android.server.thread;
 import com.android.net.module.util.DeviceConfigUtils;
 
 public class FeatureFlags {
-    /** The namespace for Thread Network feature flags. */
-    public static final String NAMESPACE_THREAD_NETWORK = "thread_network";
+    // The namespace for Thread Network feature flags
+    private static final String NAMESPACE_THREAD_NETWORK = "thread_network";
 
     // The prefix for TREL feature flags
     private static final String TREL_FEATURE_PREFIX = "TrelFeature__";
 
     // The feature flag for TREL enabled state
-    private static final String KEY_TREL_ENABLED_FLAG = TREL_FEATURE_PREFIX + "enabled";
-
-    private static final String KEY_THREAD_DEFAULT_ENABLED =
-            "ThreadEnablementFeature__default_enabled";
+    private static final String TREL_ENABLED_FLAG = TREL_FEATURE_PREFIX + "enabled";
 
     private static boolean isFeatureEnabled(String flag, boolean defaultValue) {
         return DeviceConfigUtils.getDeviceConfigPropertyBoolean(
@@ -35,16 +32,6 @@ public class FeatureFlags {
     }
 
     public static boolean isTrelEnabled() {
-        return isFeatureEnabled(KEY_TREL_ENABLED_FLAG, false);
-    }
-
-    /**
-     * Returns {@code true} if Thread is by default enabled in {@code DeviceConfig}.
-     *
-     * <p>It returns the {@code fallbackValue} if the {@code DeviceConfig} value is not found on
-     * this device.
-     */
-    public static boolean isThreadDefaultEnabled(boolean fallbackValue) {
-        return isFeatureEnabled(KEY_THREAD_DEFAULT_ENABLED, fallbackValue);
+        return isFeatureEnabled(TREL_ENABLED_FLAG, false);
     }
 }
diff --git a/thread/service/java/com/android/server/thread/ThreadNetworkControllerService.java b/thread/service/java/com/android/server/thread/ThreadNetworkControllerService.java
index c3992ddbb4..e99c88ee46 100644
--- a/thread/service/java/com/android/server/thread/ThreadNetworkControllerService.java
+++ b/thread/service/java/com/android/server/thread/ThreadNetworkControllerService.java
@@ -117,13 +117,12 @@ import android.os.IBinder;
 import android.os.Looper;
 import android.os.ParcelFileDescriptor;
 import android.os.RemoteException;
+import android.os.SystemClock;
 import android.os.UserManager;
-import android.provider.DeviceConfig;
 import android.util.SparseArray;
 
 import com.android.connectivity.resources.R;
 import com.android.internal.annotations.VisibleForTesting;
-import com.android.modules.utils.HandlerExecutor;
 import com.android.net.module.util.IIpv4PrefixRequest;
 import com.android.net.module.util.RoutingCoordinatorManager;
 import com.android.net.module.util.SharedLog;
@@ -193,7 +192,6 @@ final class ThreadNetworkControllerService extends IThreadNetworkController.Stub
 
     private final Context mContext;
     private final Handler mHandler;
-    private final ClockSource mClockSource;
     private final MockableSystemProperties mSystemProperties;
 
     // Below member fields can only be accessed from the handler thread (`mHandler`). In
@@ -232,7 +230,6 @@ final class ThreadNetworkControllerService extends IThreadNetworkController.Stub
     private final UserManager mUserManager;
     private boolean mUserRestricted;
     private boolean mForceStopOtDaemonEnabled;
-    private boolean mThreadDefaultEnabled;
 
     private InfraLinkState mInfraLinkState;
 
@@ -240,7 +237,6 @@ final class ThreadNetworkControllerService extends IThreadNetworkController.Stub
     ThreadNetworkControllerService(
             Context context,
             Handler handler,
-            ClockSource clockSource,
             MockableSystemProperties systemProperties,
             NetworkProvider networkProvider,
             Supplier<IOtDaemon> otDaemonSupplier,
@@ -256,7 +252,6 @@ final class ThreadNetworkControllerService extends IThreadNetworkController.Stub
             Map<Network, LinkProperties> networkToLinkProperties) {
         mContext = context;
         mHandler = handler;
-        mClockSource = clockSource;
         mSystemProperties = systemProperties;
         mNetworkProvider = networkProvider;
         mOtDaemonSupplier = otDaemonSupplier;
@@ -295,7 +290,6 @@ final class ThreadNetworkControllerService extends IThreadNetworkController.Stub
         return new ThreadNetworkControllerService(
                 context,
                 handler,
-                new ClockSource(),
                 new MockableSystemProperties(),
                 networkProvider,
                 () -> IOtDaemon.Stub.asInterface(ServiceManagerWrapper.waitForService("ot_daemon")),
@@ -499,21 +493,17 @@ final class ThreadNetworkControllerService extends IThreadNetworkController.Stub
     private void initializeInternal() {
         checkOnHandlerThread();
 
-        mUserRestricted = isThreadUserRestricted();
-        mThreadDefaultEnabled = evaluateThreadDefaultEnabled();
-        registerUserRestrictionsReceiver();
-        registerDeviceConfigListener();
-
         LOG.v(
                 "Initializing Thread system service: Thread is "
                         + (shouldEnableThread() ? "enabled" : "disabled"));
-
         try {
             mTunIfController.createTunInterface();
         } catch (IOException e) {
             throw new IllegalStateException("Failed to create Thread tunnel interface", e);
         }
         mConnectivityManager.registerNetworkProvider(mNetworkProvider);
+        mUserRestricted = isThreadUserRestricted();
+        registerUserRestrictionsReceiver();
 
         if (isBorderRouterMode()) {
             requestUpstreamNetwork();
@@ -522,7 +512,6 @@ final class ThreadNetworkControllerService extends IThreadNetworkController.Stub
             cancelRequestUpstreamNetwork();
             unregisterThreadNetworkCallback();
         }
-
         maybeInitializeOtDaemon();
     }
 
@@ -784,50 +773,6 @@ final class ThreadNetworkControllerService extends IThreadNetworkController.Stub
         return mUserManager.hasUserRestriction(DISALLOW_THREAD_NETWORK);
     }
 
-    private void registerDeviceConfigListener() {
-        DeviceConfig.addOnPropertiesChangedListener(
-                FeatureFlags.NAMESPACE_THREAD_NETWORK,
-                new HandlerExecutor(mHandler),
-                this::onDeviceConfigChanged);
-    }
-
-    private void onDeviceConfigChanged(DeviceConfig.Properties properties) {
-        boolean newThreadDefaultEnabled = evaluateThreadDefaultEnabled();
-        if (mThreadDefaultEnabled == newThreadDefaultEnabled) {
-            return;
-        }
-        LOG.i(
-                "Thread default_enabled in DeviceConfig changed: "
-                        + mThreadDefaultEnabled
-                        + " -> "
-                        + newThreadDefaultEnabled);
-        mThreadDefaultEnabled = newThreadDefaultEnabled;
-
-        final boolean shouldEnableThread = shouldEnableThread();
-        final IOperationReceiver receiver =
-                new IOperationReceiver.Stub() {
-                    @Override
-                    public void onSuccess() {
-                        LOG.v(
-                                (shouldEnableThread ? "Enabled" : "Disabled")
-                                        + " Thread due to DeviceConfig change");
-                    }
-
-                    @Override
-                    public void onError(int errorCode, String errorMessage) {
-                        LOG.e(
-                                "Failed to "
-                                        + (shouldEnableThread ? "enable" : "disable")
-                                        + " Thread for DeviceConfig change");
-                    }
-                };
-
-        // Do not save the DeviceConfig flag to persistent settings so that the user
-        // configuration won't be overwritten
-        setEnabledInternal(
-                shouldEnableThread, false /* persist */, new OperationReceiverWrapper(receiver));
-    }
-
     /**
      * Returns {@code true} if Thread should be enabled based on current settings, runtime user
      * restriction state.
@@ -835,14 +780,7 @@ final class ThreadNetworkControllerService extends IThreadNetworkController.Stub
     private boolean shouldEnableThread() {
         return !mForceStopOtDaemonEnabled
                 && !mUserRestricted
-                && mPersistentSettings.getBoolean(
-                        ThreadPersistentSettings.KEY_THREAD_ENABLED, mThreadDefaultEnabled);
-    }
-
-    /** Returns {@code true} if Thread is by default enabled on this device. */
-    private boolean evaluateThreadDefaultEnabled() {
-        return FeatureFlags.isThreadDefaultEnabled(
-                mResources.get().getBoolean(R.bool.config_thread_default_enabled));
+                && mPersistentSettings.get(ThreadPersistentSettings.KEY_THREAD_ENABLED);
     }
 
     private void requestUpstreamNetwork() {
@@ -1123,8 +1061,7 @@ final class ThreadNetworkControllerService extends IThreadNetworkController.Stub
                                 supportedChannelMask,
                                 preferredChannelMask,
                                 new Random(),
-                                new SecureRandom(),
-                                mClockSource);
+                                new SecureRandom());
 
                 receiver.onSuccess(dataset);
             }
@@ -1141,12 +1078,11 @@ final class ThreadNetworkControllerService extends IThreadNetworkController.Stub
             int supportedChannelMask,
             int preferredChannelMask,
             Random random,
-            SecureRandom secureRandom,
-            ClockSource clockSource) {
+            SecureRandom secureRandom) {
         boolean authoritative = false;
         Instant now = Instant.now();
         try {
-            Clock clock = clockSource.currentNetworkTimeClock();
+            Clock clock = SystemClock.currentNetworkTimeClock();
             now = clock.instant();
             authoritative = true;
         } catch (DateTimeException e) {
@@ -1825,23 +1761,10 @@ final class ThreadNetworkControllerService extends IThreadNetworkController.Stub
                 // This is thrown when the client is dead, do nothing
             }
 
-            maybeRegisterStateCallback(callbackMetadata.id);
-        }
-
-        private void maybeRegisterStateCallback(long listenerId) {
-            // Do not start ot-daemon if Thread is disabled. Going forward, this check will be added
-            // into getOtDaemon()
-            if (shouldEnableThread()) {
-                try {
-                    getOtDaemon().registerStateCallback(this, listenerId);
-                } catch (RemoteException | ThreadNetworkException e) {
-                    LOG.e("otDaemon.registerStateCallback failed", e);
-                }
-            } else {
-                OtDaemonState state = new OtDaemonState();
-                state.activeDatasetTlvs = new byte[0];
-                state.pendingDatasetTlvs = new byte[0];
-                onStateChanged(state, listenerId);
+            try {
+                getOtDaemon().registerStateCallback(this, callbackMetadata.id);
+            } catch (RemoteException | ThreadNetworkException e) {
+                LOG.e("otDaemon.registerStateCallback failed", e);
             }
         }
 
@@ -1871,7 +1794,11 @@ final class ThreadNetworkControllerService extends IThreadNetworkController.Stub
                 mOpDatasetCallbacks.remove(callback);
             }
 
-            maybeRegisterStateCallback(callbackMetadata.id);
+            try {
+                getOtDaemon().registerStateCallback(this, callbackMetadata.id);
+            } catch (RemoteException | ThreadNetworkException e) {
+                LOG.e("otDaemon.registerStateCallback failed", e);
+            }
         }
 
         public void unregisterDatasetCallback(IOperationalDatasetCallback callback) {
diff --git a/thread/service/java/com/android/server/thread/ThreadPersistentSettings.java b/thread/service/java/com/android/server/thread/ThreadPersistentSettings.java
index ead5611c5b..fd6dec728c 100644
--- a/thread/service/java/com/android/server/thread/ThreadPersistentSettings.java
+++ b/thread/service/java/com/android/server/thread/ThreadPersistentSettings.java
@@ -120,9 +120,9 @@ public class ThreadPersistentSettings {
         mAtomicFile = atomicFile;
         mResources = resources;
 
-        // The Thread default enabled state is deferred to upper layer
-        mDefaultValues.put(KEY_THREAD_ENABLED.key, null);
-
+        mDefaultValues.put(
+                KEY_THREAD_ENABLED.key,
+                mResources.get().getBoolean(R.bool.config_thread_default_enabled));
         mDefaultValues.put(
                 KEY_CONFIG_BORDER_ROUTER_ENABLED.key,
                 mResources.get().getBoolean(R.bool.config_thread_border_router_default_enabled));
@@ -161,9 +161,6 @@ public class ThreadPersistentSettings {
         Object value;
         synchronized (mLock) {
             if (defaultValue == null) {
-                if (!key.equals(KEY_COUNTRY_CODE.key)) {
-                    throw new IllegalStateException("Unexpected null defaultValue for " + key);
-                }
                 value = mSettings.getString(key, null);
             } else if (defaultValue instanceof Boolean) {
                 value = mSettings.getBoolean(key, (Boolean) defaultValue);
@@ -195,29 +192,6 @@ public class ThreadPersistentSettings {
         return getObject(key.key, defaultValue);
     }
 
-    /**
-     * Returns a {@code boolean} settings value or {@code defaultValue} if the {@code key} is
-     * missing in the persistent settings.
-     *
-     * <p>This API is useful for allowing caller to provide a custom default value which is not
-     * determined when the system initializes.
-     */
-    public boolean getBoolean(Key<Boolean> key, boolean defaultValue) {
-        synchronized (mLock) {
-            return mSettings.getBoolean(key.key, defaultValue);
-        }
-    }
-
-    /**
-     * Returns {@code true} if a value for the given {@code key} has been saved to this settings.
-     */
-    @VisibleForTesting
-    <T> boolean containsKey(Key<T> key) {
-        synchronized (mLock) {
-            return mSettings.containsKey(key.key);
-        }
-    }
-
     /**
      * Store a {@link ThreadConfiguration} to the persistent settings.
      *
diff --git a/thread/tests/unit/Android.bp b/thread/tests/unit/Android.bp
index bc4afae15a..53b1eca63b 100644
--- a/thread/tests/unit/Android.bp
+++ b/thread/tests/unit/Android.bp
@@ -21,7 +21,6 @@ package {
 
 android_test {
     name: "ThreadNetworkUnitTests",
-    defaults: ["modules-utils-testable-device-config-defaults"],
     min_sdk_version: "33",
     sdk_version: "module_current",
     manifest: "AndroidManifest.xml",
diff --git a/thread/tests/unit/src/com/android/server/thread/ThreadNetworkControllerServiceTest.java b/thread/tests/unit/src/com/android/server/thread/ThreadNetworkControllerServiceTest.java
index 000e0a77ea..a73390c670 100644
--- a/thread/tests/unit/src/com/android/server/thread/ThreadNetworkControllerServiceTest.java
+++ b/thread/tests/unit/src/com/android/server/thread/ThreadNetworkControllerServiceTest.java
@@ -17,6 +17,8 @@
 package com.android.server.thread;
 
 import static android.Manifest.permission.NETWORK_SETTINGS;
+import static android.Manifest.permission.WRITE_ALLOWLISTED_DEVICE_CONFIG;
+import static android.Manifest.permission.WRITE_DEVICE_CONFIG;
 import static android.net.NetworkCapabilities.NET_CAPABILITY_INTERNET;
 import static android.net.NetworkCapabilities.NET_CAPABILITY_NOT_VPN;
 import static android.net.NetworkCapabilities.TRANSPORT_ETHERNET;
@@ -36,6 +38,7 @@ import static com.android.server.thread.ThreadNetworkControllerService.getMeshco
 import static com.android.server.thread.ThreadNetworkCountryCode.DEFAULT_COUNTRY_CODE;
 import static com.android.server.thread.ThreadPersistentSettings.KEY_THREAD_ENABLED;
 import static com.android.server.thread.openthread.IOtDaemon.ErrorCode.OT_ERROR_INVALID_STATE;
+import static com.android.testutils.TestPermissionUtil.runAsShell;
 
 import static com.google.common.io.BaseEncoding.base16;
 import static com.google.common.truth.Truth.assertThat;
@@ -83,6 +86,7 @@ import android.os.Handler;
 import android.os.IBinder;
 import android.os.ParcelFileDescriptor;
 import android.os.RemoteException;
+import android.os.SystemClock;
 import android.os.UserManager;
 import android.os.test.TestLooper;
 import android.provider.DeviceConfig;
@@ -93,7 +97,7 @@ import androidx.test.core.app.ApplicationProvider;
 import androidx.test.filters.SmallTest;
 
 import com.android.connectivity.resources.R;
-import com.android.modules.utils.testing.TestableDeviceConfig;
+import com.android.dx.mockito.inline.extended.ExtendedMockito;
 import com.android.net.module.util.RoutingCoordinatorManager;
 import com.android.server.connectivity.ConnectivityResources;
 import com.android.server.connectivity.MockableSystemProperties;
@@ -102,6 +106,7 @@ import com.android.server.thread.openthread.IOtStatusReceiver;
 import com.android.server.thread.openthread.MeshcopTxtAttributes;
 import com.android.server.thread.openthread.testing.FakeOtDaemon;
 
+import org.junit.After;
 import org.junit.Before;
 import org.junit.Rule;
 import org.junit.Test;
@@ -114,10 +119,12 @@ import org.mockito.InOrder;
 import org.mockito.Mock;
 import org.mockito.Mockito;
 import org.mockito.MockitoAnnotations;
+import org.mockito.MockitoSession;
 
 import java.time.Clock;
 import java.time.DateTimeException;
 import java.time.Instant;
+import java.time.ZoneId;
 import java.util.Arrays;
 import java.util.Collection;
 import java.util.List;
@@ -173,8 +180,6 @@ public final class ThreadNetworkControllerServiceTest {
     private static final String TEST_MODEL_NAME = "test model";
     private static final LinkAddress TEST_NAT64_CIDR = new LinkAddress("192.168.255.0/24");
 
-    @Mock private ClockSource mMockClockSource;
-    @Mock private Clock mMockNetworkTimeClock;
     @Mock private MockableSystemProperties mMockSystemProperties;
     @Mock private ConnectivityManager mMockConnectivityManager;
     @Mock private RoutingCoordinatorManager mMockRoutingCoordinatorManager;
@@ -197,11 +202,7 @@ public final class ThreadNetworkControllerServiceTest {
     @Captor private ArgumentCaptor<ActiveOperationalDataset> mActiveDatasetCaptor;
 
     @Rule(order = 1)
-    public final TemporaryFolder mTempFolder = new TemporaryFolder();
-
-    @Rule(order = 2)
-    public final TestableDeviceConfig.TestableDeviceConfigRule mDeviceConfig =
-            new TestableDeviceConfig.TestableDeviceConfigRule();
+    public final TemporaryFolder tempFolder = new TemporaryFolder();
 
     private final boolean mIsBorderRouterEnabled;
 
@@ -262,18 +263,14 @@ public final class ThreadNetworkControllerServiceTest {
                 .thenReturn(new String[] {});
         when(mResources.getBoolean(eq(R.bool.config_thread_country_code_enabled))).thenReturn(true);
 
-        final AtomicFile storageFile = new AtomicFile(mTempFolder.newFile("thread_settings.xml"));
+        final AtomicFile storageFile = new AtomicFile(tempFolder.newFile("thread_settings.xml"));
         mPersistentSettings = new ThreadPersistentSettings(storageFile, mConnectivityResources);
         mPersistentSettings.initialize();
 
-        when(mMockClockSource.currentNetworkTimeClock()).thenReturn(mMockNetworkTimeClock);
-        when(mMockNetworkTimeClock.instant()).thenReturn(Instant.ofEpochMilli(0));
-
         mService =
                 new ThreadNetworkControllerService(
                         mContext,
                         handler,
-                        mMockClockSource,
                         mMockSystemProperties,
                         networkProvider,
                         () -> mFakeOtDaemon,
@@ -290,6 +287,14 @@ public final class ThreadNetworkControllerServiceTest {
         mService.setTestNetworkAgent(mMockNetworkAgent);
     }
 
+    @After
+    public void tearDown() throws Exception {
+        runAsShell(
+                WRITE_DEVICE_CONFIG,
+                WRITE_ALLOWLISTED_DEVICE_CONFIG,
+                () -> DeviceConfig.deleteProperty("thread_network", "TrelFeature__enabled"));
+    }
+
     @Test
     public void initialize_tunInterfaceAndNsdPublisherSetToOtDaemon() throws Exception {
         when(mMockTunIfController.getTunFd()).thenReturn(mMockTunFd);
@@ -377,7 +382,12 @@ public final class ThreadNetworkControllerServiceTest {
 
     @Test
     public void initialize_trelFeatureDisabled_trelDisabledAtOtDaemon() throws Exception {
-        DeviceConfig.setProperty("thread_network", "TrelFeature__enabled", "false", false);
+        runAsShell(
+                WRITE_DEVICE_CONFIG,
+                WRITE_ALLOWLISTED_DEVICE_CONFIG,
+                () ->
+                        DeviceConfig.setProperty(
+                                "thread_network", "TrelFeature__enabled", "false", false));
 
         mService.initialize();
         mTestLooper.dispatchAll();
@@ -387,8 +397,12 @@ public final class ThreadNetworkControllerServiceTest {
 
     @Test
     public void initialize_trelFeatureEnabled_setTrelEnabledAtOtDamon() throws Exception {
-        DeviceConfig.setProperty("thread_network", "TrelFeature__enabled", "true", false);
-
+        runAsShell(
+                WRITE_DEVICE_CONFIG,
+                WRITE_ALLOWLISTED_DEVICE_CONFIG,
+                () ->
+                        DeviceConfig.setProperty(
+                                "thread_network", "TrelFeature__enabled", "true", false));
         mService.initialize();
         mTestLooper.dispatchAll();
 
@@ -606,7 +620,7 @@ public final class ThreadNetworkControllerServiceTest {
         mTestLooper.dispatchAll();
 
         assertThat(mFakeOtDaemon.getEnabledState()).isEqualTo(STATE_DISABLED);
-        assertThat(mPersistentSettings.containsKey(KEY_THREAD_ENABLED)).isFalse();
+        assertThat(mPersistentSettings.get(KEY_THREAD_ENABLED)).isTrue();
     }
 
     @Test
@@ -638,73 +652,6 @@ public final class ThreadNetworkControllerServiceTest {
         assertThat(failure.getErrorCode()).isEqualTo(ERROR_FAILED_PRECONDITION);
     }
 
-    @Test
-    public void deviceConfig_initWithThreadDefaultDisabled_otDaemonNotStarted() {
-        DeviceConfig.setProperty(
-                "thread_network", "ThreadEnablementFeature__default_enabled", "false", false);
-
-        mService.initialize();
-        mTestLooper.dispatchAll();
-
-        assertThat(mFakeOtDaemon.isInitialized()).isFalse();
-    }
-
-    @Test
-    public void deviceConfig_initWithThreadDefaultEnabled_threadIsEnabled() {
-        DeviceConfig.setProperty(
-                "thread_network", "ThreadEnablementFeature__default_enabled", "true", false);
-
-        mService.initialize();
-        mTestLooper.dispatchAll();
-
-        assertThat(mFakeOtDaemon.getEnabledState()).isEqualTo(STATE_ENABLED);
-    }
-
-    @Test
-    public void deviceConfig_threadDefaultEnabledBecomesTrue_stateIsEnabledButNotPersisted() {
-        DeviceConfig.setProperty(
-                "thread_network", "ThreadEnablementFeature__default_enabled", "false", false);
-        mService.initialize();
-        mTestLooper.dispatchAll();
-
-        DeviceConfig.setProperty(
-                "thread_network", "ThreadEnablementFeature__default_enabled", "true", true);
-        mTestLooper.dispatchAll();
-
-        assertThat(mFakeOtDaemon.getEnabledState()).isEqualTo(STATE_ENABLED);
-        assertThat(mPersistentSettings.containsKey(KEY_THREAD_ENABLED)).isFalse();
-    }
-
-    @Test
-    public void deviceConfig_threadThreadEnabledBecomesFalse_stateIsDisabledButNotPersisted() {
-        DeviceConfig.setProperty(
-                "thread_network", "ThreadEnablementFeature__default_enabled", "true", false);
-        mService.initialize();
-        mTestLooper.dispatchAll();
-
-        DeviceConfig.setProperty(
-                "thread_network", "ThreadEnablementFeature__default_enabled", "false", false);
-        mTestLooper.dispatchAll();
-
-        assertThat(mFakeOtDaemon.getEnabledState()).isEqualTo(STATE_DISABLED);
-        assertThat(mPersistentSettings.containsKey(KEY_THREAD_ENABLED)).isFalse();
-    }
-
-    @Test
-    public void deviceConfig_threadDefaultDisabledButUserSetEnabled_stateIsEnabledAndPersisted() {
-        DeviceConfig.setProperty(
-                "thread_network", "ThreadEnablementFeature__default_enabled", "false", false);
-        mService.initialize();
-        mTestLooper.dispatchAll();
-
-        mService.setEnabled(true, newOperationReceiver(new CompletableFuture<Void>()));
-        mTestLooper.dispatchAll();
-
-        assertThat(mFakeOtDaemon.getEnabledState()).isEqualTo(STATE_ENABLED);
-        assertThat(mPersistentSettings.containsKey(KEY_THREAD_ENABLED)).isTrue();
-        assertThat(mPersistentSettings.getBoolean(KEY_THREAD_ENABLED, false)).isTrue();
-    }
-
     private AtomicReference<BroadcastReceiver> captureBroadcastReceiver(String action) {
         AtomicReference<BroadcastReceiver> receiverRef = new AtomicReference<>();
 
@@ -741,12 +688,19 @@ public final class ThreadNetworkControllerServiceTest {
     public void
             createRandomizedDataset_noNetworkTimeClock_datasetActiveTimestampIsNotAuthoritative()
                     throws Exception {
-        var mockReceiver = mock(IActiveOperationalDatasetReceiver.class);
+        MockitoSession session =
+                ExtendedMockito.mockitoSession().mockStatic(SystemClock.class).startMocking();
+        final IActiveOperationalDatasetReceiver mockReceiver =
+                ExtendedMockito.mock(IActiveOperationalDatasetReceiver.class);
 
-        when(mMockClockSource.currentNetworkTimeClock())
-                .thenThrow(new DateTimeException("fake throw"));
-        mService.createRandomizedDataset(DEFAULT_NETWORK_NAME, mockReceiver);
-        mTestLooper.dispatchAll();
+        try {
+            ExtendedMockito.when(SystemClock.currentNetworkTimeClock())
+                    .thenThrow(new DateTimeException("fake throw"));
+            mService.createRandomizedDataset(DEFAULT_NETWORK_NAME, mockReceiver);
+            mTestLooper.dispatchAll();
+        } finally {
+            session.finishMocking();
+        }
 
         verify(mockReceiver, never()).onError(anyInt(), anyString());
         verify(mockReceiver, times(1)).onSuccess(mActiveDatasetCaptor.capture());
@@ -756,11 +710,20 @@ public final class ThreadNetworkControllerServiceTest {
 
     @Test
     public void createRandomizedDataset_zeroNanoseconds_returnsZeroTicks() throws Exception {
-        when(mMockNetworkTimeClock.instant()).thenReturn(Instant.ofEpochSecond(0, 0));
-        var mockReceiver = mock(IActiveOperationalDatasetReceiver.class);
+        Instant now = Instant.ofEpochSecond(0, 0);
+        Clock clock = Clock.fixed(now, ZoneId.systemDefault());
+        MockitoSession session =
+                ExtendedMockito.mockitoSession().mockStatic(SystemClock.class).startMocking();
+        final IActiveOperationalDatasetReceiver mockReceiver =
+                ExtendedMockito.mock(IActiveOperationalDatasetReceiver.class);
 
-        mService.createRandomizedDataset(DEFAULT_NETWORK_NAME, mockReceiver);
-        mTestLooper.dispatchAll();
+        try {
+            ExtendedMockito.when(SystemClock.currentNetworkTimeClock()).thenReturn(clock);
+            mService.createRandomizedDataset(DEFAULT_NETWORK_NAME, mockReceiver);
+            mTestLooper.dispatchAll();
+        } finally {
+            session.finishMocking();
+        }
 
         verify(mockReceiver, never()).onError(anyInt(), anyString());
         verify(mockReceiver, times(1)).onSuccess(mActiveDatasetCaptor.capture());
@@ -773,13 +736,20 @@ public final class ThreadNetworkControllerServiceTest {
         // The nanoseconds to ticks conversion is rounded in the current implementation.
         // 32767.5 / 32768 * 1000000000 = 999984741.2109375, using 999984741 to
         // produce the maximum ticks.
-        Instant maxNanos = Instant.ofEpochSecond(0, 999984741);
-        when(mMockNetworkTimeClock.instant()).thenReturn(maxNanos);
+        Instant now = Instant.ofEpochSecond(0, 999984741);
+        Clock clock = Clock.fixed(now, ZoneId.systemDefault());
+        MockitoSession session =
+                ExtendedMockito.mockitoSession().mockStatic(SystemClock.class).startMocking();
+        final IActiveOperationalDatasetReceiver mockReceiver =
+                ExtendedMockito.mock(IActiveOperationalDatasetReceiver.class);
 
-        var mockReceiver = mock(IActiveOperationalDatasetReceiver.class);
-
-        mService.createRandomizedDataset(DEFAULT_NETWORK_NAME, mockReceiver);
-        mTestLooper.dispatchAll();
+        try {
+            ExtendedMockito.when(SystemClock.currentNetworkTimeClock()).thenReturn(clock);
+            mService.createRandomizedDataset(DEFAULT_NETWORK_NAME, mockReceiver);
+            mTestLooper.dispatchAll();
+        } finally {
+            session.finishMocking();
+        }
 
         verify(mockReceiver, never()).onError(anyInt(), anyString());
         verify(mockReceiver, times(1)).onSuccess(mActiveDatasetCaptor.capture());
@@ -790,11 +760,19 @@ public final class ThreadNetworkControllerServiceTest {
     @Test
     public void createRandomizedDataset_hasNetworkTimeClock_datasetActiveTimestampIsAuthoritative()
             throws Exception {
-        when(mMockClockSource.currentNetworkTimeClock()).thenReturn(mMockNetworkTimeClock);
-        var mockReceiver = mock(IActiveOperationalDatasetReceiver.class);
+        MockitoSession session =
+                ExtendedMockito.mockitoSession().mockStatic(SystemClock.class).startMocking();
+        final IActiveOperationalDatasetReceiver mockReceiver =
+                ExtendedMockito.mock(IActiveOperationalDatasetReceiver.class);
 
-        mService.createRandomizedDataset(DEFAULT_NETWORK_NAME, mockReceiver);
-        mTestLooper.dispatchAll();
+        try {
+            ExtendedMockito.when(SystemClock.currentNetworkTimeClock())
+                    .thenReturn(Clock.systemUTC());
+            mService.createRandomizedDataset(DEFAULT_NETWORK_NAME, mockReceiver);
+            mTestLooper.dispatchAll();
+        } finally {
+            session.finishMocking();
+        }
 
         verify(mockReceiver, never()).onError(anyInt(), anyString());
         verify(mockReceiver, times(1)).onSuccess(mActiveDatasetCaptor.capture());
@@ -826,7 +804,8 @@ public final class ThreadNetworkControllerServiceTest {
     @Test
     public void createRandomizedDataset_otDaemonRemoteFailure_returnsPreconditionError()
             throws Exception {
-        var mockReceiver = mock(IActiveOperationalDatasetReceiver.class);
+        final IActiveOperationalDatasetReceiver mockReceiver =
+                mock(IActiveOperationalDatasetReceiver.class);
         mFakeOtDaemon.setChannelMasksReceiverOtError(OT_ERROR_INVALID_STATE);
         when(mockReceiver.asBinder()).thenReturn(mIBinder);
 
@@ -1014,17 +993,6 @@ public final class ThreadNetworkControllerServiceTest {
         assertThat(upstreamNetworkRequest.hasCapability(NET_CAPABILITY_INTERNET)).isTrue();
     }
 
-    @Test
-    public void initialize_ThreadDisabledInResources_disabledButNotPersisted() throws Exception {
-        when(mResources.getBoolean(eq(R.bool.config_thread_default_enabled))).thenReturn(false);
-
-        mService.initialize();
-        mTestLooper.dispatchAll();
-
-        assertThat(mFakeOtDaemon.getEnabledState()).isEqualTo(STATE_DISABLED);
-        assertThat(mPersistentSettings.containsKey(KEY_THREAD_ENABLED)).isFalse();
-    }
-
     @Test
     public void setTestNetworkAsUpstream_upstreamNetworkRequestAlwaysDisallowsVpn() {
         mService.initialize();
diff --git a/thread/tests/unit/src/com/android/server/thread/ThreadPersistentSettingsTest.java b/thread/tests/unit/src/com/android/server/thread/ThreadPersistentSettingsTest.java
index e1f6015429..15f3d0b146 100644
--- a/thread/tests/unit/src/com/android/server/thread/ThreadPersistentSettingsTest.java
+++ b/thread/tests/unit/src/com/android/server/thread/ThreadPersistentSettingsTest.java
@@ -21,7 +21,6 @@ import static com.android.server.thread.ThreadPersistentSettings.KEY_THREAD_ENAB
 
 import static com.google.common.truth.Truth.assertThat;
 
-import static org.junit.Assert.assertThrows;
 import static org.mockito.Mockito.eq;
 import static org.mockito.Mockito.validateMockitoUsage;
 import static org.mockito.Mockito.when;
@@ -84,46 +83,64 @@ public class ThreadPersistentSettingsTest {
     }
 
     @Test
-    public void initialize_threadEnabledInFile_enabledValueIsUsed() throws Exception {
-        byte[] data = createXmlForParsing(KEY_THREAD_ENABLED, true);
+    public void initialize_readsFromFile() throws Exception {
+        byte[] data = createXmlForParsing(KEY_THREAD_ENABLED, false);
         setupAtomicFileForRead(data);
 
         mThreadPersistentSettings.initialize();
 
-        assertThat(mThreadPersistentSettings.getBoolean(KEY_THREAD_ENABLED, false)).isTrue();
+        assertThat(mThreadPersistentSettings.get(KEY_THREAD_ENABLED)).isFalse();
     }
 
     @Test
-    public void getBoolean_threadEnabledNotSet_defaultValueIsUsed() {
+    public void initialize_ThreadDisabledInResources_returnsThreadDisabled() throws Exception {
+        when(mResources.getBoolean(eq(R.bool.config_thread_default_enabled))).thenReturn(false);
+        mThreadPersistentSettings =
+                new ThreadPersistentSettings(mAtomicFile, mConnectivityResources);
+
         mThreadPersistentSettings.initialize();
 
-        assertThat(mThreadPersistentSettings.getBoolean(KEY_THREAD_ENABLED, true)).isTrue();
-        assertThat(mThreadPersistentSettings.getBoolean(KEY_THREAD_ENABLED, false)).isFalse();
+        assertThat(mThreadPersistentSettings.get(KEY_THREAD_ENABLED)).isFalse();
     }
 
     @Test
-    public void get_getThreadEnabled_throwsIllegalStateException() {
+    public void initialize_ThreadEnabledInResources_returnsThreadEnabled() throws Exception {
+        when(mResources.getBoolean(eq(R.bool.config_thread_default_enabled))).thenReturn(true);
+        mThreadPersistentSettings =
+                new ThreadPersistentSettings(mAtomicFile, mConnectivityResources);
+
         mThreadPersistentSettings.initialize();
 
-        assertThrows(
-                IllegalStateException.class,
-                () -> mThreadPersistentSettings.get(KEY_THREAD_ENABLED));
+        assertThat(mThreadPersistentSettings.get(KEY_THREAD_ENABLED)).isTrue();
+    }
+
+    @Test
+    public void initialize_ThreadDisabledInResourcesButEnabledInXml_returnsThreadEnabled()
+            throws Exception {
+        when(mResources.getBoolean(eq(R.bool.config_thread_default_enabled))).thenReturn(false);
+        setupAtomicFileForRead(createXmlForParsing(KEY_THREAD_ENABLED, true));
+        mThreadPersistentSettings =
+                new ThreadPersistentSettings(mAtomicFile, mConnectivityResources);
+
+        mThreadPersistentSettings.initialize();
+
+        assertThat(mThreadPersistentSettings.get(KEY_THREAD_ENABLED)).isTrue();
     }
 
     @Test
     public void put_ThreadFeatureEnabledTrue_returnsTrue() throws Exception {
         mThreadPersistentSettings.put(KEY_THREAD_ENABLED, true);
 
-        assertThat(mThreadPersistentSettings.getBoolean(KEY_THREAD_ENABLED, false)).isTrue();
+        assertThat(mThreadPersistentSettings.get(KEY_THREAD_ENABLED)).isTrue();
     }
 
     @Test
     public void put_ThreadFeatureEnabledFalse_returnsFalse() throws Exception {
         mThreadPersistentSettings.put(KEY_THREAD_ENABLED, false);
 
-        assertThat(mThreadPersistentSettings.getBoolean(KEY_THREAD_ENABLED, true)).isFalse();
+        assertThat(mThreadPersistentSettings.get(KEY_THREAD_ENABLED)).isFalse();
         mThreadPersistentSettings.initialize();
-        assertThat(mThreadPersistentSettings.getBoolean(KEY_THREAD_ENABLED, true)).isFalse();
+        assertThat(mThreadPersistentSettings.get(KEY_THREAD_ENABLED)).isFalse();
     }
 
     @Test

From 61b73b444a5923b934799aa7acd541cd6086c1ae Mon Sep 17 00:00:00 2001
From: Remi NGUYEN VAN <reminv@google.com>
Date: Fri, 11 Apr 2025 17:09:44 +0900
Subject: [PATCH 109/377] Clean up the CtsNetTestCasesMaxTargetSdk filters

Instead of relying on the test runner ignoring "include-annotation" if
the annotation class is not part of the APK, and on the module name
matching the annotation name, specify the annotation in the build rule.

This makes the test setup easier to understand and less likely to break
with test runner behavior changes or annotation/test renames.

Test: atest
Bug: 410435307
Flag: TEST_ONLY
Change-Id: I2db905a65729adaca508eefcc0c06e5427b1bb98
---
 tests/cts/net/Android.bp              | 24 ++++++++++++++++++++++++
 tests/cts/net/AndroidTestTemplate.xml | 14 +++-----------
 2 files changed, 27 insertions(+), 11 deletions(-)

diff --git a/tests/cts/net/Android.bp b/tests/cts/net/Android.bp
index 50b131e9bf..a7eca21385 100644
--- a/tests/cts/net/Android.bp
+++ b/tests/cts/net/Android.bp
@@ -135,6 +135,14 @@ android_test {
     target_sdk_version: "33",
     package_name: "android.net.cts.maxtargetsdk33",
     instrumentation_target_package: "android.net.cts.maxtargetsdk33",
+    test_options: {
+        test_runner_options: [
+            {
+                name: "include-annotation",
+                value: "com.android.testutils.filters.CtsNetTestCasesMaxTargetSdk33",
+            },
+        ],
+    },
 }
 
 android_test {
@@ -143,6 +151,14 @@ android_test {
     target_sdk_version: "31",
     package_name: "android.net.cts.maxtargetsdk31", // CTS package names must be unique.
     instrumentation_target_package: "android.net.cts.maxtargetsdk31",
+    test_options: {
+        test_runner_options: [
+            {
+                name: "include-annotation",
+                value: "com.android.testutils.filters.CtsNetTestCasesMaxTargetSdk31",
+            },
+        ],
+    },
 }
 
 android_test {
@@ -151,6 +167,14 @@ android_test {
     target_sdk_version: "30",
     package_name: "android.net.cts.maxtargetsdk30", // CTS package names must be unique.
     instrumentation_target_package: "android.net.cts.maxtargetsdk30",
+    test_options: {
+        test_runner_options: [
+            {
+                name: "include-annotation",
+                value: "com.android.testutils.filters.CtsNetTestCasesMaxTargetSdk30",
+            },
+        ],
+    },
 }
 
 android_test_helper_app {
diff --git a/tests/cts/net/AndroidTestTemplate.xml b/tests/cts/net/AndroidTestTemplate.xml
index cb0e57539a..de21efc2ce 100644
--- a/tests/cts/net/AndroidTestTemplate.xml
+++ b/tests/cts/net/AndroidTestTemplate.xml
@@ -47,18 +47,10 @@
         <option name="hidden-api-checks" value="false" />
         <option name="isolated-storage" value="false" />
         <option name="instrumentation-arg" key="test-module-name" value="{MODULE}" />
-        <!-- Test filter that allows test APKs to select which tests they want to run by annotating
-             those tests with an annotation matching the name of the APK.
-
-             This allows us to maintain one AndroidTestTemplate.xml for all CtsNetTestCases*.apk,
-             and have CtsNetTestCases run all tests, but have CtsNetTestCasesMaxTargetSdk31 run only
-             tests that require target SDK 31.
-
-             This relies on the fact that if the class specified in include-annotation exists, then
-             the runner will only run the tests annotated with that annotation, but if it does not,
-             the runner will run all the tests. -->
-        <option name="include-annotation" value="com.android.testutils.filters.{MODULE}" />
         <option name="device-listeners" value="com.android.testutils.ConnectivityDiagnosticsCollector" />
+        <!-- Extra configuration specified in the build rules (.bp). In particular, they may specify
+         include-annotation filters to only run a subset of the test cases. -->
+        {EXTRA_TEST_RUNNER_CONFIGS}
     </test>
     <metrics_collector class="com.android.tradefed.device.metric.FilePullerLogCollector">
         <!-- Pattern matching the fileKey used by ConnectivityDiagnosticsCollector when calling addFileMetric -->

From 72b851928c2f457020608cb6cb629d2dc16fac2c Mon Sep 17 00:00:00 2001
From: Motomu Utsumi <motomuman@google.com>
Date: Thu, 27 Mar 2025 16:38:32 -0700
Subject: [PATCH 110/377] Wait for Wi-Fi validation after reconnect

RestoreDefaultNetwork has been flaky due to delays in Wi-Fi validation
after reconnecting (sometimes exceeding 30 seconds).
RestoreDefaultNetwork fails at the end of all tests. So connectivity
diagnostics does not contain diagnostics for the network that fails to
be validated.
This CL updates some tests to fail if the Wi-Fi network is not
validated within 30 seconds after the reconnect. This ensures that
connectivity diagnostics include the diagnostics for the problematic
network.

Flag: TEST_ONLY
Bug: 361401328
Test: ConnectivityManagerTest
(cherry picked from https://android-review.googlesource.com/q/commit:cd1bd59a1a18b04e71c3137c4e7d506757691c6c)
Merged-In: Ifeadc8b030f0073133df4fca838e64f1b37e735c

Change-Id: Ifeadc8b030f0073133df4fca838e64f1b37e735c
---
 .../net/cts/ConnectivityManagerTest.java      | 37 ++++++++++++-------
 1 file changed, 23 insertions(+), 14 deletions(-)

diff --git a/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java b/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
index 207b2e5206..3a3b256fc9 100644
--- a/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
+++ b/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
@@ -484,7 +484,10 @@ public class ConnectivityManagerTest {
             final TestableNetworkCallback callback =
                     networkCallbackRule.registerDefaultNetworkCallback();
             assertNotNull("Couldn't restore Internet connectivity",
-                    callback.eventuallyExpect(CallbackEntry.AVAILABLE));
+                    callback.eventuallyExpect(CallbackEntry.NETWORK_CAPS_UPDATED,
+                            NETWORK_CALLBACK_TIMEOUT_MS,
+                            entry -> ((CallbackEntry.CapabilitiesChanged) entry)
+                                    .getCaps().hasCapability(NET_CAPABILITY_VALIDATED)));
         });
     }
 
@@ -1172,6 +1175,7 @@ public class ConnectivityManagerTest {
             mCtsNetUtils.restorePrivateDnsSetting();
             // Toggle networks to make sure they are re-validated
             mCtsNetUtils.reconnectWifiIfSupported();
+            ensureWifiIsValidatedIfSupported();
             mCtsNetUtils.reconnectCellIfSupported();
         }
     }
@@ -1418,7 +1422,7 @@ public class ConnectivityManagerTest {
             if (firstIntent != null) mCm.unregisterNetworkCallback(firstIntent);
             if (secondIntent != null) mCm.unregisterNetworkCallback(secondIntent);
             if (receiver != null) mContext.unregisterReceiver(receiver);
-            mCtsNetUtils.ensureWifiConnected();
+            ensureWifiIsValidatedIfSupported();
         }
     }
 
@@ -1516,6 +1520,7 @@ public class ConnectivityManagerTest {
         assumeTrue(mPackageManager.hasSystemFeature(FEATURE_WIFI));
 
         mCtsNetUtils.reconnectWifiAndWaitForConnectivityAction();
+        ensureWifiIsValidatedIfSupported();
     }
 
     /** Verify restricted networks cannot be requested. */
@@ -2407,6 +2412,7 @@ public class ConnectivityManagerTest {
             // Restore the previous state of airplane mode and permissions:
             runShellCommand("cmd connectivity airplane-mode "
                     + (isAirplaneModeEnabled ? "enable" : "disable"));
+            ensureWifiIsValidatedIfSupported();
         }
     }
 
@@ -2836,7 +2842,7 @@ public class ConnectivityManagerTest {
             ConnectivitySettingsManager.setPrivateDnsMode(mContext, curPrivateDnsMode);
             tetherUtils.unregisterTetheringEventCallback(tetherEventCallback);
             tetherUtils.stopAllTethering();
-            mCtsNetUtils.ensureWifiConnected();
+            ensureWifiIsValidatedIfSupported();
         }
     }
 
@@ -3081,6 +3087,12 @@ public class ConnectivityManagerTest {
         }
     }
 
+    private void ensureWifiIsValidatedIfSupported() {
+        if (mPackageManager.hasSystemFeature(FEATURE_WIFI)) {
+            new ConnectUtil(mContext).ensureWifiValidated();
+        }
+    }
+
     @AppModeFull(reason = "WRITE_DEVICE_CONFIG permission can't be granted to instant apps")
     @Test
     public void testAcceptPartialConnectivity_validatedNetwork() throws Exception {
@@ -3102,7 +3114,7 @@ public class ConnectivityManagerTest {
             expectNetworkHasCapability(network, NET_CAPABILITY_VALIDATED, WIFI_CONNECT_TIMEOUT_MS);
         } finally {
             mHttpServer.stop();
-            mTestValidationConfigRule.runAfterNextCleanup(this::reconnectWifi);
+            mTestValidationConfigRule.runAfterNextCleanup(this::reconnectWifiAndEnsureValidated);
         }
     }
 
@@ -3132,7 +3144,7 @@ public class ConnectivityManagerTest {
             // apply here. Thus, turn off wifi first and restart to restore.
             mTestValidationConfigRule.runAfterNextCleanup(() -> {
                 mCtsNetUtils.disableWifi();
-                mCtsNetUtils.ensureWifiConnected();
+                ensureWifiIsValidatedIfSupported();
             });
         }
     }
@@ -3178,7 +3190,7 @@ public class ConnectivityManagerTest {
             // apply here. Thus, turn off wifi first and restart to restore.
             mTestValidationConfigRule.runAfterNextCleanup(() -> {
                 mCtsNetUtils.disableWifi();
-                mCtsNetUtils.ensureWifiConnected();
+                ensureWifiIsValidatedIfSupported();
             });
         }
     }
@@ -3242,7 +3254,7 @@ public class ConnectivityManagerTest {
         } finally {
             resetAvoidBadWifi(previousAvoidBadWifi);
             mHttpServer.stop();
-            mTestValidationConfigRule.runAfterNextCleanup(this::reconnectWifi);
+            mTestValidationConfigRule.runAfterNextCleanup(this::reconnectWifiAndEnsureValidated);
         }
     }
 
@@ -3291,9 +3303,9 @@ public class ConnectivityManagerTest {
         mHttpServer.start();
     }
 
-    private Network reconnectWifi() {
+    private Network reconnectWifiAndEnsureValidated() {
         mCtsNetUtils.ensureWifiDisconnected(null /* wifiNetworkToCheck */);
-        return mCtsNetUtils.ensureWifiConnected();
+        return new ConnectUtil(mContext).ensureWifiValidated();
     }
 
     private Network prepareValidatedNetwork() throws Exception {
@@ -3307,10 +3319,7 @@ public class ConnectivityManagerTest {
         prepareHttpServer();
         configTestServer(Status.NO_CONTENT, Status.NO_CONTENT);
         // Disconnect wifi first then start wifi network with configuration.
-        final Network wifiNetwork = reconnectWifi();
-
-        return expectNetworkHasCapability(wifiNetwork, NET_CAPABILITY_VALIDATED,
-                WIFI_CONNECT_TIMEOUT_MS);
+        return reconnectWifiAndEnsureValidated();
     }
 
     private Network preparePartialConnectivity() throws Exception {
@@ -3387,7 +3396,7 @@ public class ConnectivityManagerTest {
         testAndCleanup(() -> {
             // New default network connected will trigger a network activity notification.
             if (supportWifi) {
-                mCtsNetUtils.ensureWifiConnected();
+                ensureWifiIsValidatedIfSupported();
             } else {
                 networkCallbackRule.requestCell();
             }

From 4eabd39084c2f25dff581a952134295d09ee6d2e Mon Sep 17 00:00:00 2001
From: Junyu Lai <junyulai@google.com>
Date: Mon, 14 Apr 2025 13:56:04 +0800
Subject: [PATCH 111/377] Update TetheringWifiP2pTest to check for tethering
 support

This check is needed for devices which doesn't support tethering,
e.g. wear devices

Flag: TEST_ONLY
Test: lunch cf_gwear_x86-next-userdebug
      atest CtsTetheringTest:android.tethering.cts.TetheringWifiP2pTest#testWifiP2pGoNetworkAgent_networkCallbacks \
      -- --test-arg com.android.testutils.ConnectivityTestTargetPreparer:ignore-mobile-data-check:true
Fix: 408634222
Change-Id: I1b17eec973615f4d934e831de521d7699da7b3fd
---
 .../tethering/cts/TetheringWifiP2pTest.kt      | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/tests/cts/tethering/src/android/tethering/cts/TetheringWifiP2pTest.kt b/tests/cts/tethering/src/android/tethering/cts/TetheringWifiP2pTest.kt
index e7e9fdd9f2..4bb1fddd7e 100644
--- a/tests/cts/tethering/src/android/tethering/cts/TetheringWifiP2pTest.kt
+++ b/tests/cts/tethering/src/android/tethering/cts/TetheringWifiP2pTest.kt
@@ -18,11 +18,13 @@ package android.tethering.cts
 
 import android.Manifest.permission.LOG_COMPAT_CHANGE
 import android.Manifest.permission.READ_COMPAT_CHANGE_CONFIG
+import android.Manifest.permission.TETHER_PRIVILEGED
 import android.app.compat.CompatChanges
 import android.content.pm.PackageManager
 import android.net.NetworkCapabilities.NET_CAPABILITY_LOCAL_NETWORK
 import android.net.NetworkCapabilities.TRANSPORT_WIFI
 import android.net.NetworkRequest
+import android.net.TetheringManager
 import android.net.connectivity.ConnectivityCompatChanges
 import android.os.Build
 import android.provider.DeviceConfig
@@ -65,6 +67,7 @@ class TetheringWifiP2pTest {
 
     private val context = InstrumentationRegistry.getInstrumentation().getTargetContext()
     private val pm = context.packageManager!!
+    private val tm = context.getSystemService(TetheringManager::class.java)
 
     private fun assumeMatchNonThreadLocalNetworksEnabled() {
         assumeTrue(runAsShell<Boolean>(READ_COMPAT_CHANGE_CONFIG, LOG_COMPAT_CHANGE) {
@@ -84,15 +87,18 @@ class TetheringWifiP2pTest {
         assumeMatchNonThreadLocalNetworksEnabled()
         assumeTrue(pm.hasSystemFeature(PackageManager.FEATURE_WIFI))
         assumeTrue(pm.hasSystemFeature(PackageManager.FEATURE_WIFI_DIRECT))
+        // Wifi P2p Group Owner mode still need tethering support in order to get
+        // onLocalOnlyInterfacesChanged callbacks.
+        assumeTrue(runAsShell(TETHER_PRIVILEGED) { tm.isTetheringSupported() })
         deviceConfigRule.setConfig(
-            DeviceConfig.NAMESPACE_TETHERING,
-            TETHERING_LOCAL_NETWORK_AGENT,
-            "1"
+                DeviceConfig.NAMESPACE_TETHERING,
+                TETHERING_LOCAL_NETWORK_AGENT,
+                "1"
         )
         deviceConfigRule.setConfig(
-            DeviceConfig.NAMESPACE_TETHERING,
-            WIFIP2PGO_LOCAL_NETWORK_AGENT,
-            "1"
+                DeviceConfig.NAMESPACE_TETHERING,
+                WIFIP2PGO_LOCAL_NETWORK_AGENT,
+                "1"
         )
 
         val cb = TestableNetworkCallback()

From ea520794cc9e08e227c5b17a54f2bc5dc13b2310 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Mon, 14 Apr 2025 11:32:56 -0700
Subject: [PATCH 112/377] Align UdpPkt with scapy

Renames srcPort to sport and dstPort to dport and generates a random
port number in the range of [1, 65536) if no argument is passed.

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: If446cde9a7ff414f52c60f70458ff046a2c4dc33
---
 .../com/android/testutils/PacketBuilderUtils.kt      | 12 +++++++-----
 tests/integration/src/android/net/ClatTest.kt        |  4 ++--
 2 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
index b0b6f569c7..484e3e104d 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
@@ -28,6 +28,7 @@ import java.net.Inet6Address
 import java.net.InetAddress
 import java.nio.ByteBuffer
 import java.util.EnumSet
+import kotlin.random.Random
 
 class PacketBuilder(outerPacket: Packet, innerPacket: Packet) {
     private data class PacketHolder(
@@ -451,17 +452,18 @@ class DataPkt(data: ByteArray) : Packet {
  * Use the {@link DataPkt} for carrying a payload.
  */
 class UdpPkt(
-        private val srcPort: Short,
-        private val dstPort: Short,
+        private val sport: Short,
+        private val dport: Short,
 ) : Packet {
-    constructor(srcPort: Int, dstPort: Int) : this(srcPort.toShort(), dstPort.toShort())
+    constructor(sport: Int = Random.nextInt(1, 65536), dport: Int = Random.nextInt(1, 65536)) :
+        this(sport.toShort(), dport.toShort())
 
     override fun build(payload: FinalizedPacket?, pseudo: PseudoHeaderPacket?): FinalizedPacket {
         require(pseudo != null)
 
         val udpHeader = ByteBuffer.allocate(8)
-            .putShort(srcPort)
-            .putShort(dstPort)
+            .putShort(sport)
+            .putShort(dport)
             .putShort(0) // length; to be filled in later.
             .putShort(0) // checksum; to be filled in later.
         udpHeader.flip()
diff --git a/tests/integration/src/android/net/ClatTest.kt b/tests/integration/src/android/net/ClatTest.kt
index fb2fad8c5f..e9701d1c1f 100644
--- a/tests/integration/src/android/net/ClatTest.kt
+++ b/tests/integration/src/android/net/ClatTest.kt
@@ -177,7 +177,7 @@ class ClatTest {
 
         val ether = EtherPkt(dst = ROUTER_MAC, src = localMac)
         val ipv6 = Ip6Pkt(src = clatV6Addr.hostAddress!!, dst = "64:ff9b::1.2.3.4", hlim = 64)
-        val udp = UdpPkt(srcPort = localPort, dstPort = 12345)
+        val udp = UdpPkt(sport = localPort, dport = 12345)
         val payload = DataPkt(buf.array())
         val pkt = ether / ipv6 / udp / payload
         expectPacket(pkt.build())
@@ -193,7 +193,7 @@ class ClatTest {
 
         val ether = EtherPkt(dst = localMac, src = ROUTER_MAC)
         val ipv6 = Ip6Pkt(src = "64:ff9b::1.2.3.4", dst = clatV6Addr.hostAddress!!)
-        val udp = UdpPkt(srcPort = 12345, dstPort = localPort)
+        val udp = UdpPkt(sport = 12345, dport = localPort)
         val data = "more test data"
         val payload = DataPkt(data)
         val pkt = ether / ipv6 / udp / payload

From c43cc9636002780147f3dda8b2238feaa957fb0d Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Mon, 14 Apr 2025 12:20:51 -0700
Subject: [PATCH 113/377] Rename lifetime params for brevity

Line breaks make tests harder to read, so this change should help
fitting everything on a single line.

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I286c4398a2f738ab82498b93f9f9344577befeb8
---
 .../android/testutils/PacketBuilderUtils.kt   | 41 ++++++++-----------
 1 file changed, 18 insertions(+), 23 deletions(-)

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
index 484e3e104d..f7dabcdaff 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
@@ -212,13 +212,13 @@ class NaPkt(
  *
  * Default argument values reflect the rfc4861 defaults where applicable.
  *
- * @param routerLft lifetime of the default router in seconds.
+ * @param lft lifetime of the default router in seconds.
  * @param reachableTime The time, in milliseconds, that a node assumes a neighbor is reachable.
  * @param retransTimer The time, in milliseconds, between retransmitted NS messages.
  * @param flags The Router Advertisement flags.
  */
 class RaPkt(
-    private val routerLft: Short,
+    private val lft: Short,
     private val reachableTime: Int,
     private val retransTimer: Int,
     private val flags: EnumSet<RaFlags>,
@@ -226,17 +226,17 @@ class RaPkt(
     /**
      * Convenience constructor accepting flags parameter as String
      *
-     * @param routerLft lifetime of the default router in seconds.
+     * @param lft lifetime of the default router in seconds.
      * @param reachableTime The time, in milliseconds, that a node assumes a neighbor is reachable.
      * @param retransTimer The time, in milliseconds, between retransmitted NS messages.
      * @param flags The Router Advertisement flags as a String; e.g. {@code "MO"}. Defaults to "".
      */
     constructor(
-        routerLft: Short = 1800,
+        lft: Short = 1800,
         reachableTime: Int = 0,
         retransTimer: Int = 0,
         flags: String = "",
-    ) : this(routerLft, reachableTime, retransTimer, enumSetOfFlags<RaFlags>(flags))
+    ) : this(lft, reachableTime, retransTimer, enumSetOfFlags<RaFlags>(flags))
 
     enum class RaFlags(override val value: Int) : Flags {
         /** Managed address configuration: indicates addresses are available via DHCPv6. */
@@ -253,7 +253,7 @@ class RaPkt(
         raHeader.putShort(0) // Checksum = 0 (filled in later)
         raHeader.put(255.toByte()) // Cur Hop Limit
         raHeader.put(flags.toByte())
-        raHeader.putShort(routerLft)
+        raHeader.putShort(lft)
         raHeader.putInt(reachableTime)
         raHeader.putInt(retransTimer)
         raHeader.flip()
@@ -275,14 +275,14 @@ class RaPkt(
      * Add a Prefix Information Option
      *
      * @param prefix The prefix of an IPv6 address.
-     * @param validLft The time, in seconds, that the prefix is valid for on-link determination.
-     * @param preferredLft The time, in seconds, that SLAAC-generated addresses remain preferred.
+     * @param valid The time, in seconds, that the prefix is valid for on-link determination.
+     * @param preferred The time, in seconds, that SLAAC-generated addresses remain preferred.
      * @param flags The Prefix Information Option flags.
      */
     fun addPioOption(
             prefix: IpPrefix,
-            validLft: Int,
-            preferredLft: Int,
+            valid: Int,
+            preferred: Int,
             flags: EnumSet<PioFlags>,
     ): RaPkt {
         if (!prefix.isIPv6()) throw IllegalArgumentException("Invalid prefix")
@@ -291,8 +291,8 @@ class RaPkt(
         pio.put(4) // Length = 4 (*8)
         pio.put(prefix.prefixLength.toByte()) // Prefix Length
         pio.put(flags.toByte()) // Flags
-        pio.putInt(validLft) // Valid Lifetime
-        pio.putInt(preferredLft) // Preferred Lifetime
+        pio.putInt(valid) // Valid Lifetime
+        pio.putInt(preferred) // Preferred Lifetime
         pio.putInt(0) // Reserved2
         pio.put(prefix.rawAddress)
         pio.flip()
@@ -304,22 +304,17 @@ class RaPkt(
      * Add a Prefix Information Option
      *
      * @param prefix The IPv6 prefix as a String; e.g. {@code "2001:db8::/64"}
-     * @param validLft The time, in seconds, that the prefix is valid for on-link determination.
-     * @param preferredLft The time, in seconds, that SLAAC-generated addresses remain preferred.
+     * @param valid The time, in seconds, that the prefix is valid for on-link determination.
+     * @param preferred The time, in seconds, that SLAAC-generated addresses remain preferred.
      * @param flags The PIO flags as a String; e.g. {@code "LA"}
      */
     fun addPioOption(
             prefix: String,
-            validLft: Int = 2592000,
-            preferredLft: Int = 604800,
+            valid: Int = 2592000,
+            preferred: Int = 604800,
             flags: String = "L",
     ): RaPkt {
-        return addPioOption(
-                IpPrefix(prefix),
-                validLft,
-                preferredLft,
-                enumSetOfFlags<PioFlags>(flags)
-        )
+        return addPioOption(IpPrefix(prefix), valid, preferred, enumSetOfFlags<PioFlags>(flags))
     }
 
     /** Add a Recursive DNS Server Option
@@ -621,7 +616,7 @@ class Ip4Pkt(
  * {@code
  * val ether = EtherPkt(src = "1:2:3:4:5:6", dst = "1:1:1:1:1:1")
  * val ipv6 = Ip6Pkt(src = "fe80::1", dst = "fe80::2")
- * val ra = RaPkt(routerLft = 50, reachableTime = 100, flags = "O")
+ * val ra = RaPkt(lft = 50, reachableTime = 100, flags = "O")
  *         .addPioOption(prefix = "2001:db8::1/64", flags = "LA")
  * val p = ether / ipv6 / ra
  * val bytes = p.bytes

From db7d961fb3ded95a29c413f32d03da8dda8a7e3a Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Mon, 14 Apr 2025 13:11:30 -0700
Subject: [PATCH 114/377] Use HexDump instead of Kotlin Experimental API

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I5d0e4989194eecc90e00b1903f8458d9df098ff4
---
 .../devicetests/com/android/testutils/PacketBuilderUtils.kt  | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
index f7dabcdaff..41f43e84f9 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
@@ -21,6 +21,7 @@ package com.android.testutils
 
 import android.net.IpPrefix
 import android.net.MacAddress
+import com.android.internal.util.HexDump
 import com.android.net.module.util.IpUtils
 import java.io.ByteArrayOutputStream
 import java.net.Inet4Address
@@ -68,10 +69,8 @@ class PacketBuilder(outerPacket: Packet, innerPacket: Packet) {
         return payload!!.bytes
     }
 
-    // For ByteArray.toHexString
-    @kotlin.ExperimentalStdlibApi
     override fun toString(): String {
-        return build().toHexString()
+        return HexDump.toHexString(build())
     }
 }
 

From ea0364b5d42133a2a8abba8dceab3a3c2cbfa74d Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Mon, 14 Apr 2025 14:40:31 -0700
Subject: [PATCH 115/377] Add SLLAO support to RaPkt

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I1c0050ca1b634dfa7b2ac5de551a2470e06a9791
---
 .../android/testutils/PacketBuilderUtils.kt   | 20 +++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
index 41f43e84f9..b386f48c9e 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
@@ -409,6 +409,26 @@ class RaPkt(
         return addPref64Option(IpPrefix(prefix), lft)
     }
 
+    /** Add Source Link-Layer Address Option */
+    fun addSllaOption(lla: MacAddress): RaPkt {
+        val llao = ByteBuffer.allocate(8)
+        llao.put(1) // Type = 1 (Source Link-layer Address)
+        llao.put(1) // Length in units of 8 octets
+        llao.put(lla.toByteArray())
+        llao.flip()
+        outputStream.write(llao.array())
+        return this
+    }
+
+    /**
+     * Add Source Link-Layer Address Option
+     *
+     * @param lla Link-Layer Address as a String; e.g. {@code "0:0:5e:0:53:0"}
+     */
+    fun addSllaOption(lla: String): RaPkt {
+        return addSllaOption(MacAddress.fromString(lla))
+    }
+
     override fun build(payload: FinalizedPacket?, pseudo: PseudoHeaderPacket?): FinalizedPacket {
         require(payload == null)
         require(pseudo != null)

From 3fa3ca8e5bbcd61764d38f9730e9f47bb7ed5073 Mon Sep 17 00:00:00 2001
From: Yang Sun <sunytt@google.com>
Date: Tue, 15 Apr 2025 09:39:15 +0000
Subject: [PATCH 116/377] Add unit test for
 ThreadNetworkControllerService#SetEnabled

Bug: 321853291
Test: atest ThreadNetworkUnitTests
Flag: TEST_ONLY

Change-Id: Ifa74a629a20c87bf45d3d3e0693033d8e28b4e8f
---
 .../ThreadNetworkControllerServiceTest.java   | 37 +++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/thread/tests/unit/src/com/android/server/thread/ThreadNetworkControllerServiceTest.java b/thread/tests/unit/src/com/android/server/thread/ThreadNetworkControllerServiceTest.java
index a73390c670..51f20e15d6 100644
--- a/thread/tests/unit/src/com/android/server/thread/ThreadNetworkControllerServiceTest.java
+++ b/thread/tests/unit/src/com/android/server/thread/ThreadNetworkControllerServiceTest.java
@@ -652,6 +652,43 @@ public final class ThreadNetworkControllerServiceTest {
         assertThat(failure.getErrorCode()).isEqualTo(ERROR_FAILED_PRECONDITION);
     }
 
+    @Test
+    public void setEnabled_success_threadNetworkEnabled() throws Exception {
+        mService.initialize();
+
+        CompletableFuture<Void> setEnabledFuture = new CompletableFuture<>();
+        mService.setEnabled(true, newOperationReceiver(setEnabledFuture));
+        mTestLooper.dispatchAll();
+
+        assertThat(mFakeOtDaemon.getEnabledState()).isEqualTo(STATE_ENABLED);
+    }
+
+    @Test
+    public void setDisabled_success_threadNetworkDisabled() throws Exception {
+        mService.initialize();
+
+        CompletableFuture<Void> setEnabledFuture = new CompletableFuture<>();
+        mService.setEnabled(false, newOperationReceiver(setEnabledFuture));
+        mTestLooper.dispatchAll();
+
+        assertThat(mFakeOtDaemon.getEnabledState()).isEqualTo(STATE_DISABLED);
+    }
+
+    @Test
+    public void setEnabled_otDaemonRemoteFailure_returnsInternalError() throws Exception {
+        mService.initialize();
+        CompletableFuture<Void> setEnabledFuture = new CompletableFuture<>();
+        mFakeOtDaemon.setSetEnabledException(
+                new RemoteException("ot-daemon setThreadEnabled() throws"));
+
+        mService.setEnabled(true, newOperationReceiver(setEnabledFuture));
+        mTestLooper.dispatchAll();
+
+        var thrown = assertThrows(ExecutionException.class, () -> setEnabledFuture.get());
+        ThreadNetworkException failure = (ThreadNetworkException) thrown.getCause();
+        assertThat(failure.getErrorCode()).isEqualTo(ERROR_INTERNAL_ERROR);
+    }
+
     private AtomicReference<BroadcastReceiver> captureBroadcastReceiver(String action) {
         AtomicReference<BroadcastReceiver> receiverRef = new AtomicReference<>();
 

From 97ae103e4e1be878ba20a3fbc9f875360c745418 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Tue, 15 Apr 2025 09:37:34 -0700
Subject: [PATCH 117/377] Wait for the clat interface to be created

Clat interface creation is not always part of the second
LinkPropertiesChanged callback. This change processes
LinkPropertiesChanged callbacks until the clat interface has been
created, or no more LinkPropertiesChanged callbacks are received.

Test: atest ClatTest
Flag: EXEMPT mainline
Bug: 410685868
Change-Id: I8ff2dd95efef8dab9dfde99a1617895317c728d5
---
 tests/integration/src/android/net/ClatTest.kt | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/tests/integration/src/android/net/ClatTest.kt b/tests/integration/src/android/net/ClatTest.kt
index e9701d1c1f..c7754f8b75 100644
--- a/tests/integration/src/android/net/ClatTest.kt
+++ b/tests/integration/src/android/net/ClatTest.kt
@@ -124,13 +124,17 @@ class ClatTest {
     @Before
     fun setUp() {
         val cb = requestNetwork(REQUEST)
-        // b/233534110: eventuallyExpect<LinkPropertiesChanged>() does not advance ReadHead, use
-        // eventuallyExpect(LinkProperties::class) instead.
-        cb.eventuallyExpect(LinkPropertiesChanged::class)
-        val linkPropertiesChanged = cb.eventuallyExpect(LinkPropertiesChanged::class)
+
+        // Wait for the clat interface to be created.
+        var linkPropertiesChanged: LinkPropertiesChanged
+        do {
+            // b/233534110: eventuallyExpect<LinkPropertiesChanged>() does not advance ReadHead, use
+            // eventuallyExpect(LinkProperties::class) instead.
+            linkPropertiesChanged = cb.eventuallyExpect(LinkPropertiesChanged::class)
+        } while (linkPropertiesChanged.lp.stackedLinks.isEmpty())
+
         network = linkPropertiesChanged.network
         lp = linkPropertiesChanged.lp
-        assertThat(lp.getStackedLinks()).isNotEmpty()
 
         clatV6Addr = ProcfsParsingUtils.getAnycast6Addresses(iface.name).get(0)
     }

From 5ed47754aabed2c54b42a7f37febd244a139f3f6 Mon Sep 17 00:00:00 2001
From: Richard Uhler <ruhler@google.com>
Date: Wed, 2 Apr 2025 15:50:10 -0700
Subject: [PATCH 118/377] Avoid excessive allocation churn in network stats.

Getting the network stats required making 3 full copies of all the
network stats since boot. Reorganize the code so we only have to
allocate incremental network stats objects.

Flag: EXEMPT bugfix
Bug: 399154099
Test: atest ConnectivityCoverageTests
Test: atest NetworkStatsIntegrationTest
Change-Id: Id531c4ffd6e0d127b8aaac38bda6a89a3d700c64
---
 framework-t/src/android/net/NetworkStats.java | 48 +++++++++++++++--
 .../server/net/NetworkStatsFactory.java       | 51 +++++++------------
 2 files changed, 63 insertions(+), 36 deletions(-)

diff --git a/framework-t/src/android/net/NetworkStats.java b/framework-t/src/android/net/NetworkStats.java
index a2c4fc374e..5b7dddb454 100644
--- a/framework-t/src/android/net/NetworkStats.java
+++ b/framework-t/src/android/net/NetworkStats.java
@@ -494,6 +494,21 @@ public final class NetworkStats implements Parcelable, Iterable<NetworkStats.Ent
             return this;
         }
 
+        /**
+         * Checks if this entry matches the given filter parameters.
+         * @param uid UID to filter for, or {@link #UID_ALL}.
+         * @param ifaces Interfaces to filter for, or {@link #INTERFACES_ALL}.
+         * @param tag Tag to filter for, or {@link #TAG_ALL}.
+         *
+         * @return true if this entry matches the given filter parameters.
+         * @hide
+         */
+        public boolean matches(int uid, String[] ifaces, int tag) {
+            return (uid == UID_ALL || uid == this.uid)
+                && (tag == TAG_ALL || tag == this.tag)
+                && (ifaces == INTERFACES_ALL || CollectionUtils.contains(ifaces, this.iface));
+        }
+
         @Override
         public String toString() {
             final StringBuilder builder = new StringBuilder();
@@ -1379,10 +1394,7 @@ public final class NetworkStats implements Parcelable, Iterable<NetworkStats.Ent
         if (limitUid == UID_ALL && limitTag == TAG_ALL && limitIfaces == INTERFACES_ALL) {
             return;
         }
-        filter(e -> (limitUid == UID_ALL || limitUid == e.uid)
-                && (limitTag == TAG_ALL || limitTag == e.tag)
-                && (limitIfaces == INTERFACES_ALL
-                    || CollectionUtils.contains(limitIfaces, e.iface)));
+        filter(e -> e.matches(limitUid, limitIfaces, limitTag));
     }
 
     /**
@@ -1410,6 +1422,34 @@ public final class NetworkStats implements Parcelable, Iterable<NetworkStats.Ent
         size = nextOutputEntry;
     }
 
+    /**
+     * Make a filtered copy of the network stats.
+     *
+     * @param limitUid UID to filter for, or {@link #UID_ALL}.
+     * @param limitIfaces Interfaces to filter for, or {@link #INTERFACES_ALL}.
+     * @param limitTag Tag to filter for, or {@link #TAG_ALL}.
+     * @hide
+     */
+    public NetworkStats filteredClone(int limitUid, String[] limitIfaces, int limitTag) {
+        NetworkStats.Entry e = null;
+        int filteredSize = 0;
+        for (int i = 0; i < size; i++) {
+            e = getValues(i, e);
+            if (e.matches(limitUid, limitIfaces, limitTag)) {
+                filteredSize++;
+            }
+        }
+
+        final NetworkStats clone = new NetworkStats(elapsedRealtime, filteredSize);
+        for (int i = 0; i < size; i++) {
+            e = getValues(i, e);
+            if (e.matches(limitUid, limitIfaces, limitTag)) {
+                clone.insertEntry(e);
+            }
+        }
+        return clone;
+    }
+
     /** @hide */
     public void dump(String prefix, PrintWriter pw) {
         pw.print(prefix);
diff --git a/service-t/src/com/android/server/net/NetworkStatsFactory.java b/service-t/src/com/android/server/net/NetworkStatsFactory.java
index c5a69c0551..7d48b71d75 100644
--- a/service-t/src/com/android/server/net/NetworkStatsFactory.java
+++ b/service-t/src/com/android/server/net/NetworkStatsFactory.java
@@ -252,8 +252,6 @@ public class NetworkStatsFactory {
         synchronized (mPersistentDataLock) {
             // Take a reference. If this gets swapped out, we still have the old reference.
             final UnderlyingNetworkInfo[] vpnArray = mUnderlyingNetworkInfos;
-            // Take a defensive copy. mPersistSnapshot is mutated in some cases below
-            final NetworkStats prev = mPersistSnapshot.clone();
 
             requestSwapActiveStatsMapLocked();
             // Stats are always read from the inactive map, so they must be read after the
@@ -266,11 +264,27 @@ public class NetworkStatsFactory {
             mPersistSnapshot.setElapsedRealtime(diff.getElapsedRealtime());
             mPersistSnapshot.combineAllValues(filteredDiff);
 
-            NetworkStats adjustedStats = adjustForTunAnd464Xlat(mPersistSnapshot, prev, vpnArray);
+            // Update the stats adjusted for TunAnd464Xlat
+            // Apply 464xlat adjustments before VPN adjustments. If VPNs are using v4 on a v6 only
+            // network, the overhead is their fault.
+            // No locking here: apply464xlatAdjustments behaves fine with an add-only
+            // ConcurrentHashMap.
+            filteredDiff.apply464xlatAdjustments(mStackedIfaces);
+
+            // Migrate data usage over a VPN to the TUN network.
+            for (UnderlyingNetworkInfo info : vpnArray) {
+                filteredDiff.migrateTun(info.getOwnerUid(), info.getInterface(),
+                        info.getUnderlyingInterfaces());
+                // Filter out debug entries as that may lead to over counting.
+                filteredDiff.filterDebugEntries();
+            }
+
+            // Update mTunAnd464xlatAdjustedStats with migrated stats.
+            mTunAnd464xlatAdjustedStats.combineAllValues(filteredDiff);
+            mTunAnd464xlatAdjustedStats.setElapsedRealtime(filteredDiff.getElapsedRealtime());
 
             // Filter return values
-            adjustedStats.filter(limitUid, limitIfaces, limitTag);
-            return adjustedStats;
+            return mTunAnd464xlatAdjustedStats.filteredClone(limitUid, limitIfaces, limitTag);
         }
     }
 
@@ -309,33 +323,6 @@ public class NetworkStatsFactory {
         return filteredStats;
     }
 
-    @GuardedBy("mPersistentDataLock")
-    private NetworkStats adjustForTunAnd464Xlat(NetworkStats uidDetailStats,
-            NetworkStats previousStats, UnderlyingNetworkInfo[] vpnArray) {
-        // Calculate delta from last snapshot
-        final NetworkStats delta = uidDetailStats.subtract(previousStats);
-
-        // Apply 464xlat adjustments before VPN adjustments. If VPNs are using v4 on a v6 only
-        // network, the overhead is their fault.
-        // No locking here: apply464xlatAdjustments behaves fine with an add-only
-        // ConcurrentHashMap.
-        delta.apply464xlatAdjustments(mStackedIfaces);
-
-        // Migrate data usage over a VPN to the TUN network.
-        for (UnderlyingNetworkInfo info : vpnArray) {
-            delta.migrateTun(info.getOwnerUid(), info.getInterface(),
-                    info.getUnderlyingInterfaces());
-            // Filter out debug entries as that may lead to over counting.
-            delta.filterDebugEntries();
-        }
-
-        // Update mTunAnd464xlatAdjustedStats with migrated delta.
-        mTunAnd464xlatAdjustedStats.combineAllValues(delta);
-        mTunAnd464xlatAdjustedStats.setElapsedRealtime(uidDetailStats.getElapsedRealtime());
-
-        return mTunAnd464xlatAdjustedStats.clone();
-    }
-
     /**
      * Remove stats from {@code mPersistSnapshot} and {@code mTunAnd464xlatAdjustedStats} for the
      * given uids.

From a627d77127895ccdef0db025e45992b0eb004e87 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Tue, 15 Apr 2025 13:48:19 -0700
Subject: [PATCH 119/377] NetBpfLoad: remove dead code
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This code requires
  !isArm()
  isUserspace32bit()
  isAtLeastKernelVersion(6, 7, 0)
which implies
  isAtLeastKernelVersion(6, 2, 0)
meaning we match the condition in 1801,
and don't match the isArm() conditions in 1803/1806/1810,
thus we'd have already 'returned 1' in line 1815.

Test: TreeHugger
Flag: EXEMPT mainline
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I234ba91b9bdbfeaf1077eac64248d3ebfe2f2cd2
---
 bpf/loader/NetBpfLoad.cpp | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/bpf/loader/NetBpfLoad.cpp b/bpf/loader/NetBpfLoad.cpp
index 2d8f783365..71d85db0ab 100644
--- a/bpf/loader/NetBpfLoad.cpp
+++ b/bpf/loader/NetBpfLoad.cpp
@@ -1816,12 +1816,6 @@ static int doLoad(char** argv, char * const envp[]) {
         }
     }
 
-    // On handheld, 6.6 is highest version supported by Android V (sdk=35), so this is for sdk=36+
-    if (!isArm() && isUserspace32bit() && isAtLeastKernelVersion(6, 7, 0)) {
-        ALOGE("64-bit userspace required on 6.7+ kernels.");
-        return 1;
-    }
-
     if (isAtLeast25Q2) {
         FILE * f = fopen("/system/etc/init/netbpfload.rc", "re");
         if (!f) {

From 788ce2fa378f1e60bc543be3b8d23717d077cd68 Mon Sep 17 00:00:00 2001
From: Motomu Utsumi <motomuman@google.com>
Date: Wed, 16 Apr 2025 08:54:34 +0900
Subject: [PATCH 120/377] Build net-tests-utils-host-device-common with
 module_current

Allow module with "sdk_version: module_current" to depend on
net-tests-utils-host-device-common.
This CL also makes this module visible to cronet

Bug: 311792075
Test: TH
Flag: EXEMPT Android.bp sdk_version and visibility change
Change-Id: I3b1068e12d4abbd34006aae69bbd314fcf05d060
---
 staticlibs/testutils/Android.bp | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/staticlibs/testutils/Android.bp b/staticlibs/testutils/Android.bp
index b59ccc6292..e2b46310a4 100644
--- a/staticlibs/testutils/Android.bp
+++ b/staticlibs/testutils/Android.bp
@@ -60,10 +60,12 @@ java_library {
         "hostdevice/**/*.kt",
     ],
     host_supported: true,
+    sdk_version: "module_current",
     visibility: [
         "//packages/modules/Connectivity/staticlibs/tests:__subpackages__",
         "//packages/modules/Connectivity/staticlibs/client-libs/tests:__subpackages__",
         "//packages/modules/Connectivity/tests/cts/hostside",
+        "//external/cronet:__subpackages__",
     ],
     // There are downstream branches using an old version of Kotlin
     // that used to reserve the right to make breaking changes to the

From 9bd526d7d41ee2d8ff7cdd247b914df5df6710ee Mon Sep 17 00:00:00 2001
From: Quang Anh Luong <qal@google.com>
Date: Mon, 14 Apr 2025 16:33:02 +0900
Subject: [PATCH 121/377] Fix carrier privilege race condition

CarrierConfigRule cleanup does not wait for carrier privilege value
to change before continuing to the next test, which may cause test
failures if the value isn't fully reset on time.

Make sure the value has time to properly be reset by waiting for
onCarrierPrivilegesChanged before proceeding.

Flag: EXEMPT test only change.

Bug: 409710349
Test: atest TetheringManagerTest#testCarrierPrivilegedIsTetheringSupported TetheringManagerTest#testCarrierPrivilegedStopTetheringWifiWithConfigSucceeds

Change-Id: If67884514a2c1678834ab9ff67947e75e37db0a7
---
 .../android/testutils/CarrierConfigRule.kt    | 70 +++++++++++++++----
 1 file changed, 55 insertions(+), 15 deletions(-)

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/CarrierConfigRule.kt b/staticlibs/testutils/devicetests/com/android/testutils/CarrierConfigRule.kt
index 0d70d24e3d..d9803999ba 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/CarrierConfigRule.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/CarrierConfigRule.kt
@@ -36,11 +36,11 @@ import android.telephony.TelephonyManager.CarrierPrivilegesCallback
 import android.util.Log
 import androidx.test.platform.app.InstrumentationRegistry
 import com.android.modules.utils.build.SdkLevel
+import com.android.net.module.util.ArrayTrackRecord
 import com.android.testutils.runAsShell
 import com.android.testutils.runCommandInShell
 import com.android.testutils.tryTest
 import java.security.MessageDigest
-import kotlin.test.assertEquals
 import kotlin.test.assertNotNull
 import kotlin.test.assertTrue
 import org.junit.rules.TestRule
@@ -66,6 +66,9 @@ class CarrierConfigRule : TestRule {
     // Map of (subId) -> (original values of overridden settings)
     private val originalConfigs = mutableMapOf<Int, PersistableBundle>()
 
+    // Map of (subId) -> (original values of carrier privilege)
+    private val originalCarrierPrivileges = mutableMapOf<Int, Boolean>()
+
     // Map of (subId) -> (original values of carrier service package)
     private val originalCarrierServicePackages = mutableMapOf<Int, String?>()
 
@@ -176,8 +179,7 @@ class CarrierConfigRule : TestRule {
 
         val tm = context.getSystemService(TelephonyManager::class.java)!!
 
-        val cv = ConditionVariable()
-        val cpb = PrivilegeWaiterCallback(cv)
+        val cpb = PrivilegeWaiterCallback()
         // The lambda below is capturing |cpb|, whose type inherits from a class that appeared in
         // T. This means the lambda will compile as a private method of this class taking a
         // PrivilegeWaiterCallback argument. As JUnit uses reflection to enumerate all methods
@@ -189,10 +191,8 @@ class CarrierConfigRule : TestRule {
             runAsShell(READ_PRIVILEGED_PHONE_STATE) @JvmSerializableLambda {
                 tm.registerCarrierPrivilegesCallback(slotIndex, { it.run() }, cpb)
             }
-            // Wait for the callback to be registered
-            assertTrue(cv.block(CARRIER_CONFIG_CHANGE_TIMEOUT_MS),
-                "Can't register CarrierPrivilegesCallback")
-            if (cpb.hasPrivilege == hold) {
+            val currentPrivilege = cpb.expectCarrierPrivilegesChanged()
+            if (currentPrivilege == hold) {
                 if (hold) {
                     Log.w(TAG, "Package ${context.opPackageName} already is privileged")
                 } else {
@@ -200,7 +200,9 @@ class CarrierConfigRule : TestRule {
                 }
                 return@tryTest
             }
-            cv.close()
+            if (!originalCarrierPrivileges.contains(subId)) {
+                originalCarrierPrivileges.put(subId, currentPrivilege)
+            }
             if (hold) {
                 addConfigOverrides(subId, PersistableBundle().also {
                     it.putStringArray(CarrierConfigManager.KEY_CARRIER_CERTIFICATE_STRING_ARRAY,
@@ -209,9 +211,7 @@ class CarrierConfigRule : TestRule {
             } else {
                 cleanUpNow()
             }
-            assertTrue(cv.block(CARRIER_CONFIG_CHANGE_TIMEOUT_MS),
-                "Timed out waiting for CarrierPrivilegesCallback")
-            assertEquals(cpb.hasPrivilege, hold, "Couldn't set carrier privilege")
+            cpb.eventuallyExpectCarrierPrivilegesChanged(hold)
         } cleanup @JvmSerializableLambda {
             runAsShell(READ_PRIVILEGED_PHONE_STATE) @JvmSerializableLambda {
                 tm.unregisterCarrierPrivilegesCallback(cpb)
@@ -301,12 +301,25 @@ class CarrierConfigRule : TestRule {
         }
     }
 
-    private class PrivilegeWaiterCallback(private val cv: ConditionVariable) :
+    private class PrivilegeWaiterCallback() :
         CarrierPrivilegesCallback {
-        var hasPrivilege = false
+        private val history = ArrayTrackRecord<Boolean>().ReadHead()
         override fun onCarrierPrivilegesChanged(p: MutableSet<String>, uids: MutableSet<Int>) {
-            hasPrivilege = uids.contains(Process.myUid())
-            cv.open()
+            history.add(uids.contains(Process.myUid()))
+        }
+
+        fun expectCarrierPrivilegesChanged(): Boolean {
+            val result = history.poll(CARRIER_CONFIG_CHANGE_TIMEOUT_MS)
+            assertNotNull(result, "onCarrierPrivilegesChanged not received!")
+            return result
+        }
+
+        fun eventuallyExpectCarrierPrivilegesChanged(privileged: Boolean) {
+            val result = history.poll(
+                CARRIER_CONFIG_CHANGE_TIMEOUT_MS,
+                { it == privileged }
+            )
+            assertNotNull(result, "Carrier privilege did not change to $privileged!")
         }
     }
 
@@ -340,6 +353,33 @@ class CarrierConfigRule : TestRule {
             }
             originalConfigs.clear()
         }
+
+        // Carrier privilege status may not be reset yet even after receiving
+        // ACTION_CARRIER_CONFIG_CHANGED, so make sure to also wait for
+        // CarrierPrivilegesCallback before proceeding.
+        val tm = context.getSystemService(TelephonyManager::class.java)!!
+        originalCarrierPrivileges.forEach { (subId, privileged) ->
+            val cpb = PrivilegeWaiterCallback()
+            // The lambda below is capturing |cpb|, whose type inherits from a class that appeared in
+            // T. This means the lambda will compile as a private method of this class taking a
+            // PrivilegeWaiterCallback argument. As JUnit uses reflection to enumerate all methods
+            // including private methods, this would fail with a link error when running on S-.
+            // To solve this, make the lambda serializable, which causes the compiler to emit a
+            // synthetic class instead of a synthetic method.
+            tryTest @JvmSerializableLambda {
+                val slotIndex = SubscriptionManager.getSlotIndex(subId)!!
+                runAsShell(READ_PRIVILEGED_PHONE_STATE) @JvmSerializableLambda {
+                    tm.registerCarrierPrivilegesCallback(slotIndex, { it.run() }, cpb)
+                }
+                cpb.eventuallyExpectCarrierPrivilegesChanged(privileged)
+            } cleanup @JvmSerializableLambda {
+                runAsShell(READ_PRIVILEGED_PHONE_STATE) @JvmSerializableLambda {
+                    tm.unregisterCarrierPrivilegesCallback(cpb)
+                }
+            }
+            originalCarrierPrivileges.clear()
+        }
+
         originalCarrierServicePackages.forEach { (subId, pkg) ->
             setCarrierServicePackageOverride(subId, pkg)
         }

From 90c80840d8916ab7f591bd2c0e1b0e65839bcb5e Mon Sep 17 00:00:00 2001
From: Junyu Lai <junyulai@google.com>
Date: Mon, 10 Mar 2025 17:12:24 +0800
Subject: [PATCH 122/377] Test Tethering/NetworkStack package existence for
 SYSTEM and FULL users.

Follow-up from aosp/3405539, it is possible that OEMs do not
install Tethering/NetworkStack for certain user types.
This is undesirable. Therefore, enforce this with CTS test cases.

Flag: TEST_ONLY
Test: m CtsTetheringTest && atest \
      CtsTetheringTest:android.tethering.test.TetheringManagerTest
Fix: 400836850

Change-Id: I176d4930040d288846bde43beda9e30519ecd513
---
 tests/cts/tethering/Android.bp                |  1 +
 tests/cts/tethering/AndroidTestTemplate.xml   | 14 ++++++
 .../tethering/cts/TetheringManagerTest.java   | 49 ++++++++++++++++++-
 3 files changed, 62 insertions(+), 2 deletions(-)

diff --git a/tests/cts/tethering/Android.bp b/tests/cts/tethering/Android.bp
index 38042851a3..fffc3c7ccd 100644
--- a/tests/cts/tethering/Android.bp
+++ b/tests/cts/tethering/Android.bp
@@ -35,6 +35,7 @@ java_defaults {
 
     static_libs: [
         "ConnectivityWifiP2pMultiDevicesSnippetLib",
+        "Harrier",
         "TetheringCommonTests",
         "com.android.net.flags-aconfig-java",
         "compatibility-device-util-axt",
diff --git a/tests/cts/tethering/AndroidTestTemplate.xml b/tests/cts/tethering/AndroidTestTemplate.xml
index 0f2e72caca..215565423b 100644
--- a/tests/cts/tethering/AndroidTestTemplate.xml
+++ b/tests/cts/tethering/AndroidTestTemplate.xml
@@ -17,8 +17,16 @@
     <option name="test-suite-tag" value="cts" />
     <option name="config-descriptor:metadata" key="component" value="networking" />
     <option name="config-descriptor:metadata" key="token" value="SIM_CARD" />
+    <!-- The 'run_on_secondary_user' parameter triggers a second test iteration
+         targeting secondary users. This is only applicable to tests explicitly marked
+         with @UserTest(UserType.SECONDARY_USER) or @RequireRunOnSecondaryUser.
+    -->
+    <option name="config-descriptor:metadata" key="parameter" value="run_on_secondary_user" />
     <option name="config-descriptor:metadata" key="parameter" value="not_instant_app" />
     <option name="config-descriptor:metadata" key="parameter" value="not_multi_abi" />
+    <!-- '[not_]secondary_user' is mandatory to declare the tests could [not] be run on
+         the secondary user. See CtsConfigLoadingTest#testConfigurationLoad.
+    -->
     <option name="config-descriptor:metadata" key="parameter" value="secondary_user" />
     <option name="config-descriptor:metadata" key="mainline-param" value="CaptivePortalLoginGoogle.apk+NetworkStackGoogle.apk+com.google.android.resolv.apex+com.google.android.tethering.apex" />
     <option name="not-shardable" value="true" />
@@ -31,6 +39,12 @@
     <test class="com.android.tradefed.testtype.AndroidJUnitTest" >
         <option name="package" value="android.tethering.cts" />
         <option name="device-listeners" value="com.android.testutils.ConnectivityDiagnosticsCollector" />
+        <!-- Tests with these annotations should only be ran with their corresponding
+             configurations, e.g. Tests with the RequireRunOnWorkProfile annotation should be
+             ran with the run_on_work_profile configuration. Exclude these tests from running
+             with the normal configuration. See go/bedstead-devicestate#androidtestxml
+        -->
+        <option name="exclude-annotation" value="com.android.bedstead.multiuser.annotations.RequireRunOnSecondaryUser" />
     </test>
     <metrics_collector class="com.android.tradefed.device.metric.FilePullerLogCollector">
         <!-- Pattern matching the fileKey used by ConnectivityDiagnosticsCollector when calling addFileMetric -->
diff --git a/tests/cts/tethering/src/android/tethering/cts/TetheringManagerTest.java b/tests/cts/tethering/src/android/tethering/cts/TetheringManagerTest.java
index d9a0ef0748..006eafd8b9 100644
--- a/tests/cts/tethering/src/android/tethering/cts/TetheringManagerTest.java
+++ b/tests/cts/tethering/src/android/tethering/cts/TetheringManagerTest.java
@@ -15,10 +15,14 @@
  */
 package android.tethering.test;
 
+import static android.Manifest.permission.CREATE_USERS;
+import static android.Manifest.permission.INTERACT_ACROSS_USERS;
 import static android.Manifest.permission.MODIFY_PHONE_STATE;
 import static android.Manifest.permission.TETHER_PRIVILEGED;
 import static android.Manifest.permission.WRITE_SETTINGS;
+import static android.app.ActivityManager.getCurrentUser;
 import static android.content.pm.PackageManager.FEATURE_TELEPHONY;
+import static android.content.pm.PackageManager.MATCH_SYSTEM_ONLY;
 import static android.net.NetworkCapabilities.NET_CAPABILITY_DUN;
 import static android.net.NetworkCapabilities.NET_CAPABILITY_INTERNET;
 import static android.net.NetworkCapabilities.TRANSPORT_CELLULAR;
@@ -58,6 +62,7 @@ import android.content.Context;
 import android.content.Intent;
 import android.content.IntentFilter;
 import android.content.pm.PackageManager;
+import android.content.pm.ResolveInfo;
 import android.net.ConnectivityManager;
 import android.net.LinkAddress;
 import android.net.Network;
@@ -79,14 +84,18 @@ import android.os.Build;
 import android.os.Bundle;
 import android.os.PersistableBundle;
 import android.os.ResultReceiver;
+import android.os.UserHandle;
 import android.telephony.CarrierConfigManager;
 import android.telephony.SubscriptionManager;
 import android.telephony.TelephonyManager;
 
 import androidx.annotation.NonNull;
 import androidx.test.InstrumentationRegistry;
-import androidx.test.runner.AndroidJUnit4;
 
+import com.android.bedstead.harrier.BedsteadJUnit4;
+import com.android.bedstead.harrier.DeviceState;
+import com.android.bedstead.harrier.UserType;
+import com.android.bedstead.harrier.annotations.UserTest;
 import com.android.modules.utils.build.SdkLevel;
 import com.android.testutils.ConnectivityDiagnosticsCollector;
 import com.android.testutils.ParcelUtils;
@@ -94,6 +103,7 @@ import com.android.testutils.com.android.testutils.CarrierConfigRule;
 
 import org.junit.After;
 import org.junit.Before;
+import org.junit.ClassRule;
 import org.junit.Rule;
 import org.junit.Test;
 import org.junit.runner.RunWith;
@@ -102,15 +112,19 @@ import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
+import java.util.Objects;
 import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.LinkedBlockingQueue;
 import java.util.concurrent.TimeUnit;
 import java.util.function.Consumer;
 
-@RunWith(AndroidJUnit4.class)
+@RunWith(BedsteadJUnit4.class)
 public class TetheringManagerTest {
     @Rule
     public final CarrierConfigRule mCarrierConfigRule = new CarrierConfigRule();
+    @ClassRule
+    @Rule
+    public static final DeviceState sDeviceState = new DeviceState();
 
     private Context mContext;
 
@@ -124,6 +138,11 @@ public class TetheringManagerTest {
     private CtsTetheringUtils mCtsTetheringUtils;
 
     private static final int DEFAULT_TIMEOUT_MS = 60_000;
+    private static final String TETHERING_CONNECTOR_CLASS = "android.net.ITetheringConnector";
+    // String replacement is needed to prevent the class name from being modified
+    // by NetworkStack JarJar rules.
+    private static final String NETWORKSTACK_CONNECTOR_CLASS =
+            "android$net$INetworkStackConnector".replace('$', '.');
 
     @Before
     public void setUp() throws Exception {
@@ -910,4 +929,30 @@ public class TetheringManagerTest {
             mCtsTetheringUtils.unregisterTetheringEventCallback(tetherEventCallback);
         }
     }
+
+    // Verify the existence of the Tethering/NetworkStack package for the current user.
+    // This test will be executed on both SYSTEM and FULL users.
+    @Test
+    @UserTest({UserType.INITIAL_USER, UserType.SECONDARY_USER})
+    public void testCreatePackageContextAsUser() throws PackageManager.NameNotFoundException {
+        final List<String> packageNames = List.of(
+                resolvePackageName(TETHERING_CONNECTOR_CLASS),
+                resolvePackageName(NETWORKSTACK_CONNECTOR_CLASS));
+        // Permission CREATE_USERS is required for Android R or below.
+        final int currentUserId = runAsShell(CREATE_USERS, INTERACT_ACROSS_USERS,
+                () -> getCurrentUser());
+        final UserHandle currentUser = UserHandle.of(currentUserId);
+        for (String packageName : packageNames) {
+            mContext.createPackageContextAsUser(packageName, 0 /* flags */, currentUser);
+        }
+    }
+
+    @NonNull
+    private String resolvePackageName(@NonNull String action) {
+        final Intent intent = new Intent(action);
+        final List<ResolveInfo> resolveInfoList = mContext.getPackageManager()
+                .queryIntentServices(intent, MATCH_SYSTEM_ONLY);
+        assertFalse("Failed to resolve package for " + action, resolveInfoList.isEmpty());
+        return Objects.requireNonNull(resolveInfoList.get(0).getComponentInfo().packageName);
+    }
 }

From 48ac9543c3929c0da084328320893bc94bcb5377 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Wed, 16 Apr 2025 15:08:18 -0700
Subject: [PATCH 123/377] Remove unnecessary shutdown() calls

For some reason, I used to believe shutdown() was required for tun
interface fds. As it turns out, it isn't and throws an error every time
it is called:

    shutdown failed: ENOTSOCK (Socket operation on non-socket)

This change removes all calls to shutdown() including the shutdownRead()
and shutdownWrite() interface methods.

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I5a1716f82426b24db9e05367f82dc4080762e288
---
 .../server/net/L2capPacketForwarder.java      | 61 ++-----------------
 .../server/net/L2capPacketForwarderTest.kt    | 13 +++-
 2 files changed, 16 insertions(+), 58 deletions(-)

diff --git a/service/src/com/android/server/net/L2capPacketForwarder.java b/service/src/com/android/server/net/L2capPacketForwarder.java
index 8420d60dde..656868d2b9 100644
--- a/service/src/com/android/server/net/L2capPacketForwarder.java
+++ b/service/src/com/android/server/net/L2capPacketForwarder.java
@@ -24,7 +24,6 @@ import android.os.Handler;
 import android.os.ParcelFileDescriptor;
 import android.system.ErrnoException;
 import android.system.Os;
-import android.system.OsConstants;
 import android.util.Log;
 
 import com.android.internal.annotations.VisibleForTesting;
@@ -74,10 +73,6 @@ public class L2capPacketForwarder {
          * bytes[] must be of size >= off + len.
          */
         void write(byte[] bytes, int off, int len) throws IOException;
-        /** Disallow further receptions, shutdown(fd, SHUT_RD) */
-        void shutdownRead();
-        /** Disallow further transmissions, shutdown(fd, SHUT_WR) */
-        void shutdownWrite();
         /** Close the fd */
         void close();
     }
@@ -124,30 +119,6 @@ public class L2capPacketForwarder {
             mOutputStream.write(bytes, off, len);
         }
 
-        @Override
-        public void shutdownRead() {
-            // BluetoothSocket does not expose methods to shutdown read / write individually;
-            // however, BluetoothSocket#close() shuts down both read and write and is safe to be
-            // called multiple times from any thread.
-            try {
-                mSocket.close();
-            } catch (IOException e) {
-                Log.w(TAG, "shutdownRead: Failed to close BluetoothSocket", e);
-            }
-        }
-
-        @Override
-        public void shutdownWrite() {
-            // BluetoothSocket does not expose methods to shutdown read / write individually;
-            // however, BluetoothSocket#close() shuts down both read and write and is safe to be
-            // called multiple times from any thread.
-            try {
-                mSocket.close();
-            } catch (IOException e) {
-                Log.w(TAG, "shutdownWrite: Failed to close BluetoothSocket", e);
-            }
-        }
-
         @Override
         public void close() {
             // BluetoothSocket#close() is safe to be called multiple times.
@@ -190,24 +161,6 @@ public class L2capPacketForwarder {
             }
         }
 
-        @Override
-        public void shutdownRead() {
-            try {
-                Os.shutdown(mFd.getFileDescriptor(), OsConstants.SHUT_RD);
-            } catch (ErrnoException e) {
-                Log.w(TAG, "shutdownRead: Failed to shutdown(fd, SHUT_RD)", e);
-            }
-        }
-
-        @Override
-        public void shutdownWrite() {
-            try {
-                Os.shutdown(mFd.getFileDescriptor(), OsConstants.SHUT_WR);
-            } catch (ErrnoException e) {
-                Log.w(TAG, "shutdownWrite: Failed to shutdown(fd, SHUT_WR)", e);
-            }
-        }
-
         @Override
         public void close() {
             try {
@@ -283,10 +236,8 @@ public class L2capPacketForwarder {
             }
         }
 
-        public void tearDown() {
+        public void requestStop() {
             mIsRunning = false;
-            mReadFd.shutdownRead();
-            mWriteFd.shutdownWrite();
         }
     }
 
@@ -316,14 +267,10 @@ public class L2capPacketForwarder {
      * This operation closes both the passed tun fd and BluetoothSocket.
      **/
     public void tearDown() {
-        // Destroying both threads first guarantees that both read and write side of FD have been
-        // shutdown.
-        mIngressThread.tearDown();
-        mEgressThread.tearDown();
+        mIngressThread.requestStop();
+        mEgressThread.requestStop();
 
-        // In order to interrupt a blocking read on the BluetoothSocket, the BluetoothSocket must be
-        // closed (which triggers shutdown()). This means, the BluetoothSocket must be closed inside
-        // L2capPacketForwarder. Tear down the tun fd alongside it for consistency.
+        // BluetoothSocket#close() as well as closing the tun fd interrupts any blocking operations.
         mTunFd.close();
         mL2capFd.close();
 
diff --git a/tests/unit/java/com/android/server/net/L2capPacketForwarderTest.kt b/tests/unit/java/com/android/server/net/L2capPacketForwarderTest.kt
index e261732b53..4111f8b610 100644
--- a/tests/unit/java/com/android/server/net/L2capPacketForwarderTest.kt
+++ b/tests/unit/java/com/android/server/net/L2capPacketForwarderTest.kt
@@ -24,6 +24,7 @@ import android.os.ParcelFileDescriptor
 import android.system.Os
 import android.system.OsConstants.AF_UNIX
 import android.system.OsConstants.SHUT_RD
+import android.system.OsConstants.SHUT_RDWR
 import android.system.OsConstants.SHUT_WR
 import android.system.OsConstants.SOCK_SEQPACKET
 import android.system.OsConstants.SOL_SOCKET
@@ -180,9 +181,19 @@ class L2capPacketForwarderTest {
             }
         }).`when`(bluetoothSocket).close()
 
+        // FdWrapper does not shutdown fd as tun is not a connected socket, i.e. closing interrupts
+        // blocking operations.
+        val parcelFd = ParcelFileDescriptor(tunFds[0])
+        val fdWrapper = object : FdWrapper(parcelFd) {
+            override fun close() {
+                Os.shutdown(parcelFd.fileDescriptor, SHUT_RDWR)
+                parcelFd.close()
+            }
+        }
+
         forwarder = L2capPacketForwarder(
                 handler,
-                FdWrapper(ParcelFileDescriptor(tunFds[0])),
+                fdWrapper,
                 BluetoothSocketWrapper(bluetoothSocket),
                 false /* compressHeaders */,
                 callback

From 18ec5811ec7fc3d83b97fd8c019d6e77df18a217 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Wed, 16 Apr 2025 15:12:50 -0700
Subject: [PATCH 124/377] Rename FdWrapper to TunWrapper

For clarity, as it doesn't support wrapping any fd. If the fd is a
connected socket, it must be shutdown() to interrupt blocking
operations. Tun doesn not require shutdown(), so TunWrapper is a better
name.

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I2f7af95ef8d9ebceefdfc479c04e0272b2cb7311
---
 .../src/com/android/server/net/L2capPacketForwarder.java  | 6 +++---
 .../com/android/server/net/L2capPacketForwarderTest.kt    | 8 ++++----
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/service/src/com/android/server/net/L2capPacketForwarder.java b/service/src/com/android/server/net/L2capPacketForwarder.java
index 656868d2b9..a2a04b16d1 100644
--- a/service/src/com/android/server/net/L2capPacketForwarder.java
+++ b/service/src/com/android/server/net/L2capPacketForwarder.java
@@ -131,10 +131,10 @@ public class L2capPacketForwarder {
     }
 
     @VisibleForTesting
-    public static class FdWrapper implements IReadWriteFd {
+    public static class TunWrapper implements IReadWriteFd {
         private final ParcelFileDescriptor mFd;
 
-        public FdWrapper(ParcelFileDescriptor fd) {
+        public TunWrapper(ParcelFileDescriptor fd) {
             mFd = fd;
         }
 
@@ -243,7 +243,7 @@ public class L2capPacketForwarder {
 
     public L2capPacketForwarder(Handler handler, ParcelFileDescriptor tunFd, BluetoothSocket socket,
             boolean compressHdrs, ICallback cb) {
-        this(handler, new FdWrapper(tunFd), new BluetoothSocketWrapper(socket), compressHdrs, cb);
+        this(handler, new TunWrapper(tunFd), new BluetoothSocketWrapper(socket), compressHdrs, cb);
     }
 
     @VisibleForTesting
diff --git a/tests/unit/java/com/android/server/net/L2capPacketForwarderTest.kt b/tests/unit/java/com/android/server/net/L2capPacketForwarderTest.kt
index 4111f8b610..8076bad9a3 100644
--- a/tests/unit/java/com/android/server/net/L2capPacketForwarderTest.kt
+++ b/tests/unit/java/com/android/server/net/L2capPacketForwarderTest.kt
@@ -32,7 +32,7 @@ import android.system.OsConstants.SO_RCVTIMEO
 import android.system.OsConstants.SO_SNDTIMEO
 import android.system.StructTimeval
 import com.android.server.net.L2capPacketForwarder.BluetoothSocketWrapper
-import com.android.server.net.L2capPacketForwarder.FdWrapper
+import com.android.server.net.L2capPacketForwarder.TunWrapper
 import com.android.testutils.ConnectivityModuleTest
 import com.android.testutils.DevSdkIgnoreRule
 import com.android.testutils.DevSdkIgnoreRunner
@@ -181,10 +181,10 @@ class L2capPacketForwarderTest {
             }
         }).`when`(bluetoothSocket).close()
 
-        // FdWrapper does not shutdown fd as tun is not a connected socket, i.e. closing interrupts
+        // TunWrapper does not shutdown fd as tun is not a connected socket, i.e. closing interrupts
         // blocking operations.
         val parcelFd = ParcelFileDescriptor(tunFds[0])
-        val fdWrapper = object : FdWrapper(parcelFd) {
+        val tunWrapper = object : TunWrapper(parcelFd) {
             override fun close() {
                 Os.shutdown(parcelFd.fileDescriptor, SHUT_RDWR)
                 parcelFd.close()
@@ -193,7 +193,7 @@ class L2capPacketForwarderTest {
 
         forwarder = L2capPacketForwarder(
                 handler,
-                fdWrapper,
+                tunWrapper,
                 BluetoothSocketWrapper(bluetoothSocket),
                 false /* compressHeaders */,
                 callback

From 3e88b748ef1bfd444ae3eb679f79836db3b55764 Mon Sep 17 00:00:00 2001
From: Paul Hu <paulhu@google.com>
Date: Thu, 27 Mar 2025 13:22:00 +0000
Subject: [PATCH 125/377] Create the TetheringFeatureFlags class

Currently, Tethering feature flags are located in
TetheringConfiguration or other classes. However,
not all flags are truly related to the tethering configuration.
Therefore, create the TetheringFeatureFlags class to centralize
and manage these feature flags more easily.

Test: m
Flag: EXEMPT refactor
Change-Id: Iadca476aba57019776061102cb2a6d8226a70200
---
 .../apishim/api31/BpfCoordinatorShimImpl.java |  2 +-
 Tethering/src/android/net/ip/IpServer.java    |  4 +-
 .../tethering/BpfCoordinator.java             |  2 +-
 .../tethering/TetheringConfiguration.java     | 46 +-----------
 .../tethering/TetheringFeatureFlags.java      | 75 +++++++++++++++++++
 .../unit/src/android/net/ip/IpServerTest.java |  4 +-
 .../tethering/BpfCoordinatorTest.java         |  2 +-
 .../tethering/TetheringConfigurationTest.java |  8 +-
 .../networkstack/tethering/TetheringTest.java |  2 +-
 9 files changed, 90 insertions(+), 55 deletions(-)
 create mode 100644 Tethering/src/com/android/networkstack/tethering/TetheringFeatureFlags.java

diff --git a/Tethering/apishim/31/com/android/networkstack/tethering/apishim/api31/BpfCoordinatorShimImpl.java b/Tethering/apishim/31/com/android/networkstack/tethering/apishim/api31/BpfCoordinatorShimImpl.java
index b460f0d0b1..9b6097d094 100644
--- a/Tethering/apishim/31/com/android/networkstack/tethering/apishim/api31/BpfCoordinatorShimImpl.java
+++ b/Tethering/apishim/31/com/android/networkstack/tethering/apishim/api31/BpfCoordinatorShimImpl.java
@@ -19,7 +19,7 @@ package com.android.networkstack.tethering.apishim.api31;
 import static android.net.netstats.provider.NetworkStatsProvider.QUOTA_UNLIMITED;
 
 import static com.android.net.module.util.NetworkStackConstants.RFC7421_PREFIX_LENGTH;
-import static com.android.networkstack.tethering.TetheringConfiguration.TETHER_ACTIVE_SESSIONS_METRICS;
+import static com.android.networkstack.tethering.TetheringFeatureFlags.TETHER_ACTIVE_SESSIONS_METRICS;
 
 import android.system.ErrnoException;
 import android.system.Os;
diff --git a/Tethering/src/android/net/ip/IpServer.java b/Tethering/src/android/net/ip/IpServer.java
index baaaef5092..e8796b9647 100644
--- a/Tethering/src/android/net/ip/IpServer.java
+++ b/Tethering/src/android/net/ip/IpServer.java
@@ -41,9 +41,9 @@ import static android.system.OsConstants.RT_SCOPE_UNIVERSE;
 
 import static com.android.net.module.util.Inet4AddressUtils.intToInet4AddressHTH;
 import static com.android.net.module.util.NetworkStackConstants.RFC7421_PREFIX_LENGTH;
-import static com.android.networkstack.tethering.TetheringConfiguration.TETHERING_LOCAL_NETWORK_AGENT;
 import static com.android.networkstack.tethering.TetheringConfiguration.USE_SYNC_SM;
-import static com.android.networkstack.tethering.TetheringConfiguration.WIFIP2PGO_LOCAL_NETWORK_AGENT;
+import static com.android.networkstack.tethering.TetheringFeatureFlags.TETHERING_LOCAL_NETWORK_AGENT;
+import static com.android.networkstack.tethering.TetheringFeatureFlags.WIFIP2PGO_LOCAL_NETWORK_AGENT;
 import static com.android.networkstack.tethering.util.PrefixUtils.asIpPrefix;
 import static com.android.networkstack.tethering.util.TetheringMessageBase.BASE_IPSERVER;
 import static com.android.networkstack.tethering.util.TetheringUtils.getTransportTypeForTetherableType;
diff --git a/Tethering/src/com/android/networkstack/tethering/BpfCoordinator.java b/Tethering/src/com/android/networkstack/tethering/BpfCoordinator.java
index 75ab9eccf3..180791e813 100644
--- a/Tethering/src/com/android/networkstack/tethering/BpfCoordinator.java
+++ b/Tethering/src/com/android/networkstack/tethering/BpfCoordinator.java
@@ -34,7 +34,7 @@ import static com.android.net.module.util.ip.ConntrackMonitor.ConntrackEvent;
 import static com.android.networkstack.tethering.BpfUtils.DOWNSTREAM;
 import static com.android.networkstack.tethering.BpfUtils.UPSTREAM;
 import static com.android.networkstack.tethering.TetheringConfiguration.DEFAULT_TETHER_OFFLOAD_POLL_INTERVAL_MS;
-import static com.android.networkstack.tethering.TetheringConfiguration.TETHER_ACTIVE_SESSIONS_METRICS;
+import static com.android.networkstack.tethering.TetheringFeatureFlags.TETHER_ACTIVE_SESSIONS_METRICS;
 import static com.android.networkstack.tethering.UpstreamNetworkState.isVcnInterface;
 import static com.android.networkstack.tethering.util.TetheringUtils.getTetheringJniLibraryName;
 
diff --git a/Tethering/src/com/android/networkstack/tethering/TetheringConfiguration.java b/Tethering/src/com/android/networkstack/tethering/TetheringConfiguration.java
index 4f9916c16b..c6d71abacb 100644
--- a/Tethering/src/com/android/networkstack/tethering/TetheringConfiguration.java
+++ b/Tethering/src/com/android/networkstack/tethering/TetheringConfiguration.java
@@ -25,6 +25,9 @@ import static android.provider.DeviceConfig.NAMESPACE_CONNECTIVITY;
 
 import static com.android.networkstack.apishim.ConstantsShim.KEY_CARRIER_SUPPORTS_TETHERING_BOOL;
 import static com.android.net.module.util.SdkUtil.isAtLeast25Q2;
+import static com.android.networkstack.tethering.TetheringFeatureFlags.TETHER_ENABLE_SYNC_SM;
+import static com.android.networkstack.tethering.TetheringFeatureFlags.TETHER_ENABLE_WEAR_TETHERING;
+import static com.android.networkstack.tethering.TetheringFeatureFlags.TETHER_FORCE_UPSTREAM_AUTOMATIC_VERSION;
 
 import android.content.ContentResolver;
 import android.content.Context;
@@ -103,19 +106,6 @@ public class TetheringConfiguration {
     public static final String USE_LEGACY_WIFI_P2P_DEDICATED_IP =
             "use_legacy_wifi_p2p_dedicated_ip";
 
-    /**
-     * Experiment flag to force choosing upstreams automatically.
-     *
-     * This setting is intended to help force-enable the feature on OEM devices that disabled it
-     * via resource overlays, and later noticed issues. To that end, it overrides
-     * config_tether_upstream_automatic when set to true.
-     *
-     * This flag is enabled if !=0 and less than the module APEX version: see
-     * {@link DeviceConfigUtils#isTetheringFeatureEnabled}. It is also ignored after R, as later
-     * devices should just set config_tether_upstream_automatic to true instead.
-     */
-    public static final String TETHER_FORCE_UPSTREAM_AUTOMATIC_VERSION =
-            "tether_force_upstream_automatic_version";
 
     /**
      * Settings key to foce choosing usb functions for usb tethering.
@@ -125,17 +115,6 @@ public class TetheringConfiguration {
     public static final String TETHER_FORCE_USB_FUNCTIONS =
             "tether_force_usb_functions";
 
-    /**
-     * Experiment flag to enable TETHERING_WEAR.
-     */
-    public static final String TETHER_ENABLE_WEAR_TETHERING =
-            "tether_enable_wear_tethering";
-
-    public static final String TETHER_FORCE_RANDOM_PREFIX_BASE_SELECTION =
-            "tether_force_random_prefix_base_selection";
-
-    public static final String TETHER_ENABLE_SYNC_SM = "tether_enable_sync_sm";
-
     /**
      * Default value that used to periodic polls tether offload stats from tethering offload HAL
      * to make the data warnings work.
@@ -145,25 +124,6 @@ public class TetheringConfiguration {
     /** A flag for using synchronous or asynchronous state machine. */
     public static boolean USE_SYNC_SM = true;
 
-    /**
-     * A feature flag to control whether the active sessions metrics should be enabled.
-     * Disabled by default.
-     */
-    public static final String TETHER_ACTIVE_SESSIONS_METRICS = "tether_active_sessions_metrics";
-
-    /**
-     * A feature flag to control whether the tethering local network agent should be enabled.
-     * Disabled by default.
-     */
-    public static final String TETHERING_LOCAL_NETWORK_AGENT = "tethering_local_network_agent";
-
-    /**
-     * A feature flag to control whether the Wifi P2P Group Owner local network agent
-     * should be enabled. Disabled by default. This depends on TETHERING_LOCAL_AGENT
-     * and will not be enabled if that flag is off.
-     */
-    public static final String WIFIP2PGO_LOCAL_NETWORK_AGENT = "wifip2pgo_local_network_agent";
-
     public final String[] tetherableUsbRegexs;
     public final String[] tetherableWifiRegexs;
     public final String[] tetherableWigigRegexs;
diff --git a/Tethering/src/com/android/networkstack/tethering/TetheringFeatureFlags.java b/Tethering/src/com/android/networkstack/tethering/TetheringFeatureFlags.java
new file mode 100644
index 0000000000..fd4aa510ea
--- /dev/null
+++ b/Tethering/src/com/android/networkstack/tethering/TetheringFeatureFlags.java
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.networkstack.tethering;
+
+import com.android.net.module.util.DeviceConfigUtils;
+
+/**
+ * The class that contains Tethering feature flags;
+ *
+ * @hide
+ */
+public class TetheringFeatureFlags {
+    /**
+     * A feature flag to control whether the automatic forced choosing upstreams is enabled.
+     *
+     * This setting is intended to help force-enable the feature on OEM devices that disabled it
+     * via resource overlays, and later noticed issues. To that end, it overrides
+     * config_tether_upstream_automatic when set to true.
+     *
+     * This flag is enabled if !=0 and less than the module APEX version: see
+     * {@link DeviceConfigUtils#isTetheringFeatureEnabled}. It is also ignored after R, as later
+     * devices should just set config_tether_upstream_automatic to true instead.
+     */
+    public static final String TETHER_FORCE_UPSTREAM_AUTOMATIC_VERSION =
+            "tether_force_upstream_automatic_version";
+
+    /**
+     * A feature flag to control whether the TETHERING_WEAR is enabled.
+     */
+    public static final String TETHER_ENABLE_WEAR_TETHERING = "tether_enable_wear_tethering";
+
+    /**
+     * A feature flag to control whether the force random prefix base selection is enabled.
+     */
+    public static final String TETHER_FORCE_RANDOM_PREFIX_BASE_SELECTION =
+            "tether_force_random_prefix_base_selection";
+
+    /**
+     * A feature flag to control whether the synchronize state machine is enabled.
+     */
+    public static final String TETHER_ENABLE_SYNC_SM = "tether_enable_sync_sm";
+
+    /**
+     * A feature flag to control whether the active sessions metrics should be enabled.
+     * Disabled by default.
+     */
+    public static final String TETHER_ACTIVE_SESSIONS_METRICS = "tether_active_sessions_metrics";
+
+    /**
+     * A feature flag to control whether the tethering local network agent should be enabled.
+     * Disabled by default.
+     */
+    public static final String TETHERING_LOCAL_NETWORK_AGENT = "tethering_local_network_agent";
+
+    /**
+     * A feature flag to control whether the Wifi P2P Group Owner local network agent
+     * should be enabled. Disabled by default. This depends on TETHERING_LOCAL_AGENT
+     * and will not be enabled if that flag is off.
+     */
+    public static final String WIFIP2PGO_LOCAL_NETWORK_AGENT = "wifip2pgo_local_network_agent";
+}
diff --git a/Tethering/tests/unit/src/android/net/ip/IpServerTest.java b/Tethering/tests/unit/src/android/net/ip/IpServerTest.java
index 89fa34c60c..1d0deff3d8 100644
--- a/Tethering/tests/unit/src/android/net/ip/IpServerTest.java
+++ b/Tethering/tests/unit/src/android/net/ip/IpServerTest.java
@@ -40,8 +40,8 @@ import static android.net.ip.IpServer.getTetherableIpv6Prefixes;
 import static com.android.modules.utils.build.SdkLevel.isAtLeastT;
 import static com.android.modules.utils.build.SdkLevel.isAtLeastV;
 import static com.android.net.module.util.Inet4AddressUtils.intToInet4AddressHTH;
-import static com.android.networkstack.tethering.TetheringConfiguration.TETHERING_LOCAL_NETWORK_AGENT;
-import static com.android.networkstack.tethering.TetheringConfiguration.WIFIP2PGO_LOCAL_NETWORK_AGENT;
+import static com.android.networkstack.tethering.TetheringFeatureFlags.TETHERING_LOCAL_NETWORK_AGENT;
+import static com.android.networkstack.tethering.TetheringFeatureFlags.WIFIP2PGO_LOCAL_NETWORK_AGENT;
 
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
diff --git a/Tethering/tests/unit/src/com/android/networkstack/tethering/BpfCoordinatorTest.java b/Tethering/tests/unit/src/com/android/networkstack/tethering/BpfCoordinatorTest.java
index b537fb65a3..92ed6fc5b4 100644
--- a/Tethering/tests/unit/src/com/android/networkstack/tethering/BpfCoordinatorTest.java
+++ b/Tethering/tests/unit/src/com/android/networkstack/tethering/BpfCoordinatorTest.java
@@ -61,7 +61,7 @@ import static com.android.networkstack.tethering.BpfCoordinator.toIpv4MappedAddr
 import static com.android.networkstack.tethering.BpfUtils.DOWNSTREAM;
 import static com.android.networkstack.tethering.BpfUtils.UPSTREAM;
 import static com.android.networkstack.tethering.TetheringConfiguration.DEFAULT_TETHER_OFFLOAD_POLL_INTERVAL_MS;
-import static com.android.networkstack.tethering.TetheringConfiguration.TETHER_ACTIVE_SESSIONS_METRICS;
+import static com.android.networkstack.tethering.TetheringFeatureFlags.TETHER_ACTIVE_SESSIONS_METRICS;
 import static com.android.testutils.MiscAsserts.assertSameElements;
 
 import static org.junit.Assert.assertArrayEquals;
diff --git a/Tethering/tests/unit/src/com/android/networkstack/tethering/TetheringConfigurationTest.java b/Tethering/tests/unit/src/com/android/networkstack/tethering/TetheringConfigurationTest.java
index 179165a3bd..99baf27e82 100644
--- a/Tethering/tests/unit/src/com/android/networkstack/tethering/TetheringConfigurationTest.java
+++ b/Tethering/tests/unit/src/com/android/networkstack/tethering/TetheringConfigurationTest.java
@@ -31,6 +31,7 @@ import static com.android.networkstack.tethering.TetheringConfiguration.TETHER_E
 import static com.android.networkstack.tethering.TetheringConfiguration.TETHER_FORCE_USB_FUNCTIONS;
 import static com.android.networkstack.tethering.TetheringConfiguration.TETHER_USB_NCM_FUNCTION;
 import static com.android.networkstack.tethering.TetheringConfiguration.TETHER_USB_RNDIS_FUNCTION;
+import static com.android.networkstack.tethering.TetheringFeatureFlags.TETHER_FORCE_UPSTREAM_AUTOMATIC_VERSION;
 
 import static org.junit.Assert.assertArrayEquals;
 import static org.junit.Assert.assertEquals;
@@ -179,7 +180,7 @@ public class TetheringConfigurationTest {
 
         @Override
         boolean isTetherForceUpstreamAutomaticFeatureEnabled() {
-            return isMockFlagEnabled(TetheringConfiguration.TETHER_FORCE_UPSTREAM_AUTOMATIC_VERSION,
+            return isMockFlagEnabled(TETHER_FORCE_UPSTREAM_AUTOMATIC_VERSION,
                     false /* defaultEnabled */);
         }
 
@@ -639,8 +640,7 @@ public class TetheringConfigurationTest {
     }
 
     private void setTetherForceUpstreamAutomaticFlagEnabled(Boolean enabled) {
-        mDeps.setFeatureEnabled(
-                TetheringConfiguration.TETHER_FORCE_UPSTREAM_AUTOMATIC_VERSION, enabled);
+        mDeps.setFeatureEnabled(TETHER_FORCE_UPSTREAM_AUTOMATIC_VERSION, enabled);
     }
 
     private void assertChooseUpstreamAutomaticallyIs(boolean value) {
@@ -762,7 +762,7 @@ public class TetheringConfigurationTest {
     }
 
     private void setTetherEnableSyncSMFlagEnabled(Boolean enabled) {
-        mDeps.setFeatureEnabled(TetheringConfiguration.TETHER_ENABLE_SYNC_SM, enabled);
+        mDeps.setFeatureEnabled(TetheringFeatureFlags.TETHER_ENABLE_SYNC_SM, enabled);
         new TetheringConfiguration(
                 mMockContext, mLog, INVALID_SUBSCRIPTION_ID, mDeps).readEnableSyncSM(mMockContext);
     }
diff --git a/Tethering/tests/unit/src/com/android/networkstack/tethering/TetheringTest.java b/Tethering/tests/unit/src/com/android/networkstack/tethering/TetheringTest.java
index 160f28ccb7..7a262ded62 100644
--- a/Tethering/tests/unit/src/com/android/networkstack/tethering/TetheringTest.java
+++ b/Tethering/tests/unit/src/com/android/networkstack/tethering/TetheringTest.java
@@ -84,10 +84,10 @@ import static com.android.networkstack.tethering.OffloadHardwareInterface.OFFLOA
 import static com.android.networkstack.tethering.TestConnectivityManager.BROADCAST_FIRST;
 import static com.android.networkstack.tethering.TestConnectivityManager.CALLBACKS_FIRST;
 import static com.android.networkstack.tethering.Tethering.UserRestrictionActionListener;
-import static com.android.networkstack.tethering.TetheringConfiguration.TETHERING_LOCAL_NETWORK_AGENT;
 import static com.android.networkstack.tethering.TetheringConfiguration.TETHER_FORCE_USB_FUNCTIONS;
 import static com.android.networkstack.tethering.TetheringConfiguration.TETHER_USB_NCM_FUNCTION;
 import static com.android.networkstack.tethering.TetheringConfiguration.TETHER_USB_RNDIS_FUNCTION;
+import static com.android.networkstack.tethering.TetheringFeatureFlags.TETHERING_LOCAL_NETWORK_AGENT;
 import static com.android.networkstack.tethering.TetheringNotificationUpdater.DOWNSTREAM_NONE;
 import static com.android.networkstack.tethering.UpstreamNetworkMonitor.EVENT_ON_CAPABILITIES;
 import static com.android.testutils.TestPermissionUtil.runAsShell;

From 4eb7a669e5ec377de87edcf48b7f7cdb63575a5b Mon Sep 17 00:00:00 2001
From: Xiao Ma <xiaom@google.com>
Date: Thu, 17 Apr 2025 14:52:34 +0900
Subject: [PATCH 126/377] CSTest: move nc function helper to CSTestHelpers.

Flag: EXEMPT test-only change
Bug: 368416967
Test: atest ConnectivityCoverageTests
Change-Id: I022bb5ab026fefec82a4b2a260b9167ef7891e96
---
 .../com/android/server/connectivityservice/base/CSTest.kt  | 7 -------
 .../server/connectivityservice/base/CSTestHelpers.kt       | 7 +++++++
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
index c236ea5673..11128b623a 100644
--- a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
@@ -605,13 +605,6 @@ open class CSTest {
         NetworkScore.Builder().setKeepConnectedReason(KEEP_CONNECTED_FOR_TEST).build()
     )
 
-    fun nc(transport: Int, vararg caps: Int) = defaultNc().apply {
-        addTransportType(transport)
-        caps.forEach {
-            addCapability(it)
-        }
-    }
-
     // Create a network agent with the given parameters.
     fun createAgent(interfaceName: String, transport: Int, vararg caps: Int): CSAgentWrapper {
         return Agent(
diff --git a/tests/unit/java/com/android/server/connectivityservice/base/CSTestHelpers.kt b/tests/unit/java/com/android/server/connectivityservice/base/CSTestHelpers.kt
index 9e5ca68b21..827d73771f 100644
--- a/tests/unit/java/com/android/server/connectivityservice/base/CSTestHelpers.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/base/CSTestHelpers.kt
@@ -84,6 +84,13 @@ internal fun defaultNc() = NetworkCapabilities.Builder()
         .addCapability(NetworkCapabilities.NET_CAPABILITY_NOT_VCN_MANAGED)
         .build()
 
+internal fun nc(transport: Int, vararg caps: Int) = defaultNc().apply {
+    addTransportType(transport)
+    caps.forEach {
+        addCapability(it)
+    }
+}
+
 internal fun defaultScore() = FromS(NetworkScore.Builder().build())
 
 internal fun keepConnectedScore() = FromS(NetworkScore.Builder()

From 5db5a47144f32c82b03f3e372923a1f41787ce49 Mon Sep 17 00:00:00 2001
From: Quang Anh Luong <qal@google.com>
Date: Wed, 16 Apr 2025 13:37:59 +0900
Subject: [PATCH 127/377] Remove @JvmSerializableLambda usage in
 CarrierConfigRule

@JvmSerializableLambda was used in NetworkAgentTest to get around the
link error caused by JUnit enumerating through lambda methods that
referenced classes that weren't available on older platform versions.

Since this code was ported from NetworkAgentTest to CarrierConfigRule
whose lambda methods are not enumerated by JUnit, this workaround isn't
necessary anymore.

Flag: EXEMPT test only change

Bug: 409710349
Test: atest TetheringManagerTest
Change-Id: Ib876e237b239661548ae3c1d23fcb52f389f6254
---
 .../android/testutils/CarrierConfigRule.kt    | 42 ++++++-------------
 1 file changed, 12 insertions(+), 30 deletions(-)

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/CarrierConfigRule.kt b/staticlibs/testutils/devicetests/com/android/testutils/CarrierConfigRule.kt
index d9803999ba..bfa4019bd2 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/CarrierConfigRule.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/CarrierConfigRule.kt
@@ -180,15 +180,9 @@ class CarrierConfigRule : TestRule {
         val tm = context.getSystemService(TelephonyManager::class.java)!!
 
         val cpb = PrivilegeWaiterCallback()
-        // The lambda below is capturing |cpb|, whose type inherits from a class that appeared in
-        // T. This means the lambda will compile as a private method of this class taking a
-        // PrivilegeWaiterCallback argument. As JUnit uses reflection to enumerate all methods
-        // including private methods, this would fail with a link error when running on S-.
-        // To solve this, make the lambda serializable, which causes the compiler to emit a
-        // synthetic class instead of a synthetic method.
-        tryTest @JvmSerializableLambda {
+        tryTest {
             val slotIndex = SubscriptionManager.getSlotIndex(subId)!!
-            runAsShell(READ_PRIVILEGED_PHONE_STATE) @JvmSerializableLambda {
+            runAsShell(READ_PRIVILEGED_PHONE_STATE) {
                 tm.registerCarrierPrivilegesCallback(slotIndex, { it.run() }, cpb)
             }
             val currentPrivilege = cpb.expectCarrierPrivilegesChanged()
@@ -212,8 +206,8 @@ class CarrierConfigRule : TestRule {
                 cleanUpNow()
             }
             cpb.eventuallyExpectCarrierPrivilegesChanged(hold)
-        } cleanup @JvmSerializableLambda {
-            runAsShell(READ_PRIVILEGED_PHONE_STATE) @JvmSerializableLambda {
+        } cleanup {
+            runAsShell(READ_PRIVILEGED_PHONE_STATE) {
                 tm.unregisterCarrierPrivilegesCallback(cpb)
             }
         }
@@ -259,15 +253,9 @@ class CarrierConfigRule : TestRule {
 
         val cv = ConditionVariable()
         val cpb = CarrierServiceChangedWaiterCallback(cv)
-        // The lambda below is capturing |cpb|, whose type inherits from a class that appeared in
-        // T. This means the lambda will compile as a private method of this class taking a
-        // PrivilegeWaiterCallback argument. As JUnit uses reflection to enumerate all methods
-        // including private methods, this would fail with a link error when running on S-.
-        // To solve this, make the lambda serializable, which causes the compiler to emit a
-        // synthetic class instead of a synthetic method.
-        tryTest @JvmSerializableLambda {
+        tryTest {
             val slotIndex = SubscriptionManager.getSlotIndex(subId)!!
-            runAsShell(READ_PRIVILEGED_PHONE_STATE) @JvmSerializableLambda {
+            runAsShell(READ_PRIVILEGED_PHONE_STATE) {
                 tm.registerCarrierPrivilegesCallback(slotIndex, { it.run() }, cpb)
             }
             // Wait for the callback to be registered
@@ -294,8 +282,8 @@ class CarrierConfigRule : TestRule {
             }
             assertTrue(cv.block(CARRIER_CONFIG_CHANGE_TIMEOUT_MS),
                 "Can't modify carrier service package")
-        } cleanup @JvmSerializableLambda {
-            runAsShell(READ_PRIVILEGED_PHONE_STATE) @JvmSerializableLambda {
+        } cleanup {
+            runAsShell(READ_PRIVILEGED_PHONE_STATE) {
                 tm.unregisterCarrierPrivilegesCallback(cpb)
             }
         }
@@ -360,20 +348,14 @@ class CarrierConfigRule : TestRule {
         val tm = context.getSystemService(TelephonyManager::class.java)!!
         originalCarrierPrivileges.forEach { (subId, privileged) ->
             val cpb = PrivilegeWaiterCallback()
-            // The lambda below is capturing |cpb|, whose type inherits from a class that appeared in
-            // T. This means the lambda will compile as a private method of this class taking a
-            // PrivilegeWaiterCallback argument. As JUnit uses reflection to enumerate all methods
-            // including private methods, this would fail with a link error when running on S-.
-            // To solve this, make the lambda serializable, which causes the compiler to emit a
-            // synthetic class instead of a synthetic method.
-            tryTest @JvmSerializableLambda {
+            tryTest {
                 val slotIndex = SubscriptionManager.getSlotIndex(subId)!!
-                runAsShell(READ_PRIVILEGED_PHONE_STATE) @JvmSerializableLambda {
+                runAsShell(READ_PRIVILEGED_PHONE_STATE) {
                     tm.registerCarrierPrivilegesCallback(slotIndex, { it.run() }, cpb)
                 }
                 cpb.eventuallyExpectCarrierPrivilegesChanged(privileged)
-            } cleanup @JvmSerializableLambda {
-                runAsShell(READ_PRIVILEGED_PHONE_STATE) @JvmSerializableLambda {
+            } cleanup {
+                runAsShell(READ_PRIVILEGED_PHONE_STATE) {
                     tm.unregisterCarrierPrivilegesCallback(cpb)
                 }
             }

From 926df9a9abae01ddbf414d1ae4376eea1d7ba0e3 Mon Sep 17 00:00:00 2001
From: Xiao Ma <xiaom@google.com>
Date: Thu, 17 Apr 2025 15:45:55 +0900
Subject: [PATCH 128/377] CSTest: overload Agent with the given parameters.

CSTest already has an Agent function helper. Instead of using a new
function to create a network agent based on the given parameters,
it's better to overload the existing Agent function.

Flag: EXEMPT test-only change
Bug: 368416967
Test: atest ConnectivityCoverageTests
Change-Id: I134a96f564111ba65ddd5f8ec7878aeeab340dee
---
 .../connectivityservice/CSCaptivePortalAppTest.kt  |  2 +-
 .../connectivityservice/CSLocalAgentTests.kt       |  4 ++--
 .../server/connectivityservice/base/CSTest.kt      | 14 +++++---------
 3 files changed, 8 insertions(+), 12 deletions(-)

diff --git a/tests/unit/java/com/android/server/connectivityservice/CSCaptivePortalAppTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSCaptivePortalAppTest.kt
index a3019bb45e..b66fcc9dac 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSCaptivePortalAppTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSCaptivePortalAppTest.kt
@@ -56,7 +56,7 @@ class CSCaptivePortalAppTest : CSTest() {
         val captivePortalRequest = NetworkRequest.Builder()
                 .addCapability(NET_CAPABILITY_CAPTIVE_PORTAL).build()
         cm.registerNetworkCallback(captivePortalRequest, captivePortalCallback)
-        val wifiAgent = createAgent(WIFI_IFACE, TRANSPORT_WIFI, NET_CAPABILITY_INTERNET)
+        val wifiAgent = Agent(WIFI_IFACE, TRANSPORT_WIFI, NET_CAPABILITY_INTERNET)
         wifiAgent.connectWithCaptivePortal(TEST_REDIRECT_URL)
         captivePortalCallback.expectAvailableCallbacksUnvalidated(wifiAgent)
         val signInIntent = startCaptivePortalApp(wifiAgent)
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSLocalAgentTests.kt b/tests/unit/java/com/android/server/connectivityservice/CSLocalAgentTests.kt
index cecc177485..1058be125c 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSLocalAgentTests.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSLocalAgentTests.kt
@@ -204,11 +204,11 @@ class CSLocalAgentTests : CSTest() {
     }
 
     private fun createWifiAgent(name: String): CSAgentWrapper {
-        return createAgent(name, TRANSPORT_WIFI, NET_CAPABILITY_INTERNET)
+        return Agent(name, TRANSPORT_WIFI, NET_CAPABILITY_INTERNET)
     }
 
     private fun createCellAgent(name: String): CSAgentWrapper {
-        return createAgent(name, TRANSPORT_CELLULAR, NET_CAPABILITY_INTERNET)
+        return Agent(name, TRANSPORT_CELLULAR, NET_CAPABILITY_INTERNET)
     }
 
     private fun sendLocalNetworkConfig(
diff --git a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
index 11128b623a..6c6c6634bd 100644
--- a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
@@ -598,19 +598,15 @@ open class CSTest {
                 .build()
         return Agent(nc = nc, lp = lp)
     }
+    fun Agent(interfaceName: String, transport: Int, vararg caps: Int) = Agent(
+        nc = nc(transport, *caps),
+        lp = defaultLp().apply { this.interfaceName = interfaceName },
+        score = keepScore()
+    )
 
     // This allows keeping all the networks connected without having to file individual requests
     // for them.
     fun keepScore() = FromS(
         NetworkScore.Builder().setKeepConnectedReason(KEEP_CONNECTED_FOR_TEST).build()
     )
-
-    // Create a network agent with the given parameters.
-    fun createAgent(interfaceName: String, transport: Int, vararg caps: Int): CSAgentWrapper {
-        return Agent(
-                score = keepScore(),
-                lp = defaultLp().apply { this.interfaceName = interfaceName },
-                nc = nc(transport, *caps)
-        )
-    }
 }

From 2d9d1d129ce5b44e3be3724e403a347961f7127f Mon Sep 17 00:00:00 2001
From: Remi NGUYEN VAN <reminv@google.com>
Date: Tue, 15 Apr 2025 16:08:34 +0900
Subject: [PATCH 129/377] Add logs for awaitPrivateDnsSetting

To help investigate flakes when calling awaitPrivateDnsSetting, add more
logs.

Bug: 253698734
Test: atest
Flag: TEST_ONLY
Change-Id: I224b2693b61003a723d1e67e970232c00bd94f84
---
 tests/cts/net/src/android/net/cts/DnsResolverTest.java     | 3 +++
 .../net/util/java/android/net/cts/util/CtsNetUtils.java    | 7 +++++--
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/tests/cts/net/src/android/net/cts/DnsResolverTest.java b/tests/cts/net/src/android/net/cts/DnsResolverTest.java
index b66b853552..7cb28c7cd8 100644
--- a/tests/cts/net/src/android/net/cts/DnsResolverTest.java
+++ b/tests/cts/net/src/android/net/cts/DnsResolverTest.java
@@ -210,6 +210,7 @@ public class DnsResolverTest {
         // In order to test query with null network, add null as an element.
         // Test cases which query with null network will go on default network.
         testableNetworks.add(null);
+        Log.i(TAG, "Using testable networks: " + testableNetworks);
         return testableNetworks.toArray(new Network[0]);
     }
 
@@ -505,6 +506,8 @@ public class DnsResolverTest {
             final Network networkForPrivateDns =
                     (network != null) ? network : mCM.getActiveNetwork();
             assertNotNull("Can't find network to await private DNS on", networkForPrivateDns);
+            Log.i(TAG, "Waiting for private DNS setting on " + networkForPrivateDns
+                    + " (testable network: " + network + ")");
             mCtsNetUtils.awaitPrivateDnsSetting(msg + " wait private DNS setting timeout",
                     networkForPrivateDns, GOOGLE_PRIVATE_DNS_SERVER, true);
             final VerifyCancelCallback callback = new VerifyCancelCallback(msg);
diff --git a/tests/cts/net/util/java/android/net/cts/util/CtsNetUtils.java b/tests/cts/net/util/java/android/net/cts/util/CtsNetUtils.java
index 173d13f6d5..5e24452c73 100644
--- a/tests/cts/net/util/java/android/net/cts/util/CtsNetUtils.java
+++ b/tests/cts/net/util/java/android/net/cts/util/CtsNetUtils.java
@@ -512,12 +512,15 @@ public final class CtsNetUtils {
         final NetworkCallback callback = new NetworkCallback() {
             @Override
             public void onLinkPropertiesChanged(Network n, LinkProperties lp) {
-                Log.i(TAG, "Link properties of network " + n + " changed to " + lp);
+                Log.i(TAG,  "Waiting for the private DNS server to change to " + server + " on "
+                        + network + ": Link properties of network " + n
+                        + " changed with private DNS server " + lp.getPrivateDnsServerName()
+                        + ", full LinkProperties: " + lp);
                 if (requiresValidatedServer && lp.getValidatedPrivateDnsServers().isEmpty()) {
                     return;
                 }
-                Log.i(TAG, "Set private DNS server to " + server);
                 if (network.equals(n) && Objects.equals(server, lp.getPrivateDnsServerName())) {
+                    Log.i(TAG, "Set private DNS server to " + server + " on " + network);
                     latch.countDown();
                 }
             }

From 03b974321bfdbe7a8bcc068c4044ba4debb89466 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Thu, 17 Apr 2025 08:37:01 -0700
Subject: [PATCH 130/377] Fix memory leak in NetBpfLoad

The lambda was capturing btf by value instead of reference. This meant
that btf__free was never called, because at the time of capture btf was
null.

This changes the lambda to capture btf by reference instead of by value.

Test: TH
Flag: EXEMPT mainline
Bug: 411323352
Change-Id: I6c6637b10f16d48f9ae5b702e44883046b46e252
---
 bpf/loader/NetBpfLoad.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bpf/loader/NetBpfLoad.cpp b/bpf/loader/NetBpfLoad.cpp
index 71d85db0ab..5c420df0ba 100644
--- a/bpf/loader/NetBpfLoad.cpp
+++ b/bpf/loader/NetBpfLoad.cpp
@@ -857,7 +857,7 @@ static int createMaps(const char* elfPath, ifstream& elfFile, vector<unique_fd>&
     if (ret) return ret;
 
     struct btf *btf = NULL;
-    auto scopeGuard = base::make_scope_guard([btf] { if (btf) btf__free(btf); });
+    auto btfGuard = base::make_scope_guard([&btf] { if (btf) btf__free(btf); });
     if (isAtLeastKernelVersion(5, 10, 0)) {
         // Untested on Linux Kernel 5.4, but likely compatible.
         // On Linux Kernels older than 4.18 BPF_BTF_LOAD command doesn't exist.

From ecdc5d7743d7c88b86f79bb5f2afb414d1a80f20 Mon Sep 17 00:00:00 2001
From: Yuyang Huang <yuyanghuang@google.com>
Date: Sun, 20 Apr 2025 14:30:16 +0900
Subject: [PATCH 131/377] Format MdnsRecordRepositoryTest with ktlint

Test: TH
Flag: EXEMPT test only
Change-Id: I9d39a2927df5d09183c30140ed2e2b22f457a5bf
---
 .../mdns/MdnsRecordRepositoryTest.kt          | 1712 ++++++++++++-----
 1 file changed, 1211 insertions(+), 501 deletions(-)

diff --git a/tests/unit/java/com/android/server/connectivity/mdns/MdnsRecordRepositoryTest.kt b/tests/unit/java/com/android/server/connectivity/mdns/MdnsRecordRepositoryTest.kt
index 9674da36a0..bf88d67abf 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/MdnsRecordRepositoryTest.kt
+++ b/tests/unit/java/com/android/server/connectivity/mdns/MdnsRecordRepositoryTest.kt
@@ -39,8 +39,8 @@ import com.android.testutils.DevSdkIgnoreRunner
 import com.google.common.truth.Truth.assertThat
 import java.net.InetSocketAddress
 import java.net.NetworkInterface
-import java.util.Collections
 import java.time.Duration
+import java.util.Collections
 import kotlin.test.assertContentEquals
 import kotlin.test.assertEquals
 import kotlin.test.assertFailsWith
@@ -63,6 +63,7 @@ private const val TEST_SERVICE_CUSTOM_HOST_ID_1 = 48
 private const val TEST_PORT = 12345
 private const val TEST_SUBTYPE = "_subtype"
 private const val TEST_SUBTYPE2 = "_subtype2"
+
 // RFC6762 10. Resource Record TTL Values and Cache Coherency
 // The recommended TTL value for Multicast DNS resource records with a host name as the resource
 // record's name (e.g., A, AAAA, HINFO) or a host name contained within the resource record's rdata
@@ -74,7 +75,8 @@ private val TEST_HOSTNAME = arrayOf("Android_000102030405060708090A0B0C0D0E0F",
 private val TEST_ADDRESSES = listOf(
         LinkAddress(parseNumericAddress("192.0.2.111"), 24),
         LinkAddress(parseNumericAddress("2001:db8::111"), 64),
-        LinkAddress(parseNumericAddress("2001:db8::222"), 64))
+        LinkAddress(parseNumericAddress("2001:db8::222"), 64)
+)
 
 private val TEST_SERVICE_1 = NsdServiceInfo().apply {
     serviceType = "_testservice._tcp"
@@ -127,14 +129,16 @@ private val TEST_PUBLIC_KEY = hexStringToByteArray(
                 "221d2879dac26ee5b460e9007c992e19" +
                 "02d897c391b03764d448f7d0c772fdb0" +
                 "3b1d9d6d52ff8886769e8e2362513565" +
-                "270962d3")
+                "270962d3"
+)
 
 private val TEST_PUBLIC_KEY_2 = hexStringToByteArray(
         "0201030dc141d0637960b98cbc12cfca" +
                 "221d2879dac26ee5b460e9007c992e19" +
                 "02d897c391b03764d448f7d0c772fdb0" +
                 "3b1d9d6d52ff8886769e8e2362513565" +
-                "270962d4")
+                "270962d4"
+)
 
 @RunWith(DevSdkIgnoreRunner::class)
 @DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.S_V2)
@@ -185,8 +189,10 @@ class MdnsRecordRepositoryTest {
     fun testAddServiceAndProbe() {
         val repository = MdnsRecordRepository(thread.looper, deps, TEST_HOSTNAME, makeFlags())
         assertEquals(0, repository.servicesCount)
-        assertEquals(-1,
-                repository.addService(TEST_SERVICE_ID_1, TEST_SERVICE_1, Duration.ofSeconds(50)))
+        assertEquals(
+            -1,
+            repository.addService(TEST_SERVICE_ID_1, TEST_SERVICE_1, Duration.ofSeconds(50))
+        )
         assertEquals(1, repository.servicesCount)
 
         val probingInfo = repository.setServiceProbing(TEST_SERVICE_ID_1)
@@ -206,12 +212,16 @@ class MdnsRecordRepositoryTest {
         assertEquals(MdnsAnyRecord(expectedName, false /* unicast */), packet.questions[0])
 
         assertEquals(1, packet.authorityRecords.size)
-        assertEquals(MdnsServiceRecord(expectedName,
-                0L /* receiptTimeMillis */,
-                false /* cacheFlush */,
-                50_000L /* ttlMillis */,
-                0 /* servicePriority */, 0 /* serviceWeight */,
-                TEST_PORT, TEST_HOSTNAME), packet.authorityRecords[0])
+        assertEquals(MdnsServiceRecord(
+            expectedName,
+            0L /* receiptTimeMillis */,
+            false /* cacheFlush */,
+            50_000L /* ttlMillis */,
+            0 /* servicePriority */,
+            0 /* serviceWeight */,
+            TEST_PORT,
+            TEST_HOSTNAME
+        ), packet.authorityRecords[0])
 
         assertContentEquals(intArrayOf(TEST_SERVICE_ID_1), repository.clearServices())
     }
@@ -241,8 +251,13 @@ class MdnsRecordRepositoryTest {
 
         val queriedName = arrayOf(TEST_SUBTYPE, "_sub", "_testservice", "_tcp", "local")
         val questions = listOf(MdnsPointerRecord(queriedName, false /* isUnicast */))
-        val query = MdnsPacket(0 /* flags */, questions, emptyList() /* answers */,
-                emptyList() /* authorityRecords */, emptyList() /* additionalRecords */)
+        val query = MdnsPacket(
+            0 /* flags */,
+            questions,
+            emptyList() /* answers */,
+            emptyList() /* authorityRecords */,
+            emptyList() /* additionalRecords */
+        )
         val src = InetSocketAddress(parseNumericAddress("192.0.2.123"), 5353)
         val reply = repository.getReply(query, src)
 
@@ -258,7 +273,8 @@ class MdnsRecordRepositoryTest {
                         0L /* receiptTimeMillis */,
                         false /* cacheFlush */,
                         longTtl,
-                        serviceName),
+                        serviceName
+                ),
         ), reply.answers)
     }
 
@@ -311,7 +327,8 @@ class MdnsRecordRepositoryTest {
                         0L /* receiptTimeMillis */,
                         false /* cacheFlush */,
                         0L /* ttlMillis */,
-                        arrayOf("MyTestService", "_testservice", "_tcp", "local"))
+                        arrayOf("MyTestService", "_testservice", "_tcp", "local")
+                )
         ), packet.answers)
 
         repository.removeService(TEST_SERVICE_ID_1)
@@ -321,8 +338,11 @@ class MdnsRecordRepositoryTest {
     @Test
     fun testExitAnnouncements_WithSubtypes() {
         val repository = MdnsRecordRepository(thread.looper, deps, TEST_HOSTNAME, makeFlags())
-        repository.initWithService(TEST_SERVICE_ID_1, TEST_SERVICE_1,
-                setOf(TEST_SUBTYPE, TEST_SUBTYPE2))
+        repository.initWithService(
+            TEST_SERVICE_ID_1,
+            TEST_SERVICE_1,
+            setOf(TEST_SUBTYPE, TEST_SUBTYPE2)
+        )
         repository.onAdvertisementSent(TEST_SERVICE_ID_1, 2 /* sentPacketCount */)
 
         val exitAnnouncement = repository.exitService(TEST_SERVICE_ID_1)
@@ -342,19 +362,23 @@ class MdnsRecordRepositoryTest {
                         0L /* receiptTimeMillis */,
                         false /* cacheFlush */,
                         0L /* ttlMillis */,
-                        arrayOf("MyTestService", "_testservice", "_tcp", "local")),
+                        arrayOf("MyTestService", "_testservice", "_tcp", "local")
+                ),
                 MdnsPointerRecord(
                         arrayOf("_subtype", "_sub", "_testservice", "_tcp", "local"),
                         0L /* receiptTimeMillis */,
                         false /* cacheFlush */,
                         0L /* ttlMillis */,
-                        arrayOf("MyTestService", "_testservice", "_tcp", "local")),
+                        arrayOf("MyTestService", "_testservice", "_tcp", "local")
+                ),
                 MdnsPointerRecord(
                         arrayOf("_subtype2", "_sub", "_testservice", "_tcp", "local"),
                         0L /* receiptTimeMillis */,
                         false /* cacheFlush */,
                         0L /* ttlMillis */,
-                        arrayOf("MyTestService", "_testservice", "_tcp", "local")))
+                        arrayOf("MyTestService", "_testservice", "_tcp", "local")
+                )
+        )
 
         repository.removeService(TEST_SERVICE_ID_1)
         assertEquals(0, repository.servicesCount)
@@ -367,8 +391,10 @@ class MdnsRecordRepositoryTest {
         repository.onAdvertisementSent(TEST_SERVICE_ID_1, 2 /* sentPacketCount */)
         repository.exitService(TEST_SERVICE_ID_1)
 
-        assertEquals(TEST_SERVICE_ID_1,
-                repository.addService(TEST_SERVICE_ID_2, TEST_SERVICE_1, null /* ttl */))
+        assertEquals(
+            TEST_SERVICE_ID_1,
+            repository.addService(TEST_SERVICE_ID_2, TEST_SERVICE_1, null /* ttl */)
+        )
         assertEquals(1, repository.servicesCount)
 
         repository.removeService(TEST_SERVICE_ID_2)
@@ -378,8 +404,11 @@ class MdnsRecordRepositoryTest {
     @Test
     fun testOnProbingSucceeded() {
         val repository = MdnsRecordRepository(thread.looper, deps, TEST_HOSTNAME, makeFlags())
-        val announcementInfo = repository.initWithService(TEST_SERVICE_ID_1, TEST_SERVICE_1,
-                setOf(TEST_SUBTYPE, TEST_SUBTYPE2))
+        val announcementInfo = repository.initWithService(
+            TEST_SERVICE_ID_1,
+            TEST_SERVICE_1,
+            setOf(TEST_SUBTYPE, TEST_SUBTYPE2)
+        )
         repository.onAdvertisementSent(TEST_SERVICE_ID_1, 2 /* sentPacketCount */)
         val packet = announcementInfo.getPacket(0)
 
@@ -398,36 +427,48 @@ class MdnsRecordRepositoryTest {
 
         assertThat(packet.answers).containsExactly(
                 // Reverse address and address records for the hostname
-                MdnsPointerRecord(v4AddrRev,
-                        0L /* receiptTimeMillis */,
-                        true /* cacheFlush */,
-                        120000L /* ttlMillis */,
-                        TEST_HOSTNAME),
-                MdnsInetAddressRecord(TEST_HOSTNAME,
-                        0L /* receiptTimeMillis */,
-                        true /* cacheFlush */,
-                        120000L /* ttlMillis */,
-                        TEST_ADDRESSES[0].address),
-                MdnsPointerRecord(v6Addr1Rev,
-                        0L /* receiptTimeMillis */,
-                        true /* cacheFlush */,
-                        120000L /* ttlMillis */,
-                        TEST_HOSTNAME),
-                MdnsInetAddressRecord(TEST_HOSTNAME,
-                        0L /* receiptTimeMillis */,
-                        true /* cacheFlush */,
-                        120000L /* ttlMillis */,
-                        TEST_ADDRESSES[1].address),
-                MdnsPointerRecord(v6Addr2Rev,
-                        0L /* receiptTimeMillis */,
-                        true /* cacheFlush */,
-                        120000L /* ttlMillis */,
-                        TEST_HOSTNAME),
-                MdnsInetAddressRecord(TEST_HOSTNAME,
-                        0L /* receiptTimeMillis */,
-                        true /* cacheFlush */,
-                        120000L /* ttlMillis */,
-                        TEST_ADDRESSES[2].address),
+                MdnsPointerRecord(
+                    v4AddrRev,
+                    0L /* receiptTimeMillis */,
+                    true /* cacheFlush */,
+                    120000L /* ttlMillis */,
+                    TEST_HOSTNAME
+                ),
+                MdnsInetAddressRecord(
+                    TEST_HOSTNAME,
+                    0L /* receiptTimeMillis */,
+                    true /* cacheFlush */,
+                    120000L /* ttlMillis */,
+                    TEST_ADDRESSES[0].address
+                ),
+                MdnsPointerRecord(
+                    v6Addr1Rev,
+                    0L /* receiptTimeMillis */,
+                    true /* cacheFlush */,
+                    120000L /* ttlMillis */,
+                    TEST_HOSTNAME
+                ),
+                MdnsInetAddressRecord(
+                    TEST_HOSTNAME,
+                    0L /* receiptTimeMillis */,
+                    true /* cacheFlush */,
+                    120000L /* ttlMillis */,
+                    TEST_ADDRESSES[1].address
+                ),
+                MdnsPointerRecord(
+                    v6Addr2Rev,
+                    0L /* receiptTimeMillis */,
+                    true /* cacheFlush */,
+                    120000L /* ttlMillis */,
+                    TEST_HOSTNAME
+                ),
+                MdnsInetAddressRecord(
+                    TEST_HOSTNAME,
+                    0L /* receiptTimeMillis */,
+                    true /* cacheFlush */,
+                    120000L /* ttlMillis */,
+                    TEST_ADDRESSES[2].address
+                ),
                 // Service registration records (RFC6763)
                 MdnsPointerRecord(
                         serviceType,
@@ -435,21 +476,24 @@ class MdnsRecordRepositoryTest {
                         // Not a unique name owned by the announcer, so cacheFlush=false
                         false /* cacheFlush */,
                         4500000L /* ttlMillis */,
-                        serviceName),
+                        serviceName
+                ),
                 MdnsPointerRecord(
                         serviceSubtype,
                         0L /* receiptTimeMillis */,
                         // Not a unique name owned by the announcer, so cacheFlush=false
                         false /* cacheFlush */,
                         4500000L /* ttlMillis */,
-                        serviceName),
+                        serviceName
+                ),
                 MdnsPointerRecord(
                         serviceSubtype2,
                         0L /* receiptTimeMillis */,
                         // Not a unique name owned by the announcer, so cacheFlush=false
                         false /* cacheFlush */,
                         4500000L /* ttlMillis */,
-                        serviceName),
+                        serviceName
+                ),
                 MdnsServiceRecord(
                         serviceName,
                         0L /* receiptTimeMillis */,
@@ -458,52 +502,65 @@ class MdnsRecordRepositoryTest {
                         0 /* servicePriority */,
                         0 /* serviceWeight */,
                         TEST_PORT /* servicePort */,
-                        TEST_HOSTNAME),
+                        TEST_HOSTNAME
+                ),
                 MdnsTextRecord(
                         serviceName,
                         0L /* receiptTimeMillis */,
                         true /* cacheFlush */,
                         4500000L /* ttlMillis */,
-                        emptyList() /* entries */),
+                        emptyList() /* entries */
+                ),
                 // Service type enumeration record (RFC6763 9.)
                 MdnsPointerRecord(
                         arrayOf("_services", "_dns-sd", "_udp", "local"),
                         0L /* receiptTimeMillis */,
                         false /* cacheFlush */,
                         4500000L /* ttlMillis */,
-                        serviceType))
+                        serviceType
+                ))
 
         assertContentEquals(listOf(
-                MdnsNsecRecord(v4AddrRev,
-                        0L /* receiptTimeMillis */,
-                        true /* cacheFlush */,
-                        120000L /* ttlMillis */,
-                        v4AddrRev,
-                        intArrayOf(TYPE_PTR)),
-                MdnsNsecRecord(TEST_HOSTNAME,
-                        0L /* receiptTimeMillis */,
-                        true /* cacheFlush */,
-                        120000L /* ttlMillis */,
-                        TEST_HOSTNAME,
-                        intArrayOf(TYPE_A, TYPE_AAAA)),
-                MdnsNsecRecord(v6Addr1Rev,
-                        0L /* receiptTimeMillis */,
-                        true /* cacheFlush */,
-                        120000L /* ttlMillis */,
-                        v6Addr1Rev,
-                        intArrayOf(TYPE_PTR)),
-                MdnsNsecRecord(v6Addr2Rev,
-                        0L /* receiptTimeMillis */,
-                        true /* cacheFlush */,
-                        120000L /* ttlMillis */,
-                        v6Addr2Rev,
-                        intArrayOf(TYPE_PTR)),
-                MdnsNsecRecord(serviceName,
-                        0L /* receiptTimeMillis */,
-                        true /* cacheFlush */,
-                        4500000L /* ttlMillis */,
-                        serviceName,
-                        intArrayOf(TYPE_TXT, TYPE_SRV))
+                MdnsNsecRecord(
+                    v4AddrRev,
+                    0L /* receiptTimeMillis */,
+                    true /* cacheFlush */,
+                    120000L /* ttlMillis */,
+                    v4AddrRev,
+                    intArrayOf(TYPE_PTR)
+                ),
+                MdnsNsecRecord(
+                    TEST_HOSTNAME,
+                    0L /* receiptTimeMillis */,
+                    true /* cacheFlush */,
+                    120000L /* ttlMillis */,
+                    TEST_HOSTNAME,
+                    intArrayOf(TYPE_A, TYPE_AAAA)
+                ),
+                MdnsNsecRecord(
+                    v6Addr1Rev,
+                    0L /* receiptTimeMillis */,
+                    true /* cacheFlush */,
+                    120000L /* ttlMillis */,
+                    v6Addr1Rev,
+                    intArrayOf(TYPE_PTR)
+                ),
+                MdnsNsecRecord(
+                    v6Addr2Rev,
+                    0L /* receiptTimeMillis */,
+                    true /* cacheFlush */,
+                    120000L /* ttlMillis */,
+                    v6Addr2Rev,
+                    intArrayOf(TYPE_PTR)
+                ),
+                MdnsNsecRecord(
+                    serviceName,
+                    0L /* receiptTimeMillis */,
+                    true /* cacheFlush */,
+                    4500000L /* ttlMillis */,
+                    serviceName,
+                    intArrayOf(TYPE_TXT, TYPE_SRV)
+                )
         ), packet.additionalRecords)
     }
 
@@ -526,7 +583,8 @@ class MdnsRecordRepositoryTest {
                 // Not a unique name owned by the announcer, so cacheFlush=false
                 false /* cacheFlush */,
                 4500000L /* ttlMillis */,
-                serviceName),
+                serviceName
+            ),
             MdnsServiceRecord(
                 serviceName,
                 0L /* receiptTimeMillis */,
@@ -535,28 +593,36 @@ class MdnsRecordRepositoryTest {
                 0 /* servicePriority */,
                 0 /* serviceWeight */,
                 TEST_PORT /* servicePort */,
-                TEST_HOSTNAME),
+                TEST_HOSTNAME
+            ),
             MdnsTextRecord(
                 serviceName,
                 0L /* receiptTimeMillis */,
                 true /* cacheFlush */,
                 4500000L /* ttlMillis */,
-                emptyList() /* entries */),
-            MdnsInetAddressRecord(TEST_HOSTNAME,
+                emptyList() /* entries */
+            ),
+            MdnsInetAddressRecord(
+                TEST_HOSTNAME,
                 0L /* receiptTimeMillis */,
                 true /* cacheFlush */,
                 120000L /* ttlMillis */,
-                TEST_ADDRESSES[0].address),
-            MdnsInetAddressRecord(TEST_HOSTNAME,
+                TEST_ADDRESSES[0].address
+            ),
+            MdnsInetAddressRecord(
+                TEST_HOSTNAME,
                 0L /* receiptTimeMillis */,
                 true /* cacheFlush */,
                 120000L /* ttlMillis */,
-                TEST_ADDRESSES[1].address),
-            MdnsInetAddressRecord(TEST_HOSTNAME,
+                TEST_ADDRESSES[1].address
+            ),
+            MdnsInetAddressRecord(
+                TEST_HOSTNAME,
                 0L /* receiptTimeMillis */,
                 true /* cacheFlush */,
                 120000L /* ttlMillis */,
-                TEST_ADDRESSES[2].address),
+                TEST_ADDRESSES[2].address
+            ),
         ), offloadPacket.answers)
     }
 
@@ -574,10 +640,15 @@ class MdnsRecordRepositoryTest {
         val repository = MdnsRecordRepository(thread.looper, deps, TEST_HOSTNAME, makeFlags())
         repository.initWithService(TEST_SERVICE_ID_1, TEST_SERVICE_1)
         val questionsCaseInSensitive = listOf(
-                MdnsPointerRecord(arrayOf("_TESTSERVICE", "_TCP", "local"), false /* isUnicast */))
-        val queryCaseInsensitive = MdnsPacket(0 /* flags */, questionsCaseInSensitive,
-            emptyList() /* answers */, emptyList() /* authorityRecords */,
-            emptyList() /* additionalRecords */)
+                MdnsPointerRecord(arrayOf("_TESTSERVICE", "_TCP", "local"), false /* isUnicast */)
+        )
+        val queryCaseInsensitive = MdnsPacket(
+            0 /* flags */,
+            questionsCaseInSensitive,
+            emptyList() /* answers */,
+            emptyList() /* authorityRecords */,
+            emptyList() /* additionalRecords */
+        )
         val src = InetSocketAddress(parseNumericAddress("192.0.2.123"), 5353)
         val replyCaseInsensitive = repository.getReply(queryCaseInsensitive, src)
         assertNotNull(replyCaseInsensitive)
@@ -590,8 +661,13 @@ class MdnsRecordRepositoryTest {
      */
     private fun makeQuery(vararg queries: Pair<Int, Array<String>>): MdnsPacket {
         val questions = queries.map { (type, name) -> makeQuestionRecord(name, type) }
-        return MdnsPacket(0 /* flags */, questions, emptyList() /* answers */,
-                emptyList() /* authorityRecords */, emptyList() /* additionalRecords */)
+        return MdnsPacket(
+            0 /* flags */,
+            questions,
+            emptyList() /* answers */,
+                emptyList() /* authorityRecords */,
+            emptyList() /* additionalRecords */
+        )
     }
 
     private fun makeQuestionRecord(name: Array<String>, type: Int): MdnsRecord {
@@ -616,32 +692,69 @@ class MdnsRecordRepositoryTest {
         val reply = repository.getReply(query, src)
 
         assertNotNull(reply)
-        assertEquals(listOf(
+        assertEquals(
+            listOf(
                 MdnsPointerRecord(
-                    arrayOf("_testservice", "_tcp", "local"), 0L, false, LONG_TTL, serviceName)),
-            reply.answers)
+                    arrayOf("_testservice", "_tcp", "local"),
+                    0L,
+                    false,
+                    LONG_TTL,
+                    serviceName
+                )
+            ),
+            reply.answers
+        )
         assertEquals(listOf(
                 MdnsTextRecord(serviceName, 0L, true, LONG_TTL, emptyList()),
                 MdnsServiceRecord(serviceName, 0L, true, SHORT_TTL, 0, 0, TEST_PORT, TEST_HOSTNAME),
                 MdnsInetAddressRecord(
-                    TEST_HOSTNAME, 0L, true, SHORT_TTL, TEST_ADDRESSES[0].address),
+                    TEST_HOSTNAME,
+                    0L,
+                    true,
+                    SHORT_TTL,
+                    TEST_ADDRESSES[0].address
+                ),
                 MdnsInetAddressRecord(
-                    TEST_HOSTNAME, 0L, true, SHORT_TTL, TEST_ADDRESSES[1].address),
+                    TEST_HOSTNAME,
+                    0L,
+                    true,
+                    SHORT_TTL,
+                    TEST_ADDRESSES[1].address
+                ),
                 MdnsInetAddressRecord(
-                    TEST_HOSTNAME, 0L, true, SHORT_TTL, TEST_ADDRESSES[2].address),
-                MdnsNsecRecord(serviceName, 0L, true, LONG_TTL, serviceName /* nextDomain */,
-                        intArrayOf(TYPE_TXT, TYPE_SRV)),
-                MdnsNsecRecord(TEST_HOSTNAME, 0L, true, SHORT_TTL, TEST_HOSTNAME /* nextDomain */,
-                        intArrayOf(TYPE_A, TYPE_AAAA)),
+                    TEST_HOSTNAME,
+                    0L,
+                    true,
+                    SHORT_TTL,
+                    TEST_ADDRESSES[2].address
+                ),
+                MdnsNsecRecord(
+                    serviceName,
+                    0L,
+                    true,
+                    LONG_TTL,
+                    serviceName /* nextDomain */,
+                    intArrayOf(TYPE_TXT, TYPE_SRV)
+                ),
+                MdnsNsecRecord(
+                    TEST_HOSTNAME,
+                    0L,
+                    true,
+                    SHORT_TTL,
+                    TEST_HOSTNAME /* nextDomain */,
+                    intArrayOf(TYPE_A, TYPE_AAAA)
+                ),
             ), reply.additionalAnswers)
     }
 
-
     @Test
     fun testGetReply_ptrQuestionForServiceWithCustomHost_customHostUsedInAdditionalAnswers() {
         val repository = MdnsRecordRepository(thread.looper, deps, TEST_HOSTNAME, makeFlags())
-        repository.initWithService(TEST_SERVICE_CUSTOM_HOST_ID_1, TEST_SERVICE_CUSTOM_HOST_1,
-                setOf(TEST_SUBTYPE, TEST_SUBTYPE2))
+        repository.initWithService(
+            TEST_SERVICE_CUSTOM_HOST_ID_1,
+            TEST_SERVICE_CUSTOM_HOST_1,
+            setOf(TEST_SUBTYPE, TEST_SUBTYPE2)
+        )
         val src = InetSocketAddress(parseNumericAddress("fe80::1234"), 5353)
         val serviceName = arrayOf("TestService", "_testservice", "_tcp", "local")
 
@@ -649,23 +762,53 @@ class MdnsRecordRepositoryTest {
         val reply = repository.getReply(query, src)
 
         assertNotNull(reply)
-        assertEquals(listOf(
+        assertEquals(
+            listOf(
                 MdnsPointerRecord(
-                        arrayOf("_testservice", "_tcp", "local"),
-                        0L, false, LONG_TTL, serviceName)),
-                reply.answers)
+                    arrayOf("_testservice", "_tcp", "local"),
+                    0L,
+                    false,
+                    LONG_TTL,
+                    serviceName
+                )
+            ),
+            reply.answers
+        )
         assertEquals(listOf(
                 MdnsTextRecord(serviceName, 0L, true, LONG_TTL, listOf()),
-                MdnsServiceRecord(serviceName, 0L, true, SHORT_TTL,
-                        0, 0, TEST_PORT, TEST_CUSTOM_HOST_1_NAME),
+                MdnsServiceRecord(
+                    serviceName,
+                    0L,
+                    true,
+                    SHORT_TTL,
+                    0,
+                    0,
+                    TEST_PORT,
+                    TEST_CUSTOM_HOST_1_NAME
+                ),
                 MdnsInetAddressRecord(
-                        TEST_CUSTOM_HOST_1_NAME, 0L, true, SHORT_TTL,
-                        parseNumericAddress("2001:db8::1")),
-                MdnsNsecRecord(serviceName, 0L, true, LONG_TTL, serviceName /* nextDomain */,
-                        intArrayOf(TYPE_TXT, TYPE_SRV)),
-                MdnsNsecRecord(TEST_CUSTOM_HOST_1_NAME, 0L, true, SHORT_TTL,
-                        TEST_CUSTOM_HOST_1_NAME /* nextDomain */,
-                        intArrayOf(TYPE_AAAA)),
+                    TEST_CUSTOM_HOST_1_NAME,
+                    0L,
+                    true,
+                    SHORT_TTL,
+                    parseNumericAddress("2001:db8::1")
+                ),
+                MdnsNsecRecord(
+                    serviceName,
+                    0L,
+                    true,
+                    LONG_TTL,
+                    serviceName /* nextDomain */,
+                    intArrayOf(TYPE_TXT, TYPE_SRV)
+                ),
+                MdnsNsecRecord(
+                    TEST_CUSTOM_HOST_1_NAME,
+                    0L,
+                    true,
+                    SHORT_TTL,
+                    TEST_CUSTOM_HOST_1_NAME /* nextDomain */,
+                    intArrayOf(TYPE_AAAA)
+                ),
         ), reply.additionalAnswers)
     }
 
@@ -696,29 +839,67 @@ class MdnsRecordRepositoryTest {
         val reply = repository.getReply(query, src)
 
         assertNotNull(reply)
-        assertEquals(listOf(
+        assertEquals(
+            listOf(
                 MdnsPointerRecord(
-                        arrayOf("_testservice", "_tcp", "local"),
-                        0L, false, LONG_TTL, serviceName)),
-                reply.answers)
+                    arrayOf("_testservice", "_tcp", "local"),
+                    0L,
+                    false,
+                    LONG_TTL,
+                    serviceName
+                )
+            ),
+            reply.answers
+        )
         assertEquals(listOf(
                 MdnsTextRecord(serviceName, 0L, true, LONG_TTL, listOf()),
-                MdnsServiceRecord(serviceName, 0L, true, SHORT_TTL,
-                        0, 0, TEST_PORT, TEST_CUSTOM_HOST_1_NAME),
+                MdnsServiceRecord(
+                    serviceName,
+                    0L,
+                    true,
+                    SHORT_TTL,
+                    0,
+                    0,
+                    TEST_PORT,
+                    TEST_CUSTOM_HOST_1_NAME
+                ),
                 MdnsInetAddressRecord(
-                        TEST_CUSTOM_HOST_1_NAME, 0L, true, SHORT_TTL,
-                        parseNumericAddress("2001:db8::1")),
+                    TEST_CUSTOM_HOST_1_NAME,
+                    0L,
+                    true,
+                    SHORT_TTL,
+                    parseNumericAddress("2001:db8::1")
+                ),
                 MdnsInetAddressRecord(
-                        TEST_CUSTOM_HOST_1_NAME, 0L, true, SHORT_TTL,
-                        parseNumericAddress("192.0.2.1")),
+                    TEST_CUSTOM_HOST_1_NAME,
+                    0L,
+                    true,
+                    SHORT_TTL,
+                    parseNumericAddress("192.0.2.1")
+                ),
                 MdnsInetAddressRecord(
-                        TEST_CUSTOM_HOST_1_NAME, 0L, true, SHORT_TTL,
-                        parseNumericAddress("2001:db8::3")),
-                MdnsNsecRecord(serviceName, 0L, true, LONG_TTL, serviceName /* nextDomain */,
-                        intArrayOf(TYPE_TXT, TYPE_SRV)),
-                MdnsNsecRecord(TEST_CUSTOM_HOST_1_NAME, 0L, true, SHORT_TTL,
-                        TEST_CUSTOM_HOST_1_NAME /* nextDomain */,
-                        intArrayOf(TYPE_A, TYPE_AAAA)),
+                    TEST_CUSTOM_HOST_1_NAME,
+                    0L,
+                    true,
+                    SHORT_TTL,
+                    parseNumericAddress("2001:db8::3")
+                ),
+                MdnsNsecRecord(
+                    serviceName,
+                    0L,
+                    true,
+                    LONG_TTL,
+                    serviceName /* nextDomain */,
+                    intArrayOf(TYPE_TXT, TYPE_SRV)
+                ),
+                MdnsNsecRecord(
+                    TEST_CUSTOM_HOST_1_NAME,
+                    0L,
+                    true,
+                    SHORT_TTL,
+                    TEST_CUSTOM_HOST_1_NAME /* nextDomain */,
+                    intArrayOf(TYPE_A, TYPE_AAAA)
+                ),
         ), reply.additionalAnswers)
     }
 
@@ -730,28 +911,63 @@ class MdnsRecordRepositoryTest {
         val serviceName = arrayOf("MyTestService", "_testservice", "_tcp", "local")
 
         val query = makeQuery(
-                TYPE_PTR to arrayOf(TEST_SUBTYPE, "_sub", "_testservice", "_tcp", "local"))
+                TYPE_PTR to arrayOf(TEST_SUBTYPE, "_sub", "_testservice", "_tcp", "local")
+        )
         val reply = repository.getReply(query, src)
 
         assertNotNull(reply)
-        assertEquals(listOf(
+        assertEquals(
+            listOf(
                 MdnsPointerRecord(
-                    arrayOf(TEST_SUBTYPE, "_sub", "_testservice", "_tcp", "local"), 0L, false,
-                    LONG_TTL, serviceName)),
-            reply.answers)
+                    arrayOf(TEST_SUBTYPE, "_sub", "_testservice", "_tcp", "local"),
+                    0L,
+                    false,
+                    LONG_TTL,
+                    serviceName
+                )
+            ),
+            reply.answers
+        )
         assertEquals(listOf(
                 MdnsTextRecord(serviceName, 0L, true, LONG_TTL, emptyList()),
                 MdnsServiceRecord(serviceName, 0L, true, SHORT_TTL, 0, 0, TEST_PORT, TEST_HOSTNAME),
                 MdnsInetAddressRecord(
-                    TEST_HOSTNAME, 0L, true, SHORT_TTL, TEST_ADDRESSES[0].address),
+                    TEST_HOSTNAME,
+                    0L,
+                    true,
+                    SHORT_TTL,
+                    TEST_ADDRESSES[0].address
+                ),
                 MdnsInetAddressRecord(
-                    TEST_HOSTNAME, 0L, true, SHORT_TTL, TEST_ADDRESSES[1].address),
+                    TEST_HOSTNAME,
+                    0L,
+                    true,
+                    SHORT_TTL,
+                    TEST_ADDRESSES[1].address
+                ),
                 MdnsInetAddressRecord(
-                    TEST_HOSTNAME, 0L, true, SHORT_TTL, TEST_ADDRESSES[2].address),
-                MdnsNsecRecord(serviceName, 0L, true, LONG_TTL, serviceName /* nextDomain */,
-                        intArrayOf(TYPE_TXT, TYPE_SRV)),
-                MdnsNsecRecord(TEST_HOSTNAME, 0L, true, SHORT_TTL, TEST_HOSTNAME /* nextDomain */,
-                        intArrayOf(TYPE_A, TYPE_AAAA)),
+                    TEST_HOSTNAME,
+                    0L,
+                    true,
+                    SHORT_TTL,
+                    TEST_ADDRESSES[2].address
+                ),
+                MdnsNsecRecord(
+                    serviceName,
+                    0L,
+                    true,
+                    LONG_TTL,
+                    serviceName /* nextDomain */,
+                    intArrayOf(TYPE_TXT, TYPE_SRV)
+                ),
+                MdnsNsecRecord(
+                    TEST_HOSTNAME,
+                    0L,
+                    true,
+                    SHORT_TTL,
+                    TEST_HOSTNAME /* nextDomain */,
+                    intArrayOf(TYPE_A, TYPE_AAAA)
+                ),
             ), reply.additionalAnswers)
     }
 
@@ -764,27 +980,63 @@ class MdnsRecordRepositoryTest {
 
         val query = makeQuery(
                 TYPE_PTR to arrayOf("_testservice", "_tcp", "local"),
-                TYPE_PTR to arrayOf("_testservice", "_tcp", "local"))
+                TYPE_PTR to arrayOf("_testservice", "_tcp", "local")
+        )
         val reply = repository.getReply(query, src)
 
         assertNotNull(reply)
-        assertEquals(listOf(
+        assertEquals(
+            listOf(
                 MdnsPointerRecord(
-                    arrayOf("_testservice", "_tcp", "local"), 0L, false, LONG_TTL, serviceName)),
-            reply.answers)
+                    arrayOf("_testservice", "_tcp", "local"),
+                    0L,
+                    false,
+                    LONG_TTL,
+                    serviceName
+                )
+            ),
+            reply.answers
+        )
         assertEquals(listOf(
                 MdnsTextRecord(serviceName, 0L, true, LONG_TTL, emptyList()),
                 MdnsServiceRecord(serviceName, 0L, true, SHORT_TTL, 0, 0, TEST_PORT, TEST_HOSTNAME),
                 MdnsInetAddressRecord(
-                    TEST_HOSTNAME, 0L, true, SHORT_TTL, TEST_ADDRESSES[0].address),
+                    TEST_HOSTNAME,
+                    0L,
+                    true,
+                    SHORT_TTL,
+                    TEST_ADDRESSES[0].address
+                ),
                 MdnsInetAddressRecord(
-                    TEST_HOSTNAME, 0L, true, SHORT_TTL, TEST_ADDRESSES[1].address),
+                    TEST_HOSTNAME,
+                    0L,
+                    true,
+                    SHORT_TTL,
+                    TEST_ADDRESSES[1].address
+                ),
                 MdnsInetAddressRecord(
-                    TEST_HOSTNAME, 0L, true, SHORT_TTL, TEST_ADDRESSES[2].address),
-                MdnsNsecRecord(serviceName, 0L, true, LONG_TTL, serviceName /* nextDomain */,
-                        intArrayOf(TYPE_TXT, TYPE_SRV)),
-                MdnsNsecRecord(TEST_HOSTNAME, 0L, true, SHORT_TTL, TEST_HOSTNAME /* nextDomain */,
-                        intArrayOf(TYPE_A, TYPE_AAAA)),
+                    TEST_HOSTNAME,
+                    0L,
+                    true,
+                    SHORT_TTL,
+                    TEST_ADDRESSES[2].address
+                ),
+                MdnsNsecRecord(
+                    serviceName,
+                    0L,
+                    true,
+                    LONG_TTL,
+                    serviceName /* nextDomain */,
+                    intArrayOf(TYPE_TXT, TYPE_SRV)
+                ),
+                MdnsNsecRecord(
+                    TEST_HOSTNAME,
+                    0L,
+                    true,
+                    SHORT_TTL,
+                    TEST_HOSTNAME /* nextDomain */,
+                    intArrayOf(TYPE_A, TYPE_AAAA)
+                ),
             ), reply.additionalAnswers)
     }
 
@@ -797,30 +1049,70 @@ class MdnsRecordRepositoryTest {
 
         val query = makeQuery(
                 TYPE_PTR to arrayOf("_testservice", "_tcp", "local"),
-                TYPE_PTR to arrayOf(TEST_SUBTYPE, "_sub", "_testservice", "_tcp", "local"))
+                TYPE_PTR to arrayOf(TEST_SUBTYPE, "_sub", "_testservice", "_tcp", "local")
+        )
         val reply = repository.getReply(query, src)
 
         assertNotNull(reply)
-        assertEquals(listOf(
+        assertEquals(
+            listOf(
                 MdnsPointerRecord(
-                    arrayOf("_testservice", "_tcp", "local"), 0L, false, LONG_TTL, serviceName),
+                    arrayOf("_testservice", "_tcp", "local"),
+                    0L,
+                    false,
+                    LONG_TTL,
+                    serviceName
+                ),
                 MdnsPointerRecord(
                     arrayOf(TEST_SUBTYPE, "_sub", "_testservice", "_tcp", "local"),
-                    0L, false, LONG_TTL, serviceName)),
-            reply.answers)
+                    0L,
+                    false,
+                    LONG_TTL,
+                    serviceName
+                )
+            ),
+            reply.answers
+        )
         assertEquals(listOf(
                 MdnsTextRecord(serviceName, 0L, true, LONG_TTL, emptyList()),
                 MdnsServiceRecord(serviceName, 0L, true, SHORT_TTL, 0, 0, TEST_PORT, TEST_HOSTNAME),
                 MdnsInetAddressRecord(
-                    TEST_HOSTNAME, 0L, true, SHORT_TTL, TEST_ADDRESSES[0].address),
+                    TEST_HOSTNAME,
+                    0L,
+                    true,
+                    SHORT_TTL,
+                    TEST_ADDRESSES[0].address
+                ),
                 MdnsInetAddressRecord(
-                    TEST_HOSTNAME, 0L, true, SHORT_TTL, TEST_ADDRESSES[1].address),
+                    TEST_HOSTNAME,
+                    0L,
+                    true,
+                    SHORT_TTL,
+                    TEST_ADDRESSES[1].address
+                ),
                 MdnsInetAddressRecord(
-                    TEST_HOSTNAME, 0L, true, SHORT_TTL, TEST_ADDRESSES[2].address),
-                MdnsNsecRecord(serviceName, 0L, true, LONG_TTL, serviceName /* nextDomain */,
-                        intArrayOf(TYPE_TXT, TYPE_SRV)),
-                MdnsNsecRecord(TEST_HOSTNAME, 0L, true, SHORT_TTL, TEST_HOSTNAME /* nextDomain */,
-                        intArrayOf(TYPE_A, TYPE_AAAA)),
+                    TEST_HOSTNAME,
+                    0L,
+                    true,
+                    SHORT_TTL,
+                    TEST_ADDRESSES[2].address
+                ),
+                MdnsNsecRecord(
+                    serviceName,
+                    0L,
+                    true,
+                    LONG_TTL,
+                    serviceName /* nextDomain */,
+                    intArrayOf(TYPE_TXT, TYPE_SRV)
+                ),
+                MdnsNsecRecord(
+                    TEST_HOSTNAME,
+                    0L,
+                    true,
+                    SHORT_TTL,
+                    TEST_HOSTNAME /* nextDomain */,
+                    intArrayOf(TYPE_A, TYPE_AAAA)
+                ),
             ), reply.additionalAnswers)
     }
 
@@ -835,8 +1127,10 @@ class MdnsRecordRepositoryTest {
         val reply = repository.getReply(query, src)
 
         assertNotNull(reply)
-        assertEquals(listOf(MdnsTextRecord(serviceName, 0L, true, LONG_TTL, emptyList())),
-                reply.answers)
+        assertEquals(
+            listOf(MdnsTextRecord(serviceName, 0L, true, LONG_TTL, emptyList())),
+            reply.answers
+        )
         // No NSEC records because the reply doesn't include the SRV record
         assertTrue(reply.additionalAnswers.isEmpty())
     }
@@ -845,8 +1139,11 @@ class MdnsRecordRepositoryTest {
     fun testGetReply_AAAAQuestionButNoIpv6Address_returnsNsecRecord() {
         val repository = MdnsRecordRepository(thread.looper, deps, TEST_HOSTNAME, makeFlags())
         repository.initWithService(
-                TEST_SERVICE_ID_1, TEST_SERVICE_1, setOf(TEST_SUBTYPE),
-                listOf(LinkAddress(parseNumericAddress("192.0.2.111"), 24)))
+            TEST_SERVICE_ID_1,
+            TEST_SERVICE_1,
+            setOf(TEST_SUBTYPE),
+            listOf(LinkAddress(parseNumericAddress("192.0.2.111"), 24))
+        )
         val src = InetSocketAddress(parseNumericAddress("192.0.2.123"), 5353)
 
         val query = makeQuery(TYPE_AAAA to TEST_HOSTNAME)
@@ -854,18 +1151,30 @@ class MdnsRecordRepositoryTest {
 
         assertNotNull(reply)
         assertTrue(reply.answers.isEmpty())
-        assertEquals(listOf(
-                MdnsNsecRecord(TEST_HOSTNAME, 0L, true, LONG_TTL, TEST_HOSTNAME /* nextDomain */,
-                        intArrayOf(TYPE_AAAA))),
-            reply.additionalAnswers)
+        assertEquals(
+            listOf(
+                MdnsNsecRecord(
+                    TEST_HOSTNAME,
+                    0L,
+                    true,
+                    LONG_TTL,
+                    TEST_HOSTNAME /* nextDomain */,
+                    intArrayOf(TYPE_AAAA)
+                )
+            ),
+            reply.additionalAnswers
+        )
     }
 
     @Test
     fun testGetReply_AAAAQuestionForCustomHost_returnsAAAARecords() {
         val repository = MdnsRecordRepository(thread.looper, deps, TEST_HOSTNAME, makeFlags())
         repository.initWithService(
-                TEST_CUSTOM_HOST_ID_1, TEST_CUSTOM_HOST_1, subtypes = setOf(),
-                listOf(LinkAddress(parseNumericAddress("192.0.2.111"), 24)))
+            TEST_CUSTOM_HOST_ID_1,
+            TEST_CUSTOM_HOST_1,
+            subtypes = setOf(),
+            listOf(LinkAddress(parseNumericAddress("192.0.2.111"), 24))
+        )
         repository.addService(TEST_CUSTOM_HOST_ID_2, TEST_CUSTOM_HOST_2, null /* ttl */)
         val src = InetSocketAddress(parseNumericAddress("fe80::123"), 5353)
 
@@ -873,21 +1182,38 @@ class MdnsRecordRepositoryTest {
         val reply = repository.getReply(query, src)
 
         assertNotNull(reply)
-        assertEquals(listOf(
-                MdnsInetAddressRecord(TEST_CUSTOM_HOST_1_NAME,
-                        0, false, LONG_TTL, parseNumericAddress("2001:db8::1")),
-                MdnsInetAddressRecord(TEST_CUSTOM_HOST_1_NAME,
-                        0, false, LONG_TTL, parseNumericAddress("2001:db8::2"))),
-                reply.answers)
         assertEquals(
-                listOf(MdnsNsecRecord(TEST_CUSTOM_HOST_1_NAME,
-                        0L, true, SHORT_TTL,
-                        TEST_CUSTOM_HOST_1_NAME /* nextDomain */,
-                        intArrayOf(TYPE_AAAA))),
-                reply.additionalAnswers)
+            listOf(
+                MdnsInetAddressRecord(
+                    TEST_CUSTOM_HOST_1_NAME,
+                    0,
+                    false,
+                    LONG_TTL,
+                    parseNumericAddress("2001:db8::1")
+                ),
+                MdnsInetAddressRecord(
+                    TEST_CUSTOM_HOST_1_NAME,
+                    0,
+                    false,
+                    LONG_TTL,
+                    parseNumericAddress("2001:db8::2")
+                )
+            ),
+            reply.answers
+        )
+        assertEquals(
+                listOf(MdnsNsecRecord(
+                    TEST_CUSTOM_HOST_1_NAME,
+                    0L,
+                    true,
+                    SHORT_TTL,
+                    TEST_CUSTOM_HOST_1_NAME /* nextDomain */,
+                    intArrayOf(TYPE_AAAA)
+                )),
+                reply.additionalAnswers
+        )
     }
 
-
     @Test
     fun testGetReply_AAAAQuestionForCustomHostInMultipleRegistrations_returnsAAAARecords() {
         val repository = MdnsRecordRepository(thread.looper, deps, TEST_HOSTNAME, makeFlags())
@@ -910,20 +1236,43 @@ class MdnsRecordRepositoryTest {
         val reply = repository.getReply(query, src)
 
         assertNotNull(reply)
-        assertEquals(listOf(
-                MdnsInetAddressRecord(TEST_CUSTOM_HOST_1_NAME,
-                        0, false, LONG_TTL, parseNumericAddress("2001:db8::1")),
-                MdnsInetAddressRecord(TEST_CUSTOM_HOST_1_NAME,
-                        0, false, LONG_TTL, parseNumericAddress("2001:db8::2")),
-                MdnsInetAddressRecord(TEST_CUSTOM_HOST_1_NAME,
-                        0, false, LONG_TTL, parseNumericAddress("2001:db8::3"))),
-                reply.answers)
         assertEquals(
-                listOf(MdnsNsecRecord(TEST_CUSTOM_HOST_1_NAME,
-                        0L, true, SHORT_TTL,
-                        TEST_CUSTOM_HOST_1_NAME /* nextDomain */,
-                        intArrayOf(TYPE_AAAA))),
-                reply.additionalAnswers)
+            listOf(
+                MdnsInetAddressRecord(
+                    TEST_CUSTOM_HOST_1_NAME,
+                    0,
+                    false,
+                    LONG_TTL,
+                    parseNumericAddress("2001:db8::1")
+                ),
+                MdnsInetAddressRecord(
+                    TEST_CUSTOM_HOST_1_NAME,
+                    0,
+                    false,
+                    LONG_TTL,
+                    parseNumericAddress("2001:db8::2")
+                ),
+                MdnsInetAddressRecord(
+                    TEST_CUSTOM_HOST_1_NAME,
+                    0,
+                    false,
+                    LONG_TTL,
+                    parseNumericAddress("2001:db8::3")
+                )
+            ),
+            reply.answers
+        )
+        assertEquals(
+                listOf(MdnsNsecRecord(
+                    TEST_CUSTOM_HOST_1_NAME,
+                    0L,
+                    true,
+                    SHORT_TTL,
+                    TEST_CUSTOM_HOST_1_NAME /* nextDomain */,
+                    intArrayOf(TYPE_AAAA)
+                )),
+                reply.additionalAnswers
+        )
     }
 
     @Test
@@ -950,24 +1299,46 @@ class MdnsRecordRepositoryTest {
         val reply1 = repository.getReply(query1, src)
 
         assertNotNull(reply1)
-        assertEquals(listOf(MdnsKeyRecord(serviceName1,
-                0, false, LONG_TTL, TEST_PUBLIC_KEY)),
-                reply1.answers)
-        assertEquals(listOf(),
-                reply1.additionalAnswers)
+        assertEquals(
+            listOf(MdnsKeyRecord(
+                serviceName1,
+                0,
+                false,
+                LONG_TTL,
+                TEST_PUBLIC_KEY
+            )),
+            reply1.answers
+        )
+        assertEquals(
+            listOf(),
+            reply1.additionalAnswers
+        )
 
         val query2 = makeQuery(TYPE_KEY to serviceName2)
         val reply2 = repository.getReply(query2, src)
 
         assertNotNull(reply2)
-        assertEquals(listOf(MdnsKeyRecord(serviceName2,
-                0, false, LONG_TTL, TEST_PUBLIC_KEY)),
-                reply2.answers)
-        assertEquals(listOf(MdnsNsecRecord(serviceName2,
-                0L, true, SHORT_TTL,
+        assertEquals(
+            listOf(MdnsKeyRecord(
+                serviceName2,
+                0,
+                false,
+                LONG_TTL,
+                TEST_PUBLIC_KEY
+            )),
+            reply2.answers
+        )
+        assertEquals(
+            listOf(MdnsNsecRecord(
+                serviceName2,
+                0L,
+                true,
+                SHORT_TTL,
                 serviceName2 /* nextDomain */,
-                intArrayOf(TYPE_KEY))),
-                reply2.additionalAnswers)
+                intArrayOf(TYPE_KEY)
+            )),
+            reply2.additionalAnswers
+        )
     }
 
     @Test
@@ -994,23 +1365,46 @@ class MdnsRecordRepositoryTest {
         val reply1 = repository.getReply(query1, src)
 
         assertNotNull(reply1)
-        assertEquals(listOf(MdnsKeyRecord(hostname1,
-                0, false, LONG_TTL, TEST_PUBLIC_KEY)),
-                reply1.answers)
-        assertEquals(listOf(),
-                reply1.additionalAnswers)
+        assertEquals(
+            listOf(MdnsKeyRecord(
+                hostname1,
+                0,
+                false,
+                LONG_TTL,
+                TEST_PUBLIC_KEY
+            )),
+            reply1.answers
+        )
+        assertEquals(
+            listOf(),
+            reply1.additionalAnswers
+        )
 
         val query2 = makeQuery(TYPE_KEY to hostname2)
         val reply2 = repository.getReply(query2, src)
 
         assertNotNull(reply2)
-        assertEquals(listOf(MdnsKeyRecord(hostname2,
-                0, false, LONG_TTL, TEST_PUBLIC_KEY)),
-                reply2.answers)
-        assertEquals(listOf(MdnsNsecRecord(hostname2, 0L, true, SHORT_TTL,
+        assertEquals(
+            listOf(MdnsKeyRecord(
+                hostname2,
+                0,
+                false,
+                LONG_TTL,
+                TEST_PUBLIC_KEY
+            )),
+            reply2.answers
+        )
+        assertEquals(
+            listOf(MdnsNsecRecord(
+                hostname2,
+                0L,
+                true,
+                SHORT_TTL,
                 hostname2 /* nextDomain */,
-                intArrayOf(TYPE_KEY))),
-                reply2.additionalAnswers)
+                intArrayOf(TYPE_KEY)
+            )),
+            reply2.additionalAnswers
+        )
     }
 
     @Test
@@ -1083,10 +1477,16 @@ class MdnsRecordRepositoryTest {
     fun testGetReply_customHostRemoved_noAnswerToAAAAQuestion() {
         val repository = MdnsRecordRepository(thread.looper, deps, TEST_HOSTNAME, makeFlags())
         repository.initWithService(
-                TEST_CUSTOM_HOST_ID_1, TEST_CUSTOM_HOST_1, subtypes = setOf(),
-                listOf(LinkAddress(parseNumericAddress("192.0.2.111"), 24)))
+            TEST_CUSTOM_HOST_ID_1,
+            TEST_CUSTOM_HOST_1,
+            subtypes = setOf(),
+            listOf(LinkAddress(parseNumericAddress("192.0.2.111"), 24))
+        )
         repository.addService(
-                TEST_SERVICE_CUSTOM_HOST_ID_1, TEST_SERVICE_CUSTOM_HOST_1, null /* ttl */)
+            TEST_SERVICE_CUSTOM_HOST_ID_1,
+            TEST_SERVICE_CUSTOM_HOST_1,
+            null /* ttl */
+        )
         repository.removeService(TEST_CUSTOM_HOST_ID_1)
         repository.removeService(TEST_SERVICE_CUSTOM_HOST_ID_1)
 
@@ -1107,16 +1507,33 @@ class MdnsRecordRepositoryTest {
 
         val query = makeQuery(
                 TYPE_PTR to arrayOf("_testservice", "_tcp", "local"),
-                TYPE_SRV to serviceName)
+                TYPE_SRV to serviceName
+        )
         val reply = repository.getReply(query, src)
 
         assertNotNull(reply)
-        assertEquals(listOf(
+        assertEquals(
+            listOf(
                 MdnsPointerRecord(
-                    arrayOf("_testservice", "_tcp", "local"), 0L, false, LONG_TTL, serviceName),
+                    arrayOf("_testservice", "_tcp", "local"),
+                    0L,
+                    false,
+                    LONG_TTL,
+                    serviceName
+                ),
                 MdnsServiceRecord(
-                    serviceName, 0L, true, SHORT_TTL, 0, 0, TEST_PORT, TEST_HOSTNAME)),
-            reply.answers)
+                    serviceName,
+                    0L,
+                    true,
+                    SHORT_TTL,
+                    0,
+                    0,
+                    TEST_PORT,
+                    TEST_HOSTNAME
+                )
+            ),
+            reply.answers
+        )
         assertFalse(reply.additionalAnswers.any { it -> it is MdnsServiceRecord })
     }
 
@@ -1132,26 +1549,60 @@ class MdnsRecordRepositoryTest {
                 TYPE_TXT to serviceName,
                 TYPE_SRV to serviceName,
                 TYPE_A to TEST_HOSTNAME,
-                TYPE_AAAA to TEST_HOSTNAME)
+                TYPE_AAAA to TEST_HOSTNAME
+        )
         val reply = repository.getReply(query, src)
 
         assertNotNull(reply)
-        assertEquals(listOf(
+        assertEquals(
+            listOf(
                 MdnsServiceRecord(serviceName, 0L, true, SHORT_TTL, 0, 0, TEST_PORT, TEST_HOSTNAME),
                 MdnsTextRecord(serviceName, 0L, true, LONG_TTL, emptyList()),
                 MdnsInetAddressRecord(
-                        TEST_HOSTNAME, 0L, true, SHORT_TTL, TEST_ADDRESSES[0].address),
+                    TEST_HOSTNAME,
+                    0L,
+                    true,
+                    SHORT_TTL,
+                    TEST_ADDRESSES[0].address
+                ),
                 MdnsInetAddressRecord(
-                        TEST_HOSTNAME, 0L, true, SHORT_TTL, TEST_ADDRESSES[1].address),
+                    TEST_HOSTNAME,
+                    0L,
+                    true,
+                    SHORT_TTL,
+                    TEST_ADDRESSES[1].address
+                ),
                 MdnsInetAddressRecord(
-                        TEST_HOSTNAME, 0L, true, SHORT_TTL, TEST_ADDRESSES[2].address)),
-            reply.answers)
-        assertEquals(listOf(
-                MdnsNsecRecord(serviceName, 0L, true, LONG_TTL, serviceName /* nextDomain */,
-                        intArrayOf(TYPE_TXT, TYPE_SRV)),
-                MdnsNsecRecord(TEST_HOSTNAME, 0L, true, SHORT_TTL, TEST_HOSTNAME /* nextDomain */,
-                        intArrayOf(TYPE_A, TYPE_AAAA))),
-            reply.additionalAnswers)
+                    TEST_HOSTNAME,
+                    0L,
+                    true,
+                    SHORT_TTL,
+                    TEST_ADDRESSES[2].address
+                )
+            ),
+            reply.answers
+        )
+        assertEquals(
+            listOf(
+                MdnsNsecRecord(
+                    serviceName,
+                    0L,
+                    true,
+                    LONG_TTL,
+                    serviceName /* nextDomain */,
+                    intArrayOf(TYPE_TXT, TYPE_SRV)
+                ),
+                MdnsNsecRecord(
+                    TEST_HOSTNAME,
+                    0L,
+                    true,
+                    SHORT_TTL,
+                    TEST_HOSTNAME /* nextDomain */,
+                    intArrayOf(TYPE_A, TYPE_AAAA)
+                )
+            ),
+            reply.additionalAnswers
+        )
     }
 
     @Test
@@ -1218,7 +1669,6 @@ class MdnsRecordRepositoryTest {
         assertNull(secondReply)
     }
 
-
     @Test
     fun testGetReply_twoIpv6QueriesInOneSecond_theSecondReplyIsThrottled() {
         val repository = MdnsRecordRepository(thread.looper, deps, TEST_HOSTNAME, makeFlags())
@@ -1289,24 +1739,34 @@ class MdnsRecordRepositoryTest {
                 emptyList() /* questions */,
                 listOf(
                     MdnsServiceRecord(
-                            arrayOf("MyTestService", "_testservice", "_tcp", "local"),
-                            0L /* receiptTimeMillis */, true /* cacheFlush */, 0L /* ttlMillis */,
-                            0 /* servicePriority */, 0 /* serviceWeight */,
-                            TEST_SERVICE_1.port + 1,
-                            TEST_HOSTNAME),
+                        arrayOf("MyTestService", "_testservice", "_tcp", "local"),
+                        0L /* receiptTimeMillis */,
+                        true /* cacheFlush */,
+                        0L /* ttlMillis */,
+                        0 /* servicePriority */,
+                        0 /* serviceWeight */,
+                        TEST_SERVICE_1.port + 1,
+                        TEST_HOSTNAME
+                    ),
                     MdnsTextRecord(
-                            arrayOf("MyOtherTestService", "_testservice", "_tcp", "local"),
-                            0L /* receiptTimeMillis */, true /* cacheFlush */, 0L /* ttlMillis */,
-                            listOf(TextEntry.fromString("somedifferent=entry"))),
+                        arrayOf("MyOtherTestService", "_testservice", "_tcp", "local"),
+                        0L /* receiptTimeMillis */,
+                        true /* cacheFlush */,
+                        0L /* ttlMillis */,
+                        listOf(TextEntry.fromString("somedifferent=entry"))
+                    ),
                 ) /* answers */,
                 emptyList() /* authorityRecords */,
-                emptyList() /* additionalRecords */)
+                emptyList() /* additionalRecords */
+        )
 
         assertEquals(
                 mapOf(
                         TEST_SERVICE_ID_1 to CONFLICT_SERVICE,
-                        TEST_SERVICE_ID_2 to CONFLICT_SERVICE),
-                repository.getConflictingServices(packet))
+                        TEST_SERVICE_ID_2 to CONFLICT_SERVICE
+                ),
+                repository.getConflictingServices(packet)
+        )
     }
 
     @Test
@@ -1321,22 +1781,33 @@ class MdnsRecordRepositoryTest {
             listOf(
                 MdnsServiceRecord(
                     arrayOf("MYTESTSERVICE", "_TESTSERVICE", "_tcp", "local"),
-                    0L /* receiptTimeMillis */, true /* cacheFlush */, 0L /* ttlMillis */,
-                    0 /* servicePriority */, 0 /* serviceWeight */,
+                    0L /* receiptTimeMillis */,
+                    true /* cacheFlush */,
+                    0L /* ttlMillis */,
+                    0 /* servicePriority */,
+                    0 /* serviceWeight */,
                     TEST_SERVICE_1.port + 1,
-                    TEST_HOSTNAME),
+                    TEST_HOSTNAME
+                ),
                 MdnsTextRecord(
                     arrayOf("MYOTHERTESTSERVICE", "_TESTSERVICE", "_tcp", "local"),
-                    0L /* receiptTimeMillis */, true /* cacheFlush */, 0L /* ttlMillis */,
-                    listOf(TextEntry.fromString("somedifferent=entry"))),
+                    0L /* receiptTimeMillis */,
+                    true /* cacheFlush */,
+                    0L /* ttlMillis */,
+                    listOf(TextEntry.fromString("somedifferent=entry"))
+                ),
             ) /* answers */,
             emptyList() /* authorityRecords */,
-            emptyList() /* additionalRecords */)
+            emptyList() /* additionalRecords */
+        )
 
         assertEquals(
-                mapOf(TEST_SERVICE_ID_1 to CONFLICT_SERVICE,
-                        TEST_SERVICE_ID_2 to CONFLICT_SERVICE),
-                repository.getConflictingServices(packet))
+                mapOf(
+                    TEST_SERVICE_ID_1 to CONFLICT_SERVICE,
+                    TEST_SERVICE_ID_2 to CONFLICT_SERVICE
+                ),
+                repository.getConflictingServices(packet)
+        )
     }
 
     @Test
@@ -1349,18 +1820,29 @@ class MdnsRecordRepositoryTest {
                 0, /* flags */
                 emptyList(), /* questions */
                 listOf(
-                        MdnsInetAddressRecord(arrayOf("TestHost", "local"),
-                                0L /* receiptTimeMillis */, true /* cacheFlush */,
-                                0L /* ttlMillis */, parseNumericAddress("2001:db8::5")),
-                        MdnsInetAddressRecord(arrayOf("TestHost", "local"),
-                                0L /* receiptTimeMillis */, true /* cacheFlush */,
-                                0L /* ttlMillis */, parseNumericAddress("2001:db8::6")),
+                        MdnsInetAddressRecord(
+                            arrayOf("TestHost", "local"),
+                            0L /* receiptTimeMillis */,
+                            true /* cacheFlush */,
+                            0L /* ttlMillis */,
+                            parseNumericAddress("2001:db8::5")
+                        ),
+                        MdnsInetAddressRecord(
+                            arrayOf("TestHost", "local"),
+                            0L /* receiptTimeMillis */,
+                            true /* cacheFlush */,
+                            0L /* ttlMillis */,
+                            parseNumericAddress("2001:db8::6")
+                        ),
                 ) /* answers */,
                 emptyList() /* authorityRecords */,
-                emptyList() /* additionalRecords */)
+                emptyList() /* additionalRecords */
+        )
 
-        assertEquals(mapOf(TEST_CUSTOM_HOST_ID_1 to CONFLICT_HOST),
-                repository.getConflictingServices(packet))
+        assertEquals(
+            mapOf(TEST_CUSTOM_HOST_ID_1 to CONFLICT_HOST),
+                repository.getConflictingServices(packet)
+        )
     }
 
     @Test
@@ -1373,21 +1855,36 @@ class MdnsRecordRepositoryTest {
                 0, /* flags */
                 emptyList(), /* questions */
                 listOf(
-                        MdnsInetAddressRecord(arrayOf("TestHost", "local"),
-                                0L /* receiptTimeMillis */, true /* cacheFlush */,
-                                0L /* ttlMillis */, parseNumericAddress("2001:db8::1")),
-                        MdnsInetAddressRecord(arrayOf("TestHost", "local"),
-                                0L /* receiptTimeMillis */, true /* cacheFlush */,
-                                0L /* ttlMillis */, parseNumericAddress("2001:db8::2")),
-                        MdnsInetAddressRecord(arrayOf("TestHost", "local"),
-                                0L /* receiptTimeMillis */, true /* cacheFlush */,
-                                0L /* ttlMillis */, parseNumericAddress("2001:db8::3")),
+                        MdnsInetAddressRecord(
+                            arrayOf("TestHost", "local"),
+                            0L /* receiptTimeMillis */,
+                            true /* cacheFlush */,
+                            0L /* ttlMillis */,
+                            parseNumericAddress("2001:db8::1")
+                        ),
+                        MdnsInetAddressRecord(
+                            arrayOf("TestHost", "local"),
+                            0L /* receiptTimeMillis */,
+                            true /* cacheFlush */,
+                            0L /* ttlMillis */,
+                            parseNumericAddress("2001:db8::2")
+                        ),
+                        MdnsInetAddressRecord(
+                            arrayOf("TestHost", "local"),
+                            0L /* receiptTimeMillis */,
+                            true /* cacheFlush */,
+                            0L /* ttlMillis */,
+                            parseNumericAddress("2001:db8::3")
+                        ),
                 ) /* answers */,
                 emptyList() /* authorityRecords */,
-                emptyList() /* additionalRecords */)
+                emptyList() /* additionalRecords */
+        )
 
-        assertEquals(mapOf(TEST_CUSTOM_HOST_ID_1 to CONFLICT_HOST),
-                repository.getConflictingServices(packet))
+        assertEquals(
+            mapOf(TEST_CUSTOM_HOST_ID_1 to CONFLICT_HOST),
+            repository.getConflictingServices(packet)
+        )
     }
 
     @Test
@@ -1400,15 +1897,22 @@ class MdnsRecordRepositoryTest {
                 0, /* flags */
                 emptyList(), /* questions */
                 listOf(
-                        MdnsInetAddressRecord(arrayOf("TestHost", "local"),
-                                0L /* receiptTimeMillis */, true /* cacheFlush */,
-                                0L /* ttlMillis */, parseNumericAddress("2001:db8::2")),
+                        MdnsInetAddressRecord(
+                            arrayOf("TestHost", "local"),
+                            0L /* receiptTimeMillis */,
+                            true /* cacheFlush */,
+                            0L /* ttlMillis */,
+                            parseNumericAddress("2001:db8::2")
+                        ),
                 ) /* answers */,
                 emptyList() /* authorityRecords */,
-                emptyList() /* additionalRecords */)
+                emptyList() /* additionalRecords */
+        )
 
-        assertEquals(emptyMap(),
-                repository.getConflictingServices(packet))
+        assertEquals(
+            emptyMap(),
+            repository.getConflictingServices(packet)
+        )
     }
 
     @Test
@@ -1420,15 +1924,23 @@ class MdnsRecordRepositoryTest {
         val packet = MdnsPacket(
             0, /* flags */
             emptyList(), /* questions */
-            listOf(MdnsKeyRecord(arrayOf("TestHost", "local"),
-                    0L /* receiptTimeMillis */, true /* cacheFlush */,
-                    0L /* ttlMillis */, TEST_PUBLIC_KEY),
+            listOf(
+                MdnsKeyRecord(
+                    arrayOf("TestHost", "local"),
+                    0L /* receiptTimeMillis */,
+                    true /* cacheFlush */,
+                    0L /* ttlMillis */,
+                    TEST_PUBLIC_KEY
+                ),
             ) /* answers */,
             emptyList() /* authorityRecords */,
-            emptyList() /* additionalRecords */)
+            emptyList() /* additionalRecords */
+        )
 
-        assertEquals(mapOf(TEST_CUSTOM_HOST_ID_1 to CONFLICT_HOST),
-            repository.getConflictingServices(packet))
+        assertEquals(
+            mapOf(TEST_CUSTOM_HOST_ID_1 to CONFLICT_HOST),
+            repository.getConflictingServices(packet)
+        )
     }
 
     @Test
@@ -1441,21 +1953,31 @@ class MdnsRecordRepositoryTest {
                 0, /* flags */
                 emptyList(), /* questions */
                 listOf(
-                        MdnsInetAddressRecord(arrayOf("TestHost", "local"),
-                                0L /* receiptTimeMillis */, true /* cacheFlush */,
-                                0L /* ttlMillis */, parseNumericAddress("2001:db8::1")),
-                        MdnsInetAddressRecord(arrayOf("TestHost", "local"),
-                                0L /* receiptTimeMillis */, true /* cacheFlush */,
-                                0L /* ttlMillis */, parseNumericAddress("2001:db8::2")),
+                        MdnsInetAddressRecord(
+                            arrayOf("TestHost", "local"),
+                            0L /* receiptTimeMillis */,
+                            true /* cacheFlush */,
+                            0L /* ttlMillis */,
+                            parseNumericAddress("2001:db8::1")
+                        ),
+                        MdnsInetAddressRecord(
+                            arrayOf("TestHost", "local"),
+                            0L /* receiptTimeMillis */,
+                            true /* cacheFlush */,
+                            0L /* ttlMillis */,
+                            parseNumericAddress("2001:db8::2")
+                        ),
                 ) /* answers */,
                 emptyList() /* authorityRecords */,
-                emptyList() /* additionalRecords */)
+                emptyList() /* additionalRecords */
+        )
 
-        assertEquals(emptyMap(),
-                repository.getConflictingServices(packet))
+        assertEquals(
+            emptyMap(),
+            repository.getConflictingServices(packet)
+        )
     }
 
-
     @Test
     fun testGetConflictingServices_customHostsCaseInsensitiveReplyHasIdenticalHosts_noConflict() {
         val repository = MdnsRecordRepository(thread.looper, deps, TEST_HOSTNAME, makeFlags())
@@ -1466,18 +1988,29 @@ class MdnsRecordRepositoryTest {
                 0, /* flags */
                 emptyList(), /* questions */
                 listOf(
-                        MdnsInetAddressRecord(arrayOf("TESTHOST", "local"),
-                                0L /* receiptTimeMillis */, true /* cacheFlush */,
-                                0L /* ttlMillis */, parseNumericAddress("2001:db8::1")),
-                        MdnsInetAddressRecord(arrayOf("testhost", "local"),
-                                0L /* receiptTimeMillis */, true /* cacheFlush */,
-                                0L /* ttlMillis */, parseNumericAddress("2001:db8::2")),
+                        MdnsInetAddressRecord(
+                            arrayOf("TESTHOST", "local"),
+                            0L /* receiptTimeMillis */,
+                            true /* cacheFlush */,
+                            0L /* ttlMillis */,
+                            parseNumericAddress("2001:db8::1")
+                        ),
+                        MdnsInetAddressRecord(
+                            arrayOf("testhost", "local"),
+                            0L /* receiptTimeMillis */,
+                            true /* cacheFlush */,
+                            0L /* ttlMillis */,
+                            parseNumericAddress("2001:db8::2")
+                        ),
                 ) /* answers */,
                 emptyList() /* authorityRecords */,
-                emptyList() /* additionalRecords */)
+                emptyList() /* additionalRecords */
+        )
 
-        assertEquals(emptyMap(),
-                repository.getConflictingServices(packet))
+        assertEquals(
+            emptyMap(),
+            repository.getConflictingServices(packet)
+        )
     }
 
     @Test
@@ -1497,16 +2030,21 @@ class MdnsRecordRepositoryTest {
                 emptyList() /* questions */,
                 listOf(
                         MdnsKeyRecord(
-                                arrayOf("MyTestService", "_testservice", "_tcp", "local"),
-                                0L /* receiptTimeMillis */, true /* cacheFlush */,
-                                otherTtlMillis,
-                                TEST_PUBLIC_KEY)
+                            arrayOf("MyTestService", "_testservice", "_tcp", "local"),
+                            0L /* receiptTimeMillis */,
+                            true /* cacheFlush */,
+                            otherTtlMillis,
+                            TEST_PUBLIC_KEY
+                        )
                 ) /* answers */,
                 emptyList() /* authorityRecords */,
-                emptyList() /* additionalRecords */)
+                emptyList() /* additionalRecords */
+        )
 
-        assertEquals(emptyMap(),
-                repository.getConflictingServices(packet))
+        assertEquals(
+            emptyMap(),
+            repository.getConflictingServices(packet)
+        )
     }
 
     @Test
@@ -1526,16 +2064,21 @@ class MdnsRecordRepositoryTest {
                 emptyList() /* questions */,
                 listOf(
                         MdnsKeyRecord(
-                                arrayOf("MyTestService", "_testservice", "_tcp", "local"),
-                                0L /* receiptTimeMillis */, true /* cacheFlush */,
-                                otherTtlMillis,
-                                TEST_PUBLIC_KEY_2)
+                            arrayOf("MyTestService", "_testservice", "_tcp", "local"),
+                            0L /* receiptTimeMillis */,
+                            true /* cacheFlush */,
+                            otherTtlMillis,
+                            TEST_PUBLIC_KEY_2
+                        )
                 ) /* answers */,
                 emptyList() /* authorityRecords */,
-                emptyList() /* additionalRecords */)
+                emptyList() /* additionalRecords */
+        )
 
-        assertEquals(mapOf(TEST_SERVICE_ID_1 to CONFLICT_SERVICE),
-                repository.getConflictingServices(packet))
+        assertEquals(
+            mapOf(TEST_SERVICE_ID_1 to CONFLICT_SERVICE),
+            repository.getConflictingServices(packet)
+        )
     }
 
     @Test
@@ -1557,16 +2100,21 @@ class MdnsRecordRepositoryTest {
                 emptyList() /* questions */,
                 listOf(
                         MdnsKeyRecord(
-                                arrayOf("MyHost", "local"),
-                                0L /* receiptTimeMillis */, true /* cacheFlush */,
-                                otherTtlMillis,
-                                TEST_PUBLIC_KEY)
+                            arrayOf("MyHost", "local"),
+                            0L /* receiptTimeMillis */,
+                            true /* cacheFlush */,
+                            otherTtlMillis,
+                            TEST_PUBLIC_KEY
+                        )
                 ) /* answers */,
                 emptyList() /* authorityRecords */,
-                emptyList() /* additionalRecords */)
+                emptyList() /* additionalRecords */
+        )
 
-        assertEquals(emptyMap(),
-                repository.getConflictingServices(packet))
+        assertEquals(
+            emptyMap(),
+            repository.getConflictingServices(packet)
+        )
     }
 
     @Test
@@ -1582,18 +2130,23 @@ class MdnsRecordRepositoryTest {
         val packet = MdnsPacket(
             0 /* flags */,
             emptyList() /* questions */,
-            listOf(MdnsInetAddressRecord(arrayOf("MyHost", "local"),
+            listOf(
+                MdnsInetAddressRecord(
+                    arrayOf("MyHost", "local"),
                     0L /* receiptTimeMillis */,
                     true /* cacheFlush */,
                     otherTtlMillis,
-                    parseNumericAddress("192.168.2.111"))
+                    parseNumericAddress("192.168.2.111")
+                )
             ) /* answers */,
             emptyList() /* authorityRecords */,
             emptyList() /* additionalRecords */
         )
 
-        assertEquals(mapOf(TEST_SERVICE_ID_1 to CONFLICT_HOST),
-            repository.getConflictingServices(packet))
+        assertEquals(
+            mapOf(TEST_SERVICE_ID_1 to CONFLICT_HOST),
+            repository.getConflictingServices(packet)
+        )
     }
 
     @Test
@@ -1614,16 +2167,21 @@ class MdnsRecordRepositoryTest {
                 emptyList() /* questions */,
                 listOf(
                         MdnsKeyRecord(
-                                arrayOf("MyHost", "local"),
-                                0L /* receiptTimeMillis */, true /* cacheFlush */,
-                                otherTtlMillis,
-                                TEST_PUBLIC_KEY_2)
+                            arrayOf("MyHost", "local"),
+                            0L /* receiptTimeMillis */,
+                            true /* cacheFlush */,
+                            otherTtlMillis,
+                            TEST_PUBLIC_KEY_2
+                        )
                 ) /* answers */,
                 emptyList() /* authorityRecords */,
-                emptyList() /* additionalRecords */)
+                emptyList() /* additionalRecords */
+        )
 
-        assertEquals(mapOf(TEST_SERVICE_ID_1 to CONFLICT_HOST),
-                repository.getConflictingServices(packet))
+        assertEquals(
+            mapOf(TEST_SERVICE_ID_1 to CONFLICT_HOST),
+            repository.getConflictingServices(packet)
+        )
     }
 
     @Test
@@ -1654,12 +2212,15 @@ class MdnsRecordRepositoryTest {
             listOf(
                 MdnsInetAddressRecord(
                     arrayOf("MyHost", "local"),
-                    0L /* receiptTimeMillis */, true /* cacheFlush */,
+                    0L /* receiptTimeMillis */,
+                    true /* cacheFlush */,
                     otherTtlMillis,
-                    parseNumericAddress("2001:db8::1"))
+                    parseNumericAddress("2001:db8::1")
+                )
             ) /* answers */,
             emptyList() /* authorityRecords */,
-            emptyList() /* additionalRecords */)
+            emptyList() /* additionalRecords */
+        )
 
         assertEquals(mapOf(), repository.getConflictingServices(packet))
     }
@@ -1676,18 +2237,26 @@ class MdnsRecordRepositoryTest {
                 emptyList() /* questions */,
                 listOf(
                         MdnsServiceRecord(
-                                arrayOf("MyTestService", "_testservice", "_tcp", "local"),
-                                0L /* receiptTimeMillis */, true /* cacheFlush */,
-                                otherTtlMillis, 0 /* servicePriority */, 0 /* serviceWeight */,
-                                TEST_SERVICE_1.port,
-                                arrayOf("ANDROID_000102030405060708090A0B0C0D0E0F", "local")),
+                            arrayOf("MyTestService", "_testservice", "_tcp", "local"),
+                            0L /* receiptTimeMillis */,
+                            true /* cacheFlush */,
+                            otherTtlMillis,
+                            0 /* servicePriority */,
+                            0 /* serviceWeight */,
+                            TEST_SERVICE_1.port,
+                            arrayOf("ANDROID_000102030405060708090A0B0C0D0E0F", "local")
+                        ),
                         MdnsTextRecord(
-                                arrayOf("MyOtherTestService", "_testservice", "_tcp", "local"),
-                                0L /* receiptTimeMillis */, true /* cacheFlush */,
-                                otherTtlMillis, emptyList()),
+                            arrayOf("MyOtherTestService", "_testservice", "_tcp", "local"),
+                            0L /* receiptTimeMillis */,
+                            true /* cacheFlush */,
+                            otherTtlMillis,
+                            emptyList()
+                        ),
                 ) /* answers */,
                 emptyList() /* authorityRecords */,
-                emptyList() /* additionalRecords */)
+                emptyList() /* additionalRecords */
+        )
 
         // Above records are identical to the actual registrations: no conflict
         assertEquals(emptyMap(), repository.getConflictingServices(packet))
@@ -1705,18 +2274,26 @@ class MdnsRecordRepositoryTest {
                 emptyList() /* questions */,
                 listOf(
                         MdnsServiceRecord(
-                                arrayOf("MYTESTSERVICE", "_TESTSERVICE", "_tcp", "local"),
-                                0L /* receiptTimeMillis */, true /* cacheFlush */,
-                                otherTtlMillis, 0 /* servicePriority */, 0 /* serviceWeight */,
-                                TEST_SERVICE_1.port,
-                                TEST_HOSTNAME),
+                            arrayOf("MYTESTSERVICE", "_TESTSERVICE", "_tcp", "local"),
+                            0L /* receiptTimeMillis */,
+                            true /* cacheFlush */,
+                            otherTtlMillis,
+                            0 /* servicePriority */,
+                            0 /* serviceWeight */,
+                            TEST_SERVICE_1.port,
+                            TEST_HOSTNAME
+                        ),
                         MdnsTextRecord(
-                                arrayOf("MyOtherTestService", "_TESTSERVICE", "_tcp", "local"),
-                                0L /* receiptTimeMillis */, true /* cacheFlush */,
-                                otherTtlMillis, emptyList()),
+                            arrayOf("MyOtherTestService", "_TESTSERVICE", "_tcp", "local"),
+                            0L /* receiptTimeMillis */,
+                            true /* cacheFlush */,
+                            otherTtlMillis,
+                            emptyList()
+                        ),
                 ) /* answers */,
                 emptyList() /* authorityRecords */,
-                emptyList() /* additionalRecords */)
+                emptyList() /* additionalRecords */
+        )
 
         // Above records are identical to the actual registrations: no conflict
         assertEquals(emptyMap(), repository.getConflictingServices(packet))
@@ -1751,13 +2328,21 @@ class MdnsRecordRepositoryTest {
         val repository = MdnsRecordRepository(thread.looper, deps, TEST_HOSTNAME, makeFlags())
         repository.initWithService(TEST_SERVICE_ID_1, TEST_SERVICE_1)
         // Verify that there is no packet replied.
-        assertEquals(MdnsConstants.NO_PACKET,
-                repository.getServiceRepliedRequestsCount(TEST_SERVICE_ID_1))
+        assertEquals(
+            MdnsConstants.NO_PACKET,
+            repository.getServiceRepliedRequestsCount(TEST_SERVICE_ID_1)
+        )
 
         val questions = listOf(
-                MdnsPointerRecord(arrayOf("_testservice", "_tcp", "local"), false /* isUnicast */))
-        val query = MdnsPacket(0 /* flags */, questions, emptyList() /* answers */,
-                emptyList() /* authorityRecords */, emptyList() /* additionalRecords */)
+                MdnsPointerRecord(arrayOf("_testservice", "_tcp", "local"), false /* isUnicast */)
+        )
+        val query = MdnsPacket(
+            0 /* flags */,
+            questions,
+            emptyList() /* answers */,
+            emptyList() /* authorityRecords */,
+            emptyList() /* additionalRecords */
+        )
         val src = InetSocketAddress(parseNumericAddress("192.0.2.123"), 5353)
 
         // Reply to the question and verify there is one packet replied.
@@ -1766,18 +2351,26 @@ class MdnsRecordRepositoryTest {
         assertEquals(1, repository.getServiceRepliedRequestsCount(TEST_SERVICE_ID_1))
 
         // No package replied for unknown service.
-        assertEquals(MdnsConstants.NO_PACKET,
-                repository.getServiceRepliedRequestsCount(TEST_SERVICE_ID_2))
+        assertEquals(
+            MdnsConstants.NO_PACKET,
+            repository.getServiceRepliedRequestsCount(TEST_SERVICE_ID_2)
+        )
     }
 
     @Test
     fun testIncludeInetAddressRecordsInProbing() {
-        val repository = MdnsRecordRepository(thread.looper, deps, TEST_HOSTNAME,
-            makeFlags(includeInetAddressesInProbing = true))
+        val repository = MdnsRecordRepository(
+            thread.looper,
+            deps,
+            TEST_HOSTNAME,
+            makeFlags(includeInetAddressesInProbing = true)
+        )
         repository.updateAddresses(TEST_ADDRESSES)
         assertEquals(0, repository.servicesCount)
-        assertEquals(-1,
-                repository.addService(TEST_SERVICE_ID_1, TEST_SERVICE_1, null /* ttl */))
+        assertEquals(
+            -1,
+            repository.addService(TEST_SERVICE_ID_1, TEST_SERVICE_1, null /* ttl */)
+        )
         assertEquals(1, repository.servicesCount)
 
         val probingInfo = repository.setServiceProbing(TEST_SERVICE_ID_1)
@@ -1808,25 +2401,29 @@ class MdnsRecordRepositoryTest {
                 0 /* servicePriority */,
                 0 /* serviceWeight */,
                 TEST_PORT,
-                TEST_HOSTNAME),
+                TEST_HOSTNAME
+            ),
             MdnsInetAddressRecord(
                 TEST_HOSTNAME,
                 0L /* receiptTimeMillis */,
                 false /* cacheFlush */,
                 SHORT_TTL /* ttlMillis */,
-                TEST_ADDRESSES[0].address),
+                TEST_ADDRESSES[0].address
+            ),
             MdnsInetAddressRecord(
                 TEST_HOSTNAME,
                 0L /* receiptTimeMillis */,
                 false /* cacheFlush */,
                 SHORT_TTL /* ttlMillis */,
-                TEST_ADDRESSES[1].address),
+                TEST_ADDRESSES[1].address
+            ),
             MdnsInetAddressRecord(
                 TEST_HOSTNAME,
                 0L /* receiptTimeMillis */,
                 false /* cacheFlush */,
                 SHORT_TTL /* ttlMillis */,
-                TEST_ADDRESSES[2].address)
+                TEST_ADDRESSES[2].address
+            )
         ), packet.authorityRecords)
 
         assertContentEquals(intArrayOf(TEST_SERVICE_ID_1), repository.clearServices())
@@ -1838,11 +2435,20 @@ class MdnsRecordRepositoryTest {
             replyAnswers: List<MdnsRecord>,
             additionalAnswers: List<MdnsRecord>
     ) {
-        val repository = MdnsRecordRepository(thread.looper, deps, TEST_HOSTNAME,
-            makeFlags(isKnownAnswerSuppressionEnabled = true))
+        val repository = MdnsRecordRepository(
+            thread.looper,
+            deps,
+            TEST_HOSTNAME,
+            makeFlags(isKnownAnswerSuppressionEnabled = true)
+        )
         repository.initWithService(TEST_SERVICE_ID_1, TEST_SERVICE_1)
-        val query = MdnsPacket(0 /* flags */, questions, knownAnswers,
-                emptyList() /* authorityRecords */, emptyList() /* additionalRecords */)
+        val query = MdnsPacket(
+            0 /* flags */,
+            questions,
+            knownAnswers,
+            emptyList() /* authorityRecords */,
+            emptyList() /* additionalRecords */
+        )
         val src = InetSocketAddress(parseNumericAddress("192.0.2.123"), 5353)
         val reply = repository.getReply(query, src)
 
@@ -1869,9 +2475,14 @@ class MdnsRecordRepositoryTest {
                 0L /* receiptTimeMillis */,
                 false /* cacheFlush */,
                 LONG_TTL,
-                arrayOf("MyTestService", "_testservice", "_tcp", "local")))
-        doGetReplyWithAnswersTest(questions, knownAnswers, emptyList() /* replyAnswers */,
-                emptyList() /* additionalAnswers */)
+                arrayOf("MyTestService", "_testservice", "_tcp", "local")
+        ))
+        doGetReplyWithAnswersTest(
+            questions,
+            knownAnswers,
+            emptyList() /* replyAnswers */,
+            emptyList() /* additionalAnswers */
+        )
     }
 
     @Test
@@ -1884,20 +2495,23 @@ class MdnsRecordRepositoryTest {
                 0L /* receiptTimeMillis */,
                 false /* cacheFlush */,
                 (LONG_TTL / 2 - 1000L),
-                arrayOf("MyTestService", "_testservice", "_tcp", "local")))
+                arrayOf("MyTestService", "_testservice", "_tcp", "local")
+        ))
         val replyAnswers = listOf(MdnsPointerRecord(
                 queriedName,
                 0L /* receiptTimeMillis */,
                 false /* cacheFlush */,
                 LONG_TTL,
-                serviceName))
+                serviceName
+        ))
         val additionalAnswers = listOf(
                 MdnsTextRecord(
                         serviceName,
                         0L /* receiptTimeMillis */,
                         true /* cacheFlush */,
                         LONG_TTL,
-                        emptyList() /* entries */),
+                        emptyList() /* entries */
+                ),
                 MdnsServiceRecord(
                         serviceName,
                         0L /* receiptTimeMillis */,
@@ -1906,39 +2520,46 @@ class MdnsRecordRepositoryTest {
                         0 /* servicePriority */,
                         0 /* serviceWeight */,
                         TEST_PORT,
-                        TEST_HOSTNAME),
+                        TEST_HOSTNAME
+                ),
                 MdnsInetAddressRecord(
                         TEST_HOSTNAME,
                         0L /* receiptTimeMillis */,
                         true /* cacheFlush */,
                         SHORT_TTL,
-                        TEST_ADDRESSES[0].address),
+                        TEST_ADDRESSES[0].address
+                ),
                 MdnsInetAddressRecord(
                         TEST_HOSTNAME,
                         0L /* receiptTimeMillis */,
                         true /* cacheFlush */,
                         SHORT_TTL,
-                        TEST_ADDRESSES[1].address),
+                        TEST_ADDRESSES[1].address
+                ),
                 MdnsInetAddressRecord(
                         TEST_HOSTNAME,
                         0L /* receiptTimeMillis */,
                         true /* cacheFlush */,
                         SHORT_TTL,
-                        TEST_ADDRESSES[2].address),
+                        TEST_ADDRESSES[2].address
+                ),
                 MdnsNsecRecord(
                         serviceName,
                         0L /* receiptTimeMillis */,
                         true /* cacheFlush */,
                         LONG_TTL,
                         serviceName /* nextDomain */,
-                        intArrayOf(MdnsRecord.TYPE_TXT, MdnsRecord.TYPE_SRV)),
+                        intArrayOf(MdnsRecord.TYPE_TXT, MdnsRecord.TYPE_SRV)
+                ),
                 MdnsNsecRecord(
                         TEST_HOSTNAME,
                         0L /* receiptTimeMillis */,
                         true /* cacheFlush */,
                         SHORT_TTL,
                         TEST_HOSTNAME /* nextDomain */,
-                        intArrayOf(MdnsRecord.TYPE_A, MdnsRecord.TYPE_AAAA)))
+                        intArrayOf(MdnsRecord.TYPE_A, MdnsRecord.TYPE_AAAA)
+                )
+        )
         doGetReplyWithAnswersTest(questions, knownAnswers, replyAnswers, additionalAnswers)
     }
 
@@ -1952,20 +2573,23 @@ class MdnsRecordRepositoryTest {
                 0L /* receiptTimeMillis */,
                 false /* cacheFlush */,
                 LONG_TTL,
-                arrayOf("MyOtherTestService", "_testservice", "_tcp", "local")))
+                arrayOf("MyOtherTestService", "_testservice", "_tcp", "local")
+        ))
         val replyAnswers = listOf(MdnsPointerRecord(
                 queriedName,
                 0L /* receiptTimeMillis */,
                 false /* cacheFlush */,
                 LONG_TTL,
-                serviceName))
+                serviceName
+        ))
         val additionalAnswers = listOf(
                 MdnsTextRecord(
                         serviceName,
                         0L /* receiptTimeMillis */,
                         true /* cacheFlush */,
                         LONG_TTL,
-                        emptyList() /* entries */),
+                        emptyList() /* entries */
+                ),
                 MdnsServiceRecord(
                         serviceName,
                         0L /* receiptTimeMillis */,
@@ -1974,39 +2598,46 @@ class MdnsRecordRepositoryTest {
                         0 /* servicePriority */,
                         0 /* serviceWeight */,
                         TEST_PORT,
-                        TEST_HOSTNAME),
+                        TEST_HOSTNAME
+                ),
                 MdnsInetAddressRecord(
                         TEST_HOSTNAME,
                         0L /* receiptTimeMillis */,
                         true /* cacheFlush */,
                         SHORT_TTL,
-                        TEST_ADDRESSES[0].address),
+                        TEST_ADDRESSES[0].address
+                ),
                 MdnsInetAddressRecord(
                         TEST_HOSTNAME,
                         0L /* receiptTimeMillis */,
                         true /* cacheFlush */,
                         SHORT_TTL,
-                        TEST_ADDRESSES[1].address),
+                        TEST_ADDRESSES[1].address
+                ),
                 MdnsInetAddressRecord(
                         TEST_HOSTNAME,
                         0L /* receiptTimeMillis */,
                         true /* cacheFlush */,
                         SHORT_TTL,
-                        TEST_ADDRESSES[2].address),
+                        TEST_ADDRESSES[2].address
+                ),
                 MdnsNsecRecord(
                         serviceName,
                         0L /* receiptTimeMillis */,
                         true /* cacheFlush */,
                         LONG_TTL,
                         serviceName /* nextDomain */,
-                        intArrayOf(MdnsRecord.TYPE_TXT, MdnsRecord.TYPE_SRV)),
+                        intArrayOf(MdnsRecord.TYPE_TXT, MdnsRecord.TYPE_SRV)
+                ),
                 MdnsNsecRecord(
                         TEST_HOSTNAME,
                         0L /* receiptTimeMillis */,
                         true /* cacheFlush */,
                         SHORT_TTL,
                         TEST_HOSTNAME /* nextDomain */,
-                        intArrayOf(MdnsRecord.TYPE_A, MdnsRecord.TYPE_AAAA)))
+                        intArrayOf(MdnsRecord.TYPE_A, MdnsRecord.TYPE_AAAA)
+                )
+        )
         doGetReplyWithAnswersTest(questions, knownAnswers, replyAnswers, additionalAnswers)
     }
 
@@ -2016,13 +2647,15 @@ class MdnsRecordRepositoryTest {
         val serviceName = arrayOf("MyTestService", "_testservice", "_tcp", "local")
         val questions = listOf(
                 MdnsPointerRecord(queriedName, false /* isUnicast */),
-                MdnsServiceRecord(serviceName, false /* isUnicast */))
+                MdnsServiceRecord(serviceName, false /* isUnicast */)
+        )
         val knownAnswers = listOf(MdnsPointerRecord(
                 queriedName,
                 0L /* receiptTimeMillis */,
                 false /* cacheFlush */,
                 LONG_TTL - 1000L,
-                serviceName))
+                serviceName
+        ))
         val replyAnswers = listOf(MdnsServiceRecord(
                 serviceName,
                 0L /* receiptTimeMillis */,
@@ -2031,33 +2664,39 @@ class MdnsRecordRepositoryTest {
                 0 /* servicePriority */,
                 0 /* serviceWeight */,
                 TEST_PORT,
-                TEST_HOSTNAME))
+                TEST_HOSTNAME
+        ))
         val additionalAnswers = listOf(
                 MdnsInetAddressRecord(
                         TEST_HOSTNAME,
                         0L /* receiptTimeMillis */,
                         true /* cacheFlush */,
                         SHORT_TTL,
-                        TEST_ADDRESSES[0].address),
+                        TEST_ADDRESSES[0].address
+                ),
                 MdnsInetAddressRecord(
                         TEST_HOSTNAME,
                         0L /* receiptTimeMillis */,
                         true /* cacheFlush */,
                         SHORT_TTL,
-                        TEST_ADDRESSES[1].address),
+                        TEST_ADDRESSES[1].address
+                ),
                 MdnsInetAddressRecord(
                         TEST_HOSTNAME,
                         0L /* receiptTimeMillis */,
                         true /* cacheFlush */,
                         SHORT_TTL,
-                        TEST_ADDRESSES[2].address),
+                        TEST_ADDRESSES[2].address
+                ),
                 MdnsNsecRecord(
                         TEST_HOSTNAME,
                         0L /* receiptTimeMillis */,
                         true /* cacheFlush */,
                         SHORT_TTL,
                         TEST_HOSTNAME /* nextDomain */,
-                        intArrayOf(MdnsRecord.TYPE_A, MdnsRecord.TYPE_AAAA)))
+                        intArrayOf(MdnsRecord.TYPE_A, MdnsRecord.TYPE_AAAA)
+                )
+        )
         doGetReplyWithAnswersTest(questions, knownAnswers, replyAnswers, additionalAnswers)
     }
 
@@ -2067,7 +2706,8 @@ class MdnsRecordRepositoryTest {
         val serviceName = arrayOf("MyTestService", "_testservice", "_tcp", "local")
         val questions = listOf(
                 MdnsPointerRecord(queriedName, false /* isUnicast */),
-                MdnsServiceRecord(serviceName, false /* isUnicast */))
+                MdnsServiceRecord(serviceName, false /* isUnicast */)
+        )
         val knownAnswers = listOf(
             MdnsPointerRecord(
                 queriedName,
@@ -2087,8 +2727,12 @@ class MdnsRecordRepositoryTest {
                 TEST_HOSTNAME
             )
         )
-        doGetReplyWithAnswersTest(questions, knownAnswers, emptyList() /* replyAnswers */,
-                emptyList() /* additionalAnswers */)
+        doGetReplyWithAnswersTest(
+            questions,
+            knownAnswers,
+            emptyList() /* replyAnswers */,
+            emptyList() /* additionalAnswers */
+        )
     }
 
     @Test
@@ -2099,9 +2743,15 @@ class MdnsRecordRepositoryTest {
         // Ask for 2 services, only the first one is known and requests unicast reply
         val questions = listOf(
             MdnsPointerRecord(arrayOf("_testservice", "_tcp", "local"), true /* isUnicast */),
-            MdnsPointerRecord(arrayOf("_otherservice", "_tcp", "local"), true /* isUnicast */))
-        val query = MdnsPacket(0 /* flags */, questions, emptyList() /* answers */,
-                emptyList() /* authorityRecords */, emptyList() /* additionalRecords */)
+            MdnsPointerRecord(arrayOf("_otherservice", "_tcp", "local"), true /* isUnicast */)
+        )
+        val query = MdnsPacket(
+            0 /* flags */,
+            questions,
+            emptyList() /* answers */,
+            emptyList() /* authorityRecords */,
+            emptyList() /* additionalRecords */
+        )
         val src = InetSocketAddress(parseNumericAddress("2001:db8::123"), 5353)
 
         // Reply to the question and verify it is sent to the source.
@@ -2123,9 +2773,15 @@ class MdnsRecordRepositoryTest {
         // Ask for 2 services, both are known and only the first one requests unicast reply
         val questions = listOf(
             MdnsPointerRecord(arrayOf("_testservice", "_tcp", "local"), true /* isUnicast */),
-            MdnsPointerRecord(arrayOf("_otherservice", "_tcp", "local"), false /* isUnicast */))
-        val query = MdnsPacket(0 /* flags */, questions, emptyList() /* answers */,
-                emptyList() /* authorityRecords */, emptyList() /* additionalRecords */)
+            MdnsPointerRecord(arrayOf("_otherservice", "_tcp", "local"), false /* isUnicast */)
+        )
+        val query = MdnsPacket(
+            0 /* flags */,
+            questions,
+            emptyList() /* answers */,
+            emptyList() /* authorityRecords */,
+            emptyList() /* additionalRecords */
+        )
         val src = InetSocketAddress(parseNumericAddress("2001:db8::123"), 5353)
 
         // Reply to the question and verify it is sent multicast.
@@ -2142,9 +2798,15 @@ class MdnsRecordRepositoryTest {
         // Ask for 2 services, the first one requests a unicast reply but is unknown
         val questions = listOf(
             MdnsPointerRecord(arrayOf("_otherservice", "_tcp", "local"), true /* isUnicast */),
-            MdnsPointerRecord(arrayOf("_testservice", "_tcp", "local"), false /* isUnicast */))
-        val query = MdnsPacket(0 /* flags */, questions, emptyList() /* answers */,
-                emptyList() /* authorityRecords */, emptyList() /* additionalRecords */)
+            MdnsPointerRecord(arrayOf("_testservice", "_tcp", "local"), false /* isUnicast */)
+        )
+        val query = MdnsPacket(
+            0 /* flags */,
+            questions,
+            emptyList() /* answers */,
+            emptyList() /* authorityRecords */,
+            emptyList() /* additionalRecords */
+        )
         val src = InetSocketAddress(parseNumericAddress("2001:db8::123"), 5353)
 
         // Reply to the question and verify it is sent multicast.
@@ -2155,15 +2817,25 @@ class MdnsRecordRepositoryTest {
 
     @Test
     fun testReplyMulticastWhenUnicastFeatureDisabled() {
-        val repository = MdnsRecordRepository(thread.looper, deps, TEST_HOSTNAME,
-            makeFlags(unicastReplyEnabled = false))
+        val repository = MdnsRecordRepository(
+            thread.looper,
+            deps,
+            TEST_HOSTNAME,
+            makeFlags(unicastReplyEnabled = false)
+        )
         repository.initWithService(TEST_SERVICE_ID_1, TEST_SERVICE_1)
 
         // The service is known and requests unicast reply, but the feature is disabled
         val questions = listOf(
-            MdnsPointerRecord(arrayOf("_testservice", "_tcp", "local"), true /* isUnicast */))
-        val query = MdnsPacket(0 /* flags */, questions, emptyList() /* answers */,
-                emptyList() /* authorityRecords */, emptyList() /* additionalRecords */)
+            MdnsPointerRecord(arrayOf("_testservice", "_tcp", "local"), true /* isUnicast */)
+        )
+        val query = MdnsPacket(
+            0 /* flags */,
+            questions,
+            emptyList() /* answers */,
+            emptyList() /* authorityRecords */,
+            emptyList() /* additionalRecords */
+        )
         val src = InetSocketAddress(parseNumericAddress("2001:db8::123"), 5353)
 
         // Reply to the question and verify it is sent multicast.
@@ -2174,18 +2846,27 @@ class MdnsRecordRepositoryTest {
 
     @Test
     fun testGetReply_OnlyKnownAnswers() {
-        val repository = MdnsRecordRepository(thread.looper, deps, TEST_HOSTNAME,
-                makeFlags(isKnownAnswerSuppressionEnabled = true))
+        val repository = MdnsRecordRepository(
+            thread.looper,
+            deps,
+            TEST_HOSTNAME,
+            makeFlags(isKnownAnswerSuppressionEnabled = true)
+        )
         repository.initWithService(TEST_SERVICE_ID_1, TEST_SERVICE_1)
         val knownAnswers = listOf(MdnsPointerRecord(
                 arrayOf("_testservice", "_tcp", "local"),
                 0L /* receiptTimeMillis */,
                 false /* cacheFlush */,
                 LONG_TTL - 1000L,
-                arrayOf("MyTestService", "_testservice", "_tcp", "local")))
-        val query = MdnsPacket(MdnsConstants.FLAG_TRUNCATED /* flags */, emptyList(),
-                knownAnswers, emptyList() /* authorityRecords */,
-                emptyList() /* additionalRecords */)
+                arrayOf("MyTestService", "_testservice", "_tcp", "local")
+        ))
+        val query = MdnsPacket(
+            MdnsConstants.FLAG_TRUNCATED /* flags */,
+            emptyList(),
+            knownAnswers,
+            emptyList() /* authorityRecords */,
+            emptyList() /* additionalRecords */
+        )
         val src = InetSocketAddress(parseNumericAddress("192.0.2.123"), 5353)
         val reply = repository.getReply(query, src)
         assertNotNull(reply)
@@ -2237,10 +2918,16 @@ class MdnsRecordRepositoryTest {
     @Test
     fun testRestartProbingForHostname() {
         val repository = MdnsRecordRepository(thread.looper, deps, TEST_HOSTNAME, makeFlags())
-        repository.initWithService(TEST_CUSTOM_HOST_ID_1, TEST_CUSTOM_HOST_1,
-                setOf(TEST_SUBTYPE, TEST_SUBTYPE2))
-        repository.addService(TEST_SERVICE_CUSTOM_HOST_ID_1,
-                TEST_SERVICE_CUSTOM_HOST_NO_ADDRESSES, null)
+        repository.initWithService(
+            TEST_CUSTOM_HOST_ID_1,
+            TEST_CUSTOM_HOST_1,
+            setOf(TEST_SUBTYPE, TEST_SUBTYPE2)
+        )
+        repository.addService(
+            TEST_SERVICE_CUSTOM_HOST_ID_1,
+            TEST_SERVICE_CUSTOM_HOST_NO_ADDRESSES,
+            null
+        )
         repository.setServiceProbing(TEST_SERVICE_CUSTOM_HOST_ID_1)
         repository.removeService(TEST_CUSTOM_HOST_ID_1)
 
@@ -2266,16 +2953,23 @@ class MdnsRecordRepositoryTest {
                         0 /* servicePriority */,
                         0 /* serviceWeight */,
                         TEST_PORT,
-                        TEST_CUSTOM_HOST_1_NAME))
+                        TEST_CUSTOM_HOST_1_NAME
+                )
+        )
     }
 
     @Test
     fun testRestartAnnouncingForHostname() {
         val repository = MdnsRecordRepository(thread.looper, deps, TEST_HOSTNAME, makeFlags())
-        repository.initWithService(TEST_CUSTOM_HOST_ID_1, TEST_CUSTOM_HOST_1,
-                setOf(TEST_SUBTYPE, TEST_SUBTYPE2))
-        repository.addServiceAndFinishProbing(TEST_SERVICE_CUSTOM_HOST_ID_1,
-                TEST_SERVICE_CUSTOM_HOST_NO_ADDRESSES)
+        repository.initWithService(
+            TEST_CUSTOM_HOST_ID_1,
+            TEST_CUSTOM_HOST_1,
+            setOf(TEST_SUBTYPE, TEST_SUBTYPE2)
+        )
+        repository.addServiceAndFinishProbing(
+            TEST_SERVICE_CUSTOM_HOST_ID_1,
+            TEST_SERVICE_CUSTOM_HOST_NO_ADDRESSES
+        )
         repository.removeService(TEST_CUSTOM_HOST_ID_1)
 
         val announcementInfos = repository.restartAnnouncingForHostname("TestHost")
@@ -2300,7 +2994,8 @@ class MdnsRecordRepositoryTest {
                         // Not a unique name owned by the announcer, so cacheFlush=false
                         false /* cacheFlush */,
                         4500000L /* ttlMillis */,
-                        serviceName),
+                        serviceName
+                ),
                 MdnsServiceRecord(
                         serviceName,
                         0L /* receiptTimeMillis */,
@@ -2309,50 +3004,65 @@ class MdnsRecordRepositoryTest {
                         0 /* servicePriority */,
                         0 /* serviceWeight */,
                         TEST_PORT /* servicePort */,
-                        TEST_CUSTOM_HOST_1_NAME),
+                        TEST_CUSTOM_HOST_1_NAME
+                ),
                 MdnsTextRecord(
                         serviceName,
                         0L /* receiptTimeMillis */,
                         true /* cacheFlush */,
                         4500000L /* ttlMillis */,
-                        emptyList() /* entries */),
+                        emptyList() /* entries */
+                ),
                 MdnsPointerRecord(
                         arrayOf("_services", "_dns-sd", "_udp", "local"),
                         0L /* receiptTimeMillis */,
                         false /* cacheFlush */,
                         4500000L /* ttlMillis */,
-                        serviceType))
+                        serviceType
+                )
+        )
         assertThat(packet.additionalRecords).containsExactly(
-                MdnsNsecRecord(v4AddrRev,
-                        0L /* receiptTimeMillis */,
-                        true /* cacheFlush */,
-                        120000L /* ttlMillis */,
-                        v4AddrRev,
-                        intArrayOf(TYPE_PTR)),
-                MdnsNsecRecord(TEST_HOSTNAME,
-                        0L /* receiptTimeMillis */,
-                        true /* cacheFlush */,
-                        120000L /* ttlMillis */,
-                        TEST_HOSTNAME,
-                        intArrayOf(TYPE_A, TYPE_AAAA)),
-                MdnsNsecRecord(v6Addr1Rev,
-                        0L /* receiptTimeMillis */,
-                        true /* cacheFlush */,
-                        120000L /* ttlMillis */,
-                        v6Addr1Rev,
-                        intArrayOf(TYPE_PTR)),
-                MdnsNsecRecord(v6Addr2Rev,
-                        0L /* receiptTimeMillis */,
-                        true /* cacheFlush */,
-                        120000L /* ttlMillis */,
-                        v6Addr2Rev,
-                        intArrayOf(TYPE_PTR)),
-                MdnsNsecRecord(serviceName,
-                        0L /* receiptTimeMillis */,
-                        true /* cacheFlush */,
-                        4500000L /* ttlMillis */,
-                        serviceName,
-                        intArrayOf(TYPE_TXT, TYPE_SRV)))
+                MdnsNsecRecord(
+                    v4AddrRev,
+                    0L /* receiptTimeMillis */,
+                    true /* cacheFlush */,
+                    120000L /* ttlMillis */,
+                    v4AddrRev,
+                    intArrayOf(TYPE_PTR)
+                ),
+                MdnsNsecRecord(
+                    TEST_HOSTNAME,
+                    0L /* receiptTimeMillis */,
+                    true /* cacheFlush */,
+                    120000L /* ttlMillis */,
+                    TEST_HOSTNAME,
+                    intArrayOf(TYPE_A, TYPE_AAAA)
+                ),
+                MdnsNsecRecord(
+                    v6Addr1Rev,
+                    0L /* receiptTimeMillis */,
+                    true /* cacheFlush */,
+                    120000L /* ttlMillis */,
+                    v6Addr1Rev,
+                    intArrayOf(TYPE_PTR)
+                ),
+                MdnsNsecRecord(
+                    v6Addr2Rev,
+                    0L /* receiptTimeMillis */,
+                    true /* cacheFlush */,
+                    120000L /* ttlMillis */,
+                    v6Addr2Rev,
+                    intArrayOf(TYPE_PTR)
+                ),
+                MdnsNsecRecord(
+                    serviceName,
+                    0L /* receiptTimeMillis */,
+                    true /* cacheFlush */,
+                    4500000L /* ttlMillis */,
+                    serviceName,
+                    intArrayOf(TYPE_TXT, TYPE_SRV)
+                )
+        )
     }
 }
 

From 72db4fe19ff3b7ee049dd2687ae0004ea87cdd54 Mon Sep 17 00:00:00 2001
From: Quang Anh Luong <qal@google.com>
Date: Mon, 21 Apr 2025 10:21:11 +0900
Subject: [PATCH 132/377] Add tether start/stop events to local log

Add tether start/stop events along with their TetheringRequests to keep
track of which uid/package made the request.

Flag: EXEMPT logging change

Bug: 409564618
Test: start/stop tethering and verify the new logs show up in dumpsys
Change-Id: Iab16b16208f0ede90d7119709f7ff4888c8b86df
---
 .../src/com/android/networkstack/tethering/Tethering.java      | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/Tethering/src/com/android/networkstack/tethering/Tethering.java b/Tethering/src/com/android/networkstack/tethering/Tethering.java
index 073063963d..62e0ec7765 100644
--- a/Tethering/src/com/android/networkstack/tethering/Tethering.java
+++ b/Tethering/src/com/android/networkstack/tethering/Tethering.java
@@ -704,6 +704,7 @@ public class Tethering {
     void startTethering(final TetheringRequest request, final String callerPkg,
             final IIntResultListener listener) {
         mHandler.post(() -> {
+            mLog.i("startTethering: " + request);
             final int type = request.getTetheringType();
             RequestTracker.AddResult result = mRequestTracker.addPendingRequest(request);
             // If tethering is already pending with a conflicting request, stop tethering before
@@ -733,6 +734,7 @@ public class Tethering {
 
     void stopTethering(int type) {
         mHandler.post(() -> {
+            mLog.i("stopTethering: " + type);
             stopTetheringInternal(type);
         });
     }
@@ -742,6 +744,7 @@ public class Tethering {
         if (!isTetheringWithSoftApConfigEnabled()) return;
         final boolean hasNetworkSettings = hasCallingPermission(NETWORK_SETTINGS);
         mHandler.post(() -> {
+            mLog.i("stopTetheringRequest: " + request);
             if (mRequestTracker.findFuzzyMatchedRequest(request, !hasNetworkSettings) != null) {
                 final int type = request.getTetheringType();
                 stopTetheringInternal(type);

From 19a3d815fc13e3c2ada4b819748af5be3481c5f7 Mon Sep 17 00:00:00 2001
From: Lorenzo Colitti <lorenzo@google.com>
Date: Mon, 21 Apr 2025 11:07:11 +0900
Subject: [PATCH 133/377] Make dumpAllRequestInfoLogsToLogcat accessible to
 tests.

This could be useful for debugging in tests.

Flag: TEST_ONLY
Test: test-only code
Change-Id: If67ebaa26a297fcf6afecf7ee3c0e8027da3f40f
---
 service/src/com/android/server/ConnectivityService.java | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index 4021a82eff..1276cc2e24 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -4680,7 +4680,8 @@ public class ConnectivityService extends IConnectivityManager.Stub {
         }
     }
 
-    private void dumpAllRequestInfoLogsToLogcat() {
+    @VisibleForTesting
+    protected void dumpAllRequestInfoLogsToLogcat() {
         try (PrintWriter logPw = new PrintWriter(new Writer() {
             @Override
             public void write(final char[] cbuf, final int off, final int len) {

From 7a0a9dd096c3020705828119829afee07da32794 Mon Sep 17 00:00:00 2001
From: Lorenzo Colitti <lorenzo@google.com>
Date: Mon, 21 Apr 2025 11:02:52 +0900
Subject: [PATCH 134/377] Fix a callback leak in tests using CSAgentWrapper.

The method above this one (connect) unregisters the callback, but
disconnect doesn't. Looks like it was just missed in code review.

Flag: TEST_ONLY
Test: test-only change
Change-Id: Id3a9d3748554275fd28d8bf2ff2b6fa42be24ddc
---
 .../android/server/connectivityservice/base/CSAgentWrapper.kt    | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/unit/java/com/android/server/connectivityservice/base/CSAgentWrapper.kt b/tests/unit/java/com/android/server/connectivityservice/base/CSAgentWrapper.kt
index a77daa810e..0cc9457f2c 100644
--- a/tests/unit/java/com/android/server/connectivityservice/base/CSAgentWrapper.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/base/CSAgentWrapper.kt
@@ -191,6 +191,7 @@ class CSAgentWrapper(
             agent.unregister()
             cb.assertNoCallback()
         }
+        mgr.unregisterNetworkCallback(cb)
     }
 
     fun setTeardownDelayMillis(delayMillis: Int) = agent.setTeardownDelayMillis(delayMillis)

From a2115216187f1d7266ca549b5e2945c5ccecb7aa Mon Sep 17 00:00:00 2001
From: Lorenzo Colitti <lorenzo@google.com>
Date: Fri, 18 Apr 2025 12:58:43 +0900
Subject: [PATCH 135/377] Minor refactoring of per-app fallback requests.

1. Add a utility method to create per-app fallback requests.
   The new method only has one caller, but another caller will be
   added in an upcoming CL.

2. Extract code from removeDefaultNetworkRequestsForPreference to
   a more generic method that takes a predicate and that will be
   used elsewhere.

Bug: 410731080
Flag: EXEMPT refactor
Test: refactor covered by existing tests
Change-Id: I13facc0f3fff1d4e76d5e8117cfcc182aa049d29
---
 .../android/server/ConnectivityService.java   | 22 +++++++++++++------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index 1276cc2e24..86cfa0e466 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -14370,14 +14370,20 @@ public class ConnectivityService extends IConnectivityManager.Stub {
         );
     }
 
-    ArraySet<NetworkRequestInfo> createMultiLayerNrisFromSatelliteNetworkFallbackUids(
-            @NonNull final Set<Integer> uids) {
+    ArraySet<NetworkRequestInfo> createNrisForFallbackDefault(
+            @NonNull final Set<Integer> uids, NetworkCapabilities cap, int preferenceOrder) {
         final List<NetworkRequest> requests = new ArrayList<>();
 
         // request: track default(unrestricted internet network)
         requests.add(createDefaultInternetRequestForTransport(
                 TYPE_NONE, NetworkRequest.Type.TRACK_DEFAULT));
 
+        requests.add(createNetworkRequest(NetworkRequest.Type.REQUEST, cap));
+        return createNrisForPreferenceOrder(uids, requests, preferenceOrder);
+    }
+
+    ArraySet<NetworkRequestInfo> createMultiLayerNrisFromSatelliteNetworkFallbackUids(
+            @NonNull final Set<Integer> uids) {
         // request: Satellite internet, satellite network could be restricted or constrained
         final NetworkCapabilities cap = new NetworkCapabilities.Builder()
                 .addCapability(NET_CAPABILITY_INTERNET)
@@ -14386,9 +14392,8 @@ public class ConnectivityService extends IConnectivityManager.Stub {
                 .removeCapability(NET_CAPABILITY_NOT_BANDWIDTH_CONSTRAINED)
                 .addTransportType(NetworkCapabilities.TRANSPORT_SATELLITE)
                 .build();
-        requests.add(createNetworkRequest(NetworkRequest.Type.REQUEST, cap));
-
-        return createNrisForPreferenceOrder(uids, requests, PREFERENCE_ORDER_SATELLITE_FALLBACK);
+        return createNrisForFallbackDefault(uids, cap,
+                PREFERENCE_ORDER_SATELLITE_FALLBACK);
     }
 
     private void handleMobileDataPreferredUidsChanged() {
@@ -14598,14 +14603,17 @@ public class ConnectivityService extends IConnectivityManager.Stub {
         }
     }
 
-    private void removeDefaultNetworkRequestsForPreference(final int preferenceOrder) {
+    private void removeDefaultNetworkRequests(Predicate<NetworkRequestInfo> filter) {
         // Skip the requests which are set by other network preference. Because the uid range rules
         // should stay in netd.
         final Set<NetworkRequestInfo> requests = new ArraySet<>(mDefaultNetworkRequests);
-        requests.removeIf(request -> request.mPreferenceOrder != preferenceOrder);
+        requests.removeIf(filter.negate());
         handleRemoveNetworkRequests(requests);
     }
 
+    private void removeDefaultNetworkRequestsForPreference(final int preferenceOrder) {
+        removeDefaultNetworkRequests((nri) -> nri.mPreferenceOrder == preferenceOrder);
+    }
     private void addPerAppDefaultNetworkRequests(@NonNull final Set<NetworkRequestInfo> nris) {
         ensureRunningOnConnectivityServiceThread();
         mDefaultNetworkRequests.addAll(nris);

From 5759bf45a59f31d04d6bca8191e70c1c44e71c5b Mon Sep 17 00:00:00 2001
From: Motomu Utsumi <motomuman@google.com>
Date: Mon, 7 Apr 2025 21:12:06 +0900
Subject: [PATCH 136/377] Update enforceMeteredApnPolicy to follow the compat
 flag

On V+, ConnectivityService uses uid blocking state in BpfMap instead of
asking NetworkPolicyManager.
But, there was one behavior difference because NetworkPolicyManager
considers the network is always not blocked for apps without Internet
permission.
To ensure backward compatibility, the
NETWORK_BLOCKED_WITHOUT_INTERNET_PERMISSION flag was introduced in
aosp/3076606, aosp/3088285.

This CL updates enforceMeteredApnPolicy to respect this flag for
backward compatibility.

Test: CSEnforceMeteredApnPolicy
Bug: 404428733
Bug: 370383309
Flag: EXEMPT bugfix
Change-Id: I631f4f840818e1d40f20fccae1ec1a2cbbb6a166
---
 .../ConnectivityCompatChanges.java            |   2 +
 .../android/server/ConnectivityService.java   |  19 ++-
 .../CSEnforceMeteredApnPolicy.kt              | 129 ++++++++++++++++++
 3 files changed, 146 insertions(+), 4 deletions(-)
 create mode 100644 tests/unit/java/com/android/server/connectivityservice/CSEnforceMeteredApnPolicy.kt

diff --git a/framework/src/android/net/connectivity/ConnectivityCompatChanges.java b/framework/src/android/net/connectivity/ConnectivityCompatChanges.java
index 27d605acf9..c3279306f9 100644
--- a/framework/src/android/net/connectivity/ConnectivityCompatChanges.java
+++ b/framework/src/android/net/connectivity/ConnectivityCompatChanges.java
@@ -111,6 +111,8 @@ public final class ConnectivityCompatChanges {
      * {@link android.net.ConnectivityManager#getActiveNetwork()} always returns null.
      * {@link android.net.ConnectivityManager.NetworkCallback#onBlockedStatusChanged()} is always
      * called with blocked=true.
+     * {@link android.net.ConnectivityManager#requestNetwork} can not bring up metered network if
+     * the uid is restricted from using metered networks.
      * <p>
      * For backwards compatibility, apps running on older releases, or targeting older SDK levels,
      * network access from apps without {@link android.Manifest.permission#INTERNET} permission is
diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index 11c6f1fb7f..2f51744e00 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -8849,10 +8849,21 @@ public class ConnectivityService extends IConnectivityManager.Stub {
             // Policy already enforced.
             return;
         }
-        final boolean isRestrictedOnMeteredNetworks = mDeps.isAtLeastV()
-                ? mBpfNetMaps.isUidRestrictedOnMeteredNetworks(uid)
-                : BinderUtils.withCleanCallingIdentity(() ->
-                        mPolicyManager.isUidRestrictedOnMeteredNetworks(uid));
+        final boolean isRestrictedOnMeteredNetworks;
+        if (mDeps.isAtLeastV()) {
+            if (mDeps.isChangeEnabled(NETWORK_BLOCKED_WITHOUT_INTERNET_PERMISSION, uid)) {
+                isRestrictedOnMeteredNetworks =
+                        mBpfNetMaps.isUidRestrictedOnMeteredNetworks(uid);
+            } else {
+                // If the change is disabled and the uid does not have Internet permission,
+                // uid is considered to be allowed to bring up metered networks.
+                isRestrictedOnMeteredNetworks = hasInternetPermission(uid)
+                        && mBpfNetMaps.isUidRestrictedOnMeteredNetworks(uid);
+            }
+        } else {
+            isRestrictedOnMeteredNetworks = BinderUtils.withCleanCallingIdentity(() ->
+                    mPolicyManager.isUidRestrictedOnMeteredNetworks(uid));
+        }
         if (isRestrictedOnMeteredNetworks) {
             // If UID is restricted, don't allow them to bring up metered APNs.
             networkCapabilities.addCapability(NET_CAPABILITY_NOT_METERED);
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSEnforceMeteredApnPolicy.kt b/tests/unit/java/com/android/server/connectivityservice/CSEnforceMeteredApnPolicy.kt
new file mode 100644
index 0000000000..776d5c649a
--- /dev/null
+++ b/tests/unit/java/com/android/server/connectivityservice/CSEnforceMeteredApnPolicy.kt
@@ -0,0 +1,129 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.server
+
+import android.net.INetd.PERMISSION_INTERNET
+import android.net.INetd.PERMISSION_NONE
+import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_SUSPENDED
+import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_VCN_MANAGED
+import android.net.NetworkCapabilities.TRANSPORT_CELLULAR
+import android.net.NetworkProvider
+import android.net.NetworkRequest
+import android.net.NetworkScore
+import android.net.connectivity.ConnectivityCompatChanges.NETWORK_BLOCKED_WITHOUT_INTERNET_PERMISSION
+import android.os.Build
+import android.os.Process
+import androidx.test.filters.SmallTest
+import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
+import com.android.testutils.DevSdkIgnoreRunner
+import com.android.testutils.TestableNetworkCallback
+import com.android.testutils.TestableNetworkOfferCallback
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.junit.runners.Parameterized
+import org.mockito.Mockito.doReturn
+
+private const val TIMEOUT_MS = 5_000L
+private const val NO_CB_TIMEOUT_MS = 200L
+
+private fun cellNc() = nc(
+    TRANSPORT_CELLULAR,
+    NET_CAPABILITY_NOT_SUSPENDED,
+    NET_CAPABILITY_NOT_VCN_MANAGED
+)
+
+private fun cellRequest() = NetworkRequest.Builder()
+        .addTransportType(TRANSPORT_CELLULAR)
+        .build()
+
+@RunWith(DevSdkIgnoreRunner::class)
+@SmallTest
+@IgnoreUpTo(Build.VERSION_CODES.R)
+class CSEnforceMeteredApnPolicy : CSTest() {
+    @Parameterized.Parameter(0) lateinit var params: TestParams
+
+    data class TestParams(
+            val changeEnabled: Boolean,
+            val hasInternetPermission: Boolean,
+            val expectRequestMeteredNetwork: Boolean
+    )
+
+    companion object {
+        @JvmStatic
+        @Parameterized.Parameters
+        fun arguments() = listOf(
+                // For backwards compatibility, if the change is disabled and the uid does not have
+                // the internet permission, the uid can request metered network even if the uid is
+                // restricted from using metered networks.
+                TestParams(
+                        changeEnabled = false,
+                        hasInternetPermission = false,
+                        expectRequestMeteredNetwork = true
+                ),
+                // If the uid has the internet permission and the uid is restricted from using
+                // metered network, the uid cannot request metered network even if the change is
+                // disabled.
+                TestParams(
+                        changeEnabled = false,
+                        hasInternetPermission = true,
+                        expectRequestMeteredNetwork = false
+                ),
+                // If the change is enabled and the uid is restricted from using metered network,
+                // the uid cannot request metered network regardless of the internet permission.
+                TestParams(
+                        changeEnabled = true,
+                        hasInternetPermission = false,
+                        expectRequestMeteredNetwork = false
+                ),
+                TestParams(
+                        changeEnabled = true,
+                        hasInternetPermission = true,
+                        expectRequestMeteredNetwork = false
+                )
+        )
+    }
+
+    @Test
+    fun testEnforceMeteredApnPolicy() {
+        deps.setBuildSdk(VERSION_V)
+        deps.setChangeIdEnabled(params.changeEnabled, NETWORK_BLOCKED_WITHOUT_INTERNET_PERMISSION)
+        doReturn(true).`when`(bpfNetMaps).isUidRestrictedOnMeteredNetworks(Process.myUid())
+        doReturn(if (params.hasInternetPermission) PERMISSION_INTERNET else PERMISSION_NONE )
+                .`when`(bpfNetMaps).getNetPermForUid(Process.myUid())
+
+        val provider = NetworkProvider(context, csHandlerThread.looper, "Cell provider")
+        cm.registerNetworkProvider(provider)
+        val offerCb = TestableNetworkOfferCallback(TIMEOUT_MS, NO_CB_TIMEOUT_MS)
+        provider.registerNetworkOffer(
+                NetworkScore.Builder().build(),
+                cellNc(),
+                Runnable::run,
+                offerCb
+        )
+        val cb = TestableNetworkCallback()
+        cm.requestNetwork(cellRequest(), cb)
+
+        if (params.expectRequestMeteredNetwork) {
+            offerCb.expectOnNetworkNeeded(cellNc())
+        } else {
+            offerCb.assertNoCallback()
+        }
+
+        cm.unregisterNetworkCallback(cb)
+        provider.unregisterNetworkOffer(offerCb)
+    }
+}

From 49ca1e7a32c1344280f6ebc1deab81136b9ea3cc Mon Sep 17 00:00:00 2001
From: Lorenzo Colitti <lorenzo@google.com>
Date: Mon, 21 Apr 2025 13:33:36 +0900
Subject: [PATCH 137/377] Style improvements to removeDefaultNetworkRequests.

Rename the variable and add a comment to make the code clearer.

Bug: 410731080
Flag: EXEMPT refactor
Test: covered by existing tests
Change-Id: Ia5ff9754b070951948cb3edcfbe11934a2dc13ff
---
 .../src/com/android/server/ConnectivityService.java    | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index 86cfa0e466..4c7c8303a2 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -14603,12 +14603,12 @@ public class ConnectivityService extends IConnectivityManager.Stub {
         }
     }
 
+    /** Removes all default network requests matching the specified filter. */
     private void removeDefaultNetworkRequests(Predicate<NetworkRequestInfo> filter) {
-        // Skip the requests which are set by other network preference. Because the uid range rules
-        // should stay in netd.
-        final Set<NetworkRequestInfo> requests = new ArraySet<>(mDefaultNetworkRequests);
-        requests.removeIf(filter.negate());
-        handleRemoveNetworkRequests(requests);
+        // Remove all requests in mDefaultNetworkRequests except the ones that match the filter.
+        final Set<NetworkRequestInfo> toRemove = new ArraySet<>(mDefaultNetworkRequests);
+        toRemove.removeIf(filter.negate());
+        handleRemoveNetworkRequests(toRemove);
     }
 
     private void removeDefaultNetworkRequestsForPreference(final int preferenceOrder) {

From 2184846d35950371b3c6652088c85b8c8c0821c7 Mon Sep 17 00:00:00 2001
From: Yuyang Huang <yuyanghuang@google.com>
Date: Sun, 20 Apr 2025 14:19:35 +0900
Subject: [PATCH 138/377] Ignore IPv6 temporary addresses in mDNS advertising.

This commit modifies the mDNS advertising process to ignore IPv6
temporary addresses. These addresses are ephemeral and can lead to large
advertising packets and negatively impact mDNS offload(as RAM for doing
mDNS offload is limited), especially on devices with long internet
connections and multiple temporary addresses.  Ignoring them provides a
more stable and efficient mDNS advertising
experience.

Flag: EXEMPT mainline
Test: TH
Change-Id: I79c7f331eb29ecdd7ade4ccde1d1a22d0dbf1400
---
 .../src/com/android/server/NsdService.java    |  2 ++
 .../connectivity/mdns/MdnsFeatureFlags.java   | 25 +++++++++++++++++++
 .../mdns/MdnsRecordRepository.java            |  7 ++++++
 .../mdns/MdnsRecordRepositoryTest.kt          | 15 ++++++++++-
 4 files changed, 48 insertions(+), 1 deletion(-)

diff --git a/service-t/src/com/android/server/NsdService.java b/service-t/src/com/android/server/NsdService.java
index c1a263e258..23899150bf 100644
--- a/service-t/src/com/android/server/NsdService.java
+++ b/service-t/src/com/android/server/NsdService.java
@@ -1951,6 +1951,8 @@ public class NsdService extends INsdManager.Stub {
                         mContext, MdnsFeatureFlags.NSD_USE_SHORT_HOSTNAMES))
                 .setIsCacheFlushPerAddressTypeEnabled(mDeps.isTetheringFeatureNotChickenedOut(
                         mContext, MdnsFeatureFlags.NSD_CACHE_FLUSH_PER_ADDRESS_TYPE))
+                .setIsIgnoreTemporaryIPv6AddressesEnabled(mDeps.isTetheringFeatureNotChickenedOut(
+                        mContext, MdnsFeatureFlags.NSD_IGNORE_TEMPORARY_IPV6_ADDRESSES))
                 .setOverrideProvider(new MdnsFeatureFlags.FlagOverrideProvider() {
                     @Override
                     public boolean isForceEnabledForTest(@NonNull String flag) {
diff --git a/service-t/src/com/android/server/connectivity/mdns/MdnsFeatureFlags.java b/service-t/src/com/android/server/connectivity/mdns/MdnsFeatureFlags.java
index 97a65f62d7..5ca65ca336 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MdnsFeatureFlags.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MdnsFeatureFlags.java
@@ -86,6 +86,12 @@ public class MdnsFeatureFlags {
      */
     public static final String NSD_USE_SHORT_HOSTNAMES = "nsd_use_short_hostnames";
 
+    /**
+     * A feature flag to control whether to advertise the temporary IPv6 addresses should be
+     */
+    public static final String NSD_IGNORE_TEMPORARY_IPV6_ADDRESSES =
+            "nsd_ignore_temporary_ipv6_addresses";
+
     /**
 
      * A feature flag to control whether to only flush address records when another address record
@@ -171,6 +177,9 @@ public class MdnsFeatureFlags {
     // Flag for optimized expired service removal
     public final boolean mIsOptimizedExpiredServiceRemovalEnabled;
 
+    // Flag for ignoring temporary IPv6 addresses in advertising
+    public final boolean mIsIgnoreTemporaryIPv6AddressesEnabled;
+
     // Thread stats tag for MdnsSocketClient
     public final int mMdnsSocketThreadStatsTag;
 
@@ -309,6 +318,7 @@ public class MdnsFeatureFlags {
             boolean isSocketClientNetworkGuessingEnabled,
             boolean isCacheFlushPerAddressTypeEnabled,
             boolean isOptimizedExpiredServiceRemovalEnabled,
+            boolean isIgnoreTemporaryIPv6AddressesEnabled,
             int mdnsSocketThreadStatsTag,
             @Nullable FlagOverrideProvider overrideProvider) {
         mIsMdnsOffloadFeatureEnabled = isOffloadFeatureEnabled;
@@ -328,6 +338,7 @@ public class MdnsFeatureFlags {
         mIsCacheFlushPerAddressTypeEnabled = isCacheFlushPerAddressTypeEnabled;
         mIsOptimizedExpiredServiceRemovalEnabled = isOptimizedExpiredServiceRemovalEnabled;
         mMdnsSocketThreadStatsTag = mdnsSocketThreadStatsTag;
+        mIsIgnoreTemporaryIPv6AddressesEnabled = isIgnoreTemporaryIPv6AddressesEnabled;
         mOverrideProvider = overrideProvider;
     }
 
@@ -356,6 +367,7 @@ public class MdnsFeatureFlags {
         private boolean mIsSocketClientNetworkGuessingEnabled;
         private boolean mIsCacheFlushPerAddressTypeEnabled;
         private boolean mIsOptimizedExpiredServiceRemovalEnabled;
+        private boolean mIsIgnoreTemporaryIPv6AddressesEnabled;
         private int mMdnsSocketThreadStatsTag;
         private FlagOverrideProvider mOverrideProvider;
 
@@ -379,10 +391,22 @@ public class MdnsFeatureFlags {
             mIsSocketClientNetworkGuessingEnabled = false;
             mIsCacheFlushPerAddressTypeEnabled = true; // Default enabled.
             mIsOptimizedExpiredServiceRemovalEnabled = false;
+            mIsIgnoreTemporaryIPv6AddressesEnabled = true; // Default enabled.
             mMdnsSocketThreadStatsTag = MDNS_SOCKET_THREAD_STATS_TAG_NONE;
             mOverrideProvider = null;
         }
 
+        /**
+         * Set whether the temporary IPv6 addresses should be ignored.
+         *
+         * @see #NSD_IGNORE_TEMPORARY_IPV6_ADDRESSES
+         */
+        public Builder setIsIgnoreTemporaryIPv6AddressesEnabled(
+                boolean isIgnoreTemporaryIPv6AddressesEnabled) {
+            mIsIgnoreTemporaryIPv6AddressesEnabled = isIgnoreTemporaryIPv6AddressesEnabled;
+            return this;
+        }
+
         /**
          * Set whether the mDNS offload feature is enabled.
          *
@@ -584,6 +608,7 @@ public class MdnsFeatureFlags {
                     mIsSocketClientNetworkGuessingEnabled,
                     mIsCacheFlushPerAddressTypeEnabled,
                     mIsOptimizedExpiredServiceRemovalEnabled,
+                    mIsIgnoreTemporaryIPv6AddressesEnabled,
                     mMdnsSocketThreadStatsTag,
                     mOverrideProvider);
         }
diff --git a/service-t/src/com/android/server/connectivity/mdns/MdnsRecordRepository.java b/service-t/src/com/android/server/connectivity/mdns/MdnsRecordRepository.java
index bfef5d9204..73a6f2f78b 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MdnsRecordRepository.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MdnsRecordRepository.java
@@ -16,6 +16,8 @@
 
 package com.android.server.connectivity.mdns;
 
+import static android.system.OsConstants.IFA_F_TEMPORARY;
+
 import static com.android.server.connectivity.mdns.MdnsConstants.IPV4_SOCKET_ADDR;
 import static com.android.server.connectivity.mdns.MdnsConstants.IPV6_SOCKET_ADDR;
 import static com.android.server.connectivity.mdns.MdnsConstants.NO_PACKET;
@@ -414,6 +416,11 @@ public class MdnsRecordRepository {
     public void updateAddresses(@NonNull List<LinkAddress> newAddresses) {
         mGeneralRecords.clear();
         for (LinkAddress addr : newAddresses) {
+            if (mMdnsFeatureFlags.mIsIgnoreTemporaryIPv6AddressesEnabled && addr.isIpv6()
+                    && (addr.getFlags() & IFA_F_TEMPORARY) != 0) {
+                // Ignore temporary IPv6 addresses
+                continue;
+            }
             final String[] revDnsAddr = getReverseDnsAddress(addr.getAddress());
             mGeneralRecords.add(new RecordInfo<>(
                     null /* serviceInfo */,
diff --git a/tests/unit/java/com/android/server/connectivity/mdns/MdnsRecordRepositoryTest.kt b/tests/unit/java/com/android/server/connectivity/mdns/MdnsRecordRepositoryTest.kt
index bf88d67abf..38b333c0ae 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/MdnsRecordRepositoryTest.kt
+++ b/tests/unit/java/com/android/server/connectivity/mdns/MdnsRecordRepositoryTest.kt
@@ -21,6 +21,7 @@ import android.net.LinkAddress
 import android.net.nsd.NsdServiceInfo
 import android.os.Build
 import android.os.HandlerThread
+import android.system.OsConstants
 import com.android.net.module.util.HexDump.hexStringToByteArray
 import com.android.server.connectivity.mdns.MdnsAnnouncer.AnnouncementInfo
 import com.android.server.connectivity.mdns.MdnsInterfaceAdvertiser.CONFLICT_HOST
@@ -77,6 +78,12 @@ private val TEST_ADDRESSES = listOf(
         LinkAddress(parseNumericAddress("2001:db8::111"), 64),
         LinkAddress(parseNumericAddress("2001:db8::222"), 64)
 )
+private val TEST_TEMPORARY_IPV6_ADDRESS = LinkAddress(
+    parseNumericAddress("2001:db8::333"),
+    64,
+    OsConstants.IFA_F_TEMPORARY /* flags */,
+    0 /* lifetime */
+)
 
 private val TEST_SERVICE_1 = NsdServiceInfo().apply {
     serviceType = "_testservice._tcp"
@@ -567,7 +574,13 @@ class MdnsRecordRepositoryTest {
     @Test
     fun testGetOffloadPacket() {
         val repository = MdnsRecordRepository(thread.looper, deps, TEST_HOSTNAME, makeFlags())
-        repository.initWithService(TEST_SERVICE_ID_1, TEST_SERVICE_1)
+        val ipAddress = TEST_ADDRESSES.toMutableList()
+        ipAddress.add(TEST_TEMPORARY_IPV6_ADDRESS)
+        repository.initWithService(
+            TEST_SERVICE_ID_1,
+            TEST_SERVICE_1,
+            addresses = ipAddress
+        )
         val serviceName = arrayOf("MyTestService", "_testservice", "_tcp", "local")
         val serviceType = arrayOf("_testservice", "_tcp", "local")
         val offloadPacket = repository.getOffloadPacket(TEST_SERVICE_ID_1)

From 46f86934e19d61fd86326b2c5c61378603952a9e Mon Sep 17 00:00:00 2001
From: Remi NGUYEN VAN <reminv@google.com>
Date: Tue, 15 Apr 2025 18:28:06 +0900
Subject: [PATCH 139/377] Move getTestableNetworks to a common location

Use a common code path for getTestableNetworks, which obtains Wi-Fi and
cellular from network callbacks. This avoids mixing callbacks and
synchronous calls, as getTestableNetworks may be called after
ensureWifiConnected, which uses NetworkCallbacks.

Test: atest
Bug: 253698734
Flag: TEST_ONLY
Change-Id: I8bf946b5258270554286e52b8aa3189aa2ba52e1
---
 .../AutoReleaseNetworkCallbackRule.kt         | 40 ++++++--
 .../src/android/net/cts/DnsResolverTest.java  | 97 ++++++++-----------
 .../android/net/cts/MultinetworkApiTest.java  | 82 +++-------------
 .../android/net/cts/util/CtsNetUtils.java     | 72 ++++++++++++--
 4 files changed, 149 insertions(+), 142 deletions(-)

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/AutoReleaseNetworkCallbackRule.kt b/staticlibs/testutils/devicetests/com/android/testutils/AutoReleaseNetworkCallbackRule.kt
index be6947f231..e42223d7f9 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/AutoReleaseNetworkCallbackRule.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/AutoReleaseNetworkCallbackRule.kt
@@ -16,10 +16,14 @@
 
 package com.android.testutils
 
+import android.content.pm.PackageManager.FEATURE_TELEPHONY
+import android.content.pm.PackageManager.FEATURE_WIFI
 import android.net.ConnectivityManager
 import android.net.ConnectivityManager.NetworkCallback
 import android.net.Network
 import android.net.NetworkCapabilities
+import android.net.NetworkCapabilities.TRANSPORT_CELLULAR
+import android.net.NetworkCapabilities.TRANSPORT_WIFI
 import android.net.NetworkRequest
 import android.os.Handler
 import androidx.test.platform.app.InstrumentationRegistry
@@ -58,9 +62,11 @@ class AutoReleaseNetworkCallbackRule : NetworkCallbackHelper(), TestRule {
  * Helps file [NetworkCallback]s to request or watch networks, keeping track of them for cleanup.
  */
 open class NetworkCallbackHelper {
-    private val cm by lazy {
+    private val context by lazy {
         InstrumentationRegistry.getInstrumentation().context
-            .getSystemService(ConnectivityManager::class.java)
+    }
+    private val cm by lazy {
+        context.getSystemService(ConnectivityManager::class.java)
             ?: fail("ConnectivityManager not found")
     }
     private val cbToCleanup = Collections.synchronizedSet(mutableSetOf<NetworkCallback>())
@@ -76,12 +82,7 @@ open class NetworkCallbackHelper {
         if (cellRequestCb != null) {
             fail("Cell network was already requested")
         }
-        val cb = requestNetwork(
-            NetworkRequest.Builder()
-                .addTransportType(NetworkCapabilities.TRANSPORT_CELLULAR)
-                .addCapability(NetworkCapabilities.NET_CAPABILITY_INTERNET)
-                .build()
-        )
+        val cb = requestNetwork(getInternetRequest(TRANSPORT_CELLULAR))
         cellRequestCb = cb
         return cb.expect<CallbackEntry.Available>(
             errorMsg = "Cell network not available. " +
@@ -89,6 +90,11 @@ open class NetworkCallbackHelper {
         ).network
     }
 
+    private fun getInternetRequest(transportType: Int) = NetworkRequest.Builder()
+        .addTransportType(transportType)
+        .addCapability(NetworkCapabilities.NET_CAPABILITY_INTERNET)
+        .build()
+
     /**
      * Unrequest a cell network requested through [requestCell].
      */
@@ -98,6 +104,24 @@ open class NetworkCallbackHelper {
         cellRequestCb = null
     }
 
+    /**
+     * Request a cell network if supported by the device.
+     */
+    fun requestCellIfSupported() = if (context.packageManager.hasSystemFeature(FEATURE_TELEPHONY)) {
+        requestNetwork(getInternetRequest(TRANSPORT_CELLULAR))
+    } else {
+        null
+    }
+
+    /**
+     * Request a Wi-Fi network if supported by the device.
+     */
+    fun requestWifiIfSupported() = if (context.packageManager.hasSystemFeature(FEATURE_WIFI)) {
+        requestNetwork(getInternetRequest(TRANSPORT_WIFI))
+    } else {
+        null
+    }
+
     private fun <T> addCallback(
         cb: T,
         registrar: (NetworkCallback) -> Unit
diff --git a/tests/cts/net/src/android/net/cts/DnsResolverTest.java b/tests/cts/net/src/android/net/cts/DnsResolverTest.java
index 7cb28c7cd8..1d4e37f6f8 100644
--- a/tests/cts/net/src/android/net/cts/DnsResolverTest.java
+++ b/tests/cts/net/src/android/net/cts/DnsResolverTest.java
@@ -22,10 +22,10 @@ import static android.net.DnsResolver.FLAG_NO_CACHE_LOOKUP;
 import static android.net.DnsResolver.TYPE_A;
 import static android.net.DnsResolver.TYPE_AAAA;
 import static android.net.NetworkCapabilities.TRANSPORT_CELLULAR;
-import static android.net.cts.util.CtsNetUtils.TestNetworkCallback;
 import static android.provider.DeviceConfig.NAMESPACE_CONNECTIVITY;
 import static android.system.OsConstants.ETIMEDOUT;
 
+import static com.android.testutils.Cleanup.testAndCleanup;
 import static com.android.testutils.DevSdkIgnoreRuleKt.SC_V2;
 
 import static org.junit.Assert.assertEquals;
@@ -38,12 +38,10 @@ import android.annotation.NonNull;
 import android.annotation.Nullable;
 import android.content.ContentResolver;
 import android.content.Context;
-import android.content.pm.PackageManager;
 import android.net.ConnectivityManager;
 import android.net.DnsResolver;
 import android.net.Network;
 import android.net.NetworkCapabilities;
-import android.net.NetworkRequest;
 import android.net.ParseException;
 import android.net.cts.util.CtsNetUtils;
 import android.os.CancellationSignal;
@@ -52,18 +50,22 @@ import android.os.Looper;
 import android.platform.test.annotations.AppModeFull;
 import android.provider.Settings;
 import android.system.ErrnoException;
+import android.util.ArraySet;
 import android.util.Log;
 
 import androidx.test.InstrumentationRegistry;
 import androidx.test.runner.AndroidJUnit4;
 
 import com.android.net.module.util.DnsPacket;
+import com.android.testutils.AutoReleaseNetworkCallbackRule;
 import com.android.testutils.ConnectivityDiagnosticsCollector;
 import com.android.testutils.DevSdkIgnoreRule;
 import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo;
 import com.android.testutils.DeviceConfigRule;
 import com.android.testutils.DnsResolverModuleTest;
+import com.android.testutils.RecorderCallback.CallbackEntry;
 import com.android.testutils.SkipPresubmit;
+import com.android.testutils.TestableNetworkCallback;
 
 import org.junit.After;
 import org.junit.Before;
@@ -78,6 +80,7 @@ import java.net.Inet6Address;
 import java.net.InetAddress;
 import java.util.ArrayList;
 import java.util.List;
+import java.util.Set;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.Executor;
 import java.util.concurrent.TimeUnit;
@@ -89,6 +92,8 @@ public class DnsResolverTest {
     public static final DeviceConfigRule DEVICE_CONFIG_CLASS_RULE = new DeviceConfigRule();
     @Rule
     public final DevSdkIgnoreRule ignoreRule = new DevSdkIgnoreRule();
+    @Rule
+    public final AutoReleaseNetworkCallbackRule callbackRule = new AutoReleaseNetworkCallbackRule();
 
     private static final String TAG = "DnsResolverTest";
     private static final char[] HEX_CHARS = {
@@ -122,14 +127,11 @@ public class DnsResolverTest {
     private Context mContext;
     private ContentResolver mCR;
     private ConnectivityManager mCM;
-    private PackageManager mPackageManager;
     private CtsNetUtils mCtsNetUtils;
     private Executor mExecutor;
     private Executor mExecutorInline;
     private DnsResolver mDns;
 
-    private TestNetworkCallback mWifiRequestCallback = null;
-
     /**
      * @see BeforeClass
      */
@@ -154,15 +156,13 @@ public class DnsResolverTest {
         mCR = mContext.getContentResolver();
         mCtsNetUtils = new CtsNetUtils(mContext);
         mCtsNetUtils.storePrivateDnsSetting();
-        mPackageManager = mContext.getPackageManager();
+        callbackRule.requestCellIfSupported();
+        callbackRule.requestWifiIfSupported();
     }
 
     @After
     public void tearDown() throws Exception {
         mCtsNetUtils.restorePrivateDnsSetting();
-        if (mWifiRequestCallback != null) {
-            mCM.unregisterNetworkCallback(mWifiRequestCallback);
-        }
     }
 
     private static void maybeToggleWifiAndCell() throws Exception {
@@ -181,37 +181,21 @@ public class DnsResolverTest {
         return new String(hexChars);
     }
 
-    private Network[] getTestableNetworks() {
-        if (mPackageManager.hasSystemFeature(PackageManager.FEATURE_WIFI)) {
-            // File a NetworkRequest for Wi-Fi, so it connects even if a higher-scoring
-            // network, such as Ethernet, is already connected.
-            final NetworkRequest request = new NetworkRequest.Builder()
-                    .addTransportType(NetworkCapabilities.TRANSPORT_WIFI)
-                    .addCapability(NetworkCapabilities.NET_CAPABILITY_INTERNET)
-                    .build();
-            mWifiRequestCallback = new TestNetworkCallback();
-            mCM.requestNetwork(request, mWifiRequestCallback);
-            mCtsNetUtils.ensureWifiConnected();
-        }
-        final ArrayList<Network> testableNetworks = new ArrayList<Network>();
-        for (Network network : mCM.getAllNetworks()) {
-            final NetworkCapabilities nc = mCM.getNetworkCapabilities(network);
-            if (nc != null
-                    && nc.hasCapability(NetworkCapabilities.NET_CAPABILITY_NOT_RESTRICTED)
-                    && nc.hasCapability(NetworkCapabilities.NET_CAPABILITY_INTERNET)) {
-                testableNetworks.add(network);
-            }
-        }
+    /**
+     * Get all testable networks, and null to represent the default network.
+     */
+    private Set<Network> getTestableNetworksAndNull() {
+        final Set<Network> networks = new ArraySet<>();
+        networks.addAll(mCtsNetUtils.getTestableNetworks());
+        networks.add(null);
+        return networks;
+    }
 
-        assertTrue(
-                "This test requires that at least one network be connected. " +
-                        "Please ensure that the device is connected to a network.",
-                testableNetworks.size() >= 1);
-        // In order to test query with null network, add null as an element.
-        // Test cases which query with null network will go on default network.
-        testableNetworks.add(null);
-        Log.i(TAG, "Using testable networks: " + testableNetworks);
-        return testableNetworks.toArray(new Network[0]);
+    private Network getDefaultNetwork() {
+        final TestableNetworkCallback cb = callbackRule.registerDefaultNetworkCallback();
+        return testAndCleanup(
+                () -> cb.eventuallyExpect(CallbackEntry.AVAILABLE, TIMEOUT_MS).getNetwork(),
+                () -> callbackRule.unregisterNetworkCallback(cb));
     }
 
     static private void assertGreaterThan(String msg, int first, int second) {
@@ -422,7 +406,7 @@ public class DnsResolverTest {
 
     public void doTestRawQuery(Executor executor) throws InterruptedException {
         final String msg = "RawQuery " + TEST_DOMAIN;
-        for (Network network : getTestableNetworks()) {
+        for (Network network : getTestableNetworksAndNull()) {
             final VerifyCancelCallback callback = new VerifyCancelCallback(msg);
             mDns.rawQuery(network, TEST_DOMAIN, CLASS_IN, TYPE_AAAA, FLAG_NO_CACHE_LOOKUP,
                     executor, null, callback);
@@ -449,7 +433,7 @@ public class DnsResolverTest {
                 0x00, 0x01  /* Class */
         };
         final String msg = "RawQuery blob " + byteArrayToHexString(blob);
-        for (Network network : getTestableNetworks()) {
+        for (Network network : getTestableNetworksAndNull()) {
             final VerifyCancelCallback callback = new VerifyCancelCallback(msg);
             mDns.rawQuery(network, blob, FLAG_NO_CACHE_LOOKUP, executor, null, callback);
 
@@ -462,7 +446,7 @@ public class DnsResolverTest {
     public void doTestRawQueryRoot(Executor executor) throws InterruptedException {
         final String dname = "";
         final String msg = "RawQuery empty dname(ROOT) ";
-        for (Network network : getTestableNetworks()) {
+        for (Network network : getTestableNetworksAndNull()) {
             final VerifyCancelCallback callback = new VerifyCancelCallback(msg);
             mDns.rawQuery(network, dname, CLASS_IN, TYPE_AAAA, FLAG_NO_CACHE_LOOKUP,
                     executor, null, callback);
@@ -477,10 +461,10 @@ public class DnsResolverTest {
     public void doTestRawQueryNXDomain(Executor executor) throws InterruptedException {
         final String msg = "RawQuery " + TEST_NX_DOMAIN;
 
-        for (Network network : getTestableNetworks()) {
+        for (Network network : getTestableNetworksAndNull()) {
             final NetworkCapabilities nc = (network != null)
                     ? mCM.getNetworkCapabilities(network)
-                    : mCM.getNetworkCapabilities(mCM.getActiveNetwork());
+                    : mCM.getNetworkCapabilities(getDefaultNetwork());
             assertNotNull("Couldn't determine NetworkCapabilities for " + network, nc);
             // Some cellular networks configure their DNS servers never to return NXDOMAIN, so don't
             // test NXDOMAIN on these DNS servers.
@@ -502,9 +486,8 @@ public class DnsResolverTest {
         // Enable private DNS strict mode and set server to dns.google before doing NxDomain test.
         // b/144521720
         mCtsNetUtils.setPrivateDnsStrictMode(GOOGLE_PRIVATE_DNS_SERVER);
-        for (Network network :  getTestableNetworks()) {
-            final Network networkForPrivateDns =
-                    (network != null) ? network : mCM.getActiveNetwork();
+        for (Network network : getTestableNetworksAndNull()) {
+            final Network networkForPrivateDns = (network != null) ? network : getDefaultNetwork();
             assertNotNull("Can't find network to await private DNS on", networkForPrivateDns);
             Log.i(TAG, "Waiting for private DNS setting on " + networkForPrivateDns
                     + " (testable network: " + network + ")");
@@ -526,7 +509,7 @@ public class DnsResolverTest {
         // Start a DNS query and the cancel it immediately. Use VerifyCancelCallback to expect
         // that the query is cancelled before it succeeds. If it is not cancelled before it
         // succeeds, retry the test until it is.
-        for (Network network : getTestableNetworks()) {
+        for (Network network : getTestableNetworksAndNull()) {
             boolean retry = false;
             int round = 0;
             do {
@@ -556,7 +539,7 @@ public class DnsResolverTest {
         // Start a DNS query and the cancel it immediately. Use VerifyCancelCallback to expect
         // that the query is cancelled before it succeeds. If it is not cancelled before it
         // succeeds, retry the test until it is.
-        for (Network network : getTestableNetworks()) {
+        for (Network network : getTestableNetworksAndNull()) {
             boolean retry = false;
             int round = 0;
             do {
@@ -582,7 +565,7 @@ public class DnsResolverTest {
     @Test
     public void testCancelBeforeQuery() throws InterruptedException {
         final String msg = "Test cancelled RawQuery " + TEST_DOMAIN;
-        for (Network network : getTestableNetworks()) {
+        for (Network network : getTestableNetworksAndNull()) {
             final VerifyCancelCallback callback = new VerifyCancelCallback(msg);
             final CancellationSignal cancelSignal = new CancellationSignal();
             cancelSignal.cancel();
@@ -716,7 +699,7 @@ public class DnsResolverTest {
 
     public void doTestQueryForInetAddress(Executor executor) throws InterruptedException {
         final String msg = "Test query for InetAddress " + TEST_DOMAIN;
-        for (Network network : getTestableNetworks()) {
+        for (Network network : getTestableNetworksAndNull()) {
             final VerifyCancelInetAddressCallback callback =
                     new VerifyCancelInetAddressCallback(msg, null);
             mDns.query(network, TEST_DOMAIN, FLAG_NO_CACHE_LOOKUP, executor, null, callback);
@@ -734,7 +717,7 @@ public class DnsResolverTest {
         // Start a DNS query and the cancel it immediately. Use VerifyCancelInetAddressCallback to
         // expect that the query is cancelled before it succeeds. If it is not cancelled before it
         // succeeds, retry the test until it is.
-        for (Network network : getTestableNetworks()) {
+        for (Network network : getTestableNetworksAndNull()) {
             boolean retry = false;
             int round = 0;
             do {
@@ -760,7 +743,7 @@ public class DnsResolverTest {
 
     public void doTestQueryForInetAddressIpv4(Executor executor) throws InterruptedException {
         final String msg = "Test query for IPv4 InetAddress " + TEST_DOMAIN;
-        for (Network network : getTestableNetworks()) {
+        for (Network network : getTestableNetworksAndNull()) {
             final VerifyCancelInetAddressCallback callback =
                     new VerifyCancelInetAddressCallback(msg, null);
             mDns.query(network, TEST_DOMAIN, TYPE_A, FLAG_NO_CACHE_LOOKUP,
@@ -776,7 +759,7 @@ public class DnsResolverTest {
 
     public void doTestQueryForInetAddressIpv6(Executor executor) throws InterruptedException {
         final String msg = "Test query for IPv6 InetAddress " + TEST_DOMAIN;
-        for (Network network : getTestableNetworks()) {
+        for (Network network : getTestableNetworksAndNull()) {
             final VerifyCancelInetAddressCallback callback =
                     new VerifyCancelInetAddressCallback(msg, null);
             mDns.query(network, TEST_DOMAIN, TYPE_AAAA, FLAG_NO_CACHE_LOOKUP,
@@ -804,7 +787,7 @@ public class DnsResolverTest {
     }
 
     private void doTestPrivateDnsBypass() throws InterruptedException {
-        final Network[] testNetworks = getTestableNetworks();
+        final Set<Network> testNetworks = getTestableNetworksAndNull();
 
         // Set an invalid private DNS server
         mCtsNetUtils.setPrivateDnsStrictMode(INVALID_PRIVATE_DNS_SERVER);
@@ -871,7 +854,7 @@ public class DnsResolverTest {
     }
 
     public void doTestContinuousQueries(Executor executor) throws InterruptedException {
-        for (Network network : getTestableNetworks()) {
+        for (Network network : getTestableNetworksAndNull()) {
             for (int i = 0; i < QUERY_TIMES ; ++i) {
                 // query v6/v4 in turn
                 boolean queryV6 = (i % 2 == 0);
diff --git a/tests/cts/net/src/android/net/cts/MultinetworkApiTest.java b/tests/cts/net/src/android/net/cts/MultinetworkApiTest.java
index c67443e1d1..6ae9f1dc5c 100644
--- a/tests/cts/net/src/android/net/cts/MultinetworkApiTest.java
+++ b/tests/cts/net/src/android/net/cts/MultinetworkApiTest.java
@@ -16,19 +16,15 @@
 
 package android.net.cts;
 
-import static android.content.pm.PackageManager.FEATURE_TELEPHONY;
-import static android.content.pm.PackageManager.FEATURE_WIFI;
 import static android.net.NetworkCapabilities.TRANSPORT_CELLULAR;
 import static android.net.NetworkCapabilities.TRANSPORT_WIFI;
 import static android.provider.DeviceConfig.NAMESPACE_CONNECTIVITY;
 
 import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertNull;
 import static org.junit.Assert.fail;
 
-import android.content.ContentResolver;
 import android.content.Context;
 import android.net.ConnectivityManager;
 import android.net.Network;
@@ -38,7 +34,6 @@ import android.net.cts.util.CtsNetUtils;
 import android.platform.test.annotations.AppModeFull;
 import android.system.ErrnoException;
 import android.system.OsConstants;
-import android.util.ArraySet;
 import android.util.Log;
 
 import androidx.test.platform.app.InstrumentationRegistry;
@@ -56,7 +51,6 @@ import org.junit.runner.RunWith;
 
 import java.util.ArrayList;
 import java.util.Arrays;
-import java.util.Set;
 
 @DevSdkIgnoreRunner.RestoreDefaultNetwork
 @RunWith(DevSdkIgnoreRunner.class)
@@ -110,23 +104,21 @@ public class MultinetworkApiTest {
     private static native void runResNnxDomainCheck(long networkHandle);
 
 
-    private ContentResolver mCR;
     private ConnectivityManager mCM;
     private CtsNetUtils mCtsNetUtils;
-    private Context mContext;
-    private Network mRequestedCellNetwork;
 
     @Before
     public void setUp() throws Exception {
-        mContext = InstrumentationRegistry.getInstrumentation().getContext();
-        mCM = mContext.getSystemService(ConnectivityManager.class);
-        mCR = mContext.getContentResolver();
-        mCtsNetUtils = new CtsNetUtils(mContext);
+        final Context context = InstrumentationRegistry.getInstrumentation().getContext();
+        mCM = context.getSystemService(ConnectivityManager.class);
+        mCtsNetUtils = new CtsNetUtils(context);
+        mNetworkCallbackRule.requestCellIfSupported();
+        mNetworkCallbackRule.requestWifiIfSupported();
     }
 
     @Test
     public void testGetaddrinfo() throws Exception {
-        for (Network network : getTestableNetworks()) {
+        for (Network network : mCtsNetUtils.getTestableNetworks()) {
             int errno = runGetaddrinfoCheck(network.getNetworkHandle());
             if (errno != 0) {
                 throw new ErrnoException(
@@ -142,7 +134,7 @@ public class MultinetworkApiTest {
         assertNull(mCM.getProcessDefaultNetwork());
         assertEquals(0, NetworkUtils.getBoundNetworkForProcess());
 
-        for (Network network : getTestableNetworks()) {
+        for (Network network : mCtsNetUtils.getTestableNetworks()) {
             mCM.setProcessDefaultNetwork(null);
             assertNull(mCM.getProcessDefaultNetwork());
 
@@ -161,7 +153,7 @@ public class MultinetworkApiTest {
             mCM.setProcessDefaultNetwork(null);
         }
 
-        for (Network network : getTestableNetworks()) {
+        for (Network network : mCtsNetUtils.getTestableNetworks()) {
             NetworkUtils.bindProcessToNetwork(0);
             assertNull(mCM.getBoundNetworkForProcess());
 
@@ -182,7 +174,7 @@ public class MultinetworkApiTest {
     @Test
     @AppModeFull(reason = "CHANGE_NETWORK_STATE permission can't be granted to instant apps")
     public void testSetsocknetwork() throws Exception {
-        for (Network network : getTestableNetworks()) {
+        for (Network network : mCtsNetUtils.getTestableNetworks()) {
             int errno = runSetsocknetwork(network.getNetworkHandle());
             if (errno != 0) {
                 throw new ErrnoException(
@@ -236,7 +228,7 @@ public class MultinetworkApiTest {
 
     @Test
     public void testNativeDatagramTransmission() throws Exception {
-        for (Network network : getTestableNetworks()) {
+        for (Network network : mCtsNetUtils.getTestableNetworks()) {
             final QueryTestResult result = runDatagramCheck(network.getNetworkHandle(),
                     0 /* sourcePort */);
             if (result.errNo == 0) {
@@ -273,7 +265,7 @@ public class MultinetworkApiTest {
     @Test
     public void testNetworkHandle() throws Exception {
         // Test Network -> NetworkHandle -> Network results in the same Network.
-        for (Network network : getTestableNetworks()) {
+        for (Network network : mCtsNetUtils.getTestableNetworks()) {
             long networkHandle = network.getNetworkHandle();
             Network newNetwork = Network.fromNetworkHandle(networkHandle);
             assertEquals(newNetwork, network);
@@ -296,7 +288,7 @@ public class MultinetworkApiTest {
 
     @Test
     public void testResNApi() throws Exception {
-        for (Network network : getTestableNetworks()) {
+        for (Network network : mCtsNetUtils.getTestableNetworks()) {
             // Throws AssertionError directly in jni function if test fail.
             runResNqueryCheck(network.getNetworkHandle());
             runResNsendCheck(network.getNetworkHandle());
@@ -332,7 +324,7 @@ public class MultinetworkApiTest {
         // b/144521720
         try {
             mCtsNetUtils.setPrivateDnsStrictMode(GOOGLE_PRIVATE_DNS_SERVER);
-            for (Network network : getTestableNetworks()) {
+            for (Network network : mCtsNetUtils.getTestableNetworks()) {
               // Wait for private DNS setting to propagate.
               mCtsNetUtils.awaitPrivateDnsSetting("NxDomain test wait private DNS setting timeout",
                         network, GOOGLE_PRIVATE_DNS_SERVER, true);
@@ -342,52 +334,4 @@ public class MultinetworkApiTest {
             mCtsNetUtils.restorePrivateDnsSetting();
         }
     }
-
-    /**
-     * Get all testable Networks with internet capability.
-     */
-    private Set<Network> getTestableNetworks() throws InterruptedException {
-        // Calling requestNetwork() to request a cell or Wi-Fi network via CtsNetUtils or
-        // NetworkCallbackRule requires the CHANGE_NETWORK_STATE permission. This permission cannot
-        // be granted to instant apps. Therefore, return currently available testable networks
-        // directly in instant mode.
-        if (mContext.getApplicationInfo().isInstantApp()) {
-            return new ArraySet<>(mCtsNetUtils.getTestableNetworks());
-        }
-
-        // Obtain cell and Wi-Fi through CtsNetUtils (which uses NetworkCallbacks), as they may have
-        // just been reconnected by the test using NetworkCallbacks, so synchronous calls may not
-        // yet return them (synchronous calls and callbacks should not be mixed for a given
-        // Network).
-        final Set<Network> testableNetworks = new ArraySet<>();
-        if (mContext.getPackageManager().hasSystemFeature(FEATURE_TELEPHONY)) {
-            if (mRequestedCellNetwork == null) {
-                mRequestedCellNetwork = mNetworkCallbackRule.requestCell();
-            }
-            assertNotNull("Cell network requested but not obtained", mRequestedCellNetwork);
-            testableNetworks.add(mRequestedCellNetwork);
-        }
-
-        if (mContext.getPackageManager().hasSystemFeature(FEATURE_WIFI)) {
-            testableNetworks.add(mCtsNetUtils.ensureWifiConnected());
-        }
-
-        // Obtain other networks through the synchronous API, if any.
-        for (Network network : mCtsNetUtils.getTestableNetworks()) {
-            final NetworkCapabilities nc = mCM.getNetworkCapabilities(network);
-            if (nc != null
-                    && !nc.hasTransport(TRANSPORT_WIFI)
-                    && !nc.hasTransport(TRANSPORT_CELLULAR)) {
-                testableNetworks.add(network);
-            }
-        }
-
-        // In practice this should not happen as getTestableNetworks throws if there is no network
-        // at all.
-        assertFalse("This device does not support WiFi nor cell data, and does not have any other "
-                        + "network connected. This test requires at least one internet-providing "
-                        + "network.",
-                testableNetworks.isEmpty());
-        return testableNetworks;
-    }
 }
diff --git a/tests/cts/net/util/java/android/net/cts/util/CtsNetUtils.java b/tests/cts/net/util/java/android/net/cts/util/CtsNetUtils.java
index 5e24452c73..e8ce959d00 100644
--- a/tests/cts/net/util/java/android/net/cts/util/CtsNetUtils.java
+++ b/tests/cts/net/util/java/android/net/cts/util/CtsNetUtils.java
@@ -18,14 +18,18 @@ package android.net.cts.util;
 
 import static android.Manifest.permission.MODIFY_PHONE_STATE;
 import static android.Manifest.permission.NETWORK_SETTINGS;
+import static android.content.pm.PackageManager.FEATURE_TELEPHONY;
+import static android.content.pm.PackageManager.FEATURE_WIFI;
 import static android.net.NetworkCapabilities.NET_CAPABILITY_INTERNET;
 import static android.net.NetworkCapabilities.TRANSPORT_CELLULAR;
 import static android.net.NetworkCapabilities.TRANSPORT_TEST;
+import static android.net.NetworkCapabilities.TRANSPORT_WIFI;
 
 import static com.android.compatibility.common.util.PropertyUtil.getFirstApiLevel;
 import static com.android.testutils.TestPermissionUtil.runAsShell;
 
 import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
@@ -59,6 +63,7 @@ import android.system.OsConstants;
 import android.telephony.SubscriptionManager;
 import android.telephony.TelephonyManager;
 import android.text.TextUtils;
+import android.util.ArraySet;
 import android.util.Log;
 
 import androidx.annotation.Nullable;
@@ -69,6 +74,8 @@ import com.android.compatibility.common.util.SystemUtil;
 import com.android.modules.utils.build.SdkLevel;
 import com.android.net.module.util.ConnectivitySettingsUtils;
 import com.android.testutils.ConnectUtil;
+import com.android.testutils.RecorderCallback.CallbackEntry;
+import com.android.testutils.TestableNetworkCallback;
 
 import java.io.IOException;
 import java.io.InputStream;
@@ -76,11 +83,14 @@ import java.io.OutputStream;
 import java.net.InetSocketAddress;
 import java.net.Socket;
 import java.util.ArrayList;
+import java.util.List;
 import java.util.Objects;
+import java.util.Set;
 import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.TimeoutException;
+import java.util.function.Predicate;
 
 public final class CtsNetUtils {
     private static final String TAG = CtsNetUtils.class.getSimpleName();
@@ -544,23 +554,69 @@ public final class CtsNetUtils {
 
     /**
      * Get all testable Networks with internet capability.
+     *
+     * <p>At least cellular and Wi-Fi networks are expected to be returned when supported, so tests
+     * must ensure that network requests are filed for them (so they are up) before calling this
+     * method.
      */
-    public Network[] getTestableNetworks() {
+    public Set<Network> getTestableNetworks() {
+        // Calling requestNetwork() to request a cell or Wi-Fi network via CtsNetUtils or
+        // NetworkCallbackRule requires the CHANGE_NETWORK_STATE permission. This permission cannot
+        // be granted to instant apps. Therefore, return currently available testable networks
+        // directly in instant mode.
+        if (mContext.getApplicationInfo().isInstantApp()) {
+            return new ArraySet<>(getTestableNetworks(nc -> true));
+        }
+
+        // Obtain cell and Wi-Fi through NetworkCallbacks, as they may have just been reconnected by
+        // the test using NetworkCallbacks, so synchronous calls may not yet return them
+        // (synchronous calls and callbacks should not be mixed for a given Network).
+        final Set<Network> testableNetworks = new ArraySet<>();
+        if (mContext.getPackageManager().hasSystemFeature(FEATURE_TELEPHONY)) {
+            final String errorMsg = "No cell network obtained within timeout. Ensure that the "
+                    + "device has working mobile data, and that the test has filed a request for "
+                    + "TRANSPORT_CELLULAR before calling getTestableNetworks().";
+            final TestableNetworkCallback cb = new TestableNetworkCallback();
+            mCm.registerNetworkCallback(new NetworkRequest.Builder()
+                    .addTransportType(NetworkCapabilities.TRANSPORT_CELLULAR)
+                    .addCapability(NetworkCapabilities.NET_CAPABILITY_INTERNET)
+                    .build(), cb);
+            final Network cellNetwork = cb.expect(CallbackEntry.AVAILABLE, errorMsg).getNetwork();
+            mCm.unregisterNetworkCallback(cb);
+            testableNetworks.add(cellNetwork);
+        }
+
+        if (mContext.getPackageManager().hasSystemFeature(FEATURE_WIFI)) {
+            testableNetworks.add(ensureWifiConnected());
+        }
+
+        // Obtain other networks through the synchronous API, if any.
+        testableNetworks.addAll(getTestableNetworks(nc ->
+                !nc.hasTransport(TRANSPORT_WIFI) && !nc.hasTransport(TRANSPORT_CELLULAR)));
+
+        // If Wi-Fi or cell are supported testableNetworks won't be empty as per previous assertions
+        assertFalse("This device does not support Wi-Fi nor cell data, and does not have any other "
+                        + "network connected. This test requires at least one internet-providing "
+                        + "network.",
+                testableNetworks.isEmpty());
+        return testableNetworks;
+    }
+
+    /**
+     * Get all testable Networks with internet capability.
+     */
+    private List<Network> getTestableNetworks(Predicate<NetworkCapabilities> filter) {
         final ArrayList<Network> testableNetworks = new ArrayList<Network>();
         for (Network network : mCm.getAllNetworks()) {
             final NetworkCapabilities nc = mCm.getNetworkCapabilities(network);
             if (nc != null
                     && nc.hasCapability(NetworkCapabilities.NET_CAPABILITY_NOT_RESTRICTED)
-                    && nc.hasCapability(NetworkCapabilities.NET_CAPABILITY_INTERNET)) {
+                    && nc.hasCapability(NetworkCapabilities.NET_CAPABILITY_INTERNET)
+                    && filter.test(nc)) {
                 testableNetworks.add(network);
             }
         }
-
-        assertTrue("This test requires that at least one public Internet-providing"
-                        + " network be connected. Please ensure that the device is connected to"
-                        + " a network.",
-                testableNetworks.size() >= 1);
-        return testableNetworks.toArray(new Network[0]);
+        return testableNetworks;
     }
 
     /**

From eae4ebf690084929de533053e80684ff9bb6022c Mon Sep 17 00:00:00 2001
From: Remi NGUYEN VAN <reminv@google.com>
Date: Mon, 21 Apr 2025 15:29:30 +0900
Subject: [PATCH 140/377] Hardcode the setting for multipath preference

Remove the dependency on hidden API by setting the constant in tests.

While there is a ConnectivitySettingsManager for this setting, it is
mostly broken (does not allow combining different bitmask values for the
multipath preference), and OEMs are much more likely to be setting the
setting directly. In practice the constant cannot be changed, otherwise
some of these callers may break. Therefore it is more valuable/realistic
to test behavior when the setting is modified directly.

Test: atest
Flag: TEST_ONLY
Bug: 410435307
Bug: 411565010
Change-Id: I802541ae0a6a6bab4b98c1a64dacb04775c349df
---
 .../android/net/cts/ConnectivityManagerTest.java    | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java b/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
index 207b2e5206..64441c674a 100644
--- a/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
+++ b/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
@@ -98,7 +98,6 @@ import static android.net.cts.util.CtsNetUtils.TEST_HOST;
 import static android.net.cts.util.CtsTetheringUtils.TestTetheringEventCallback;
 import static android.os.MessageQueue.OnFileDescriptorEventListener.EVENT_INPUT;
 import static android.os.Process.INVALID_UID;
-import static android.provider.Settings.Global.NETWORK_METERED_MULTIPATH_PREFERENCE;
 import static android.system.OsConstants.AF_INET;
 import static android.system.OsConstants.AF_INET6;
 import static android.system.OsConstants.AF_UNSPEC;
@@ -345,6 +344,8 @@ public class ConnectivityManagerTest {
     public static final int MIN_SUPPORTED_CELLULAR_KEEPALIVE_COUNT = 1;
     public static final int MIN_SUPPORTED_WIFI_KEEPALIVE_COUNT = 3;
 
+    private static final String NETWORK_METERED_MULTIPATH_PREFERENCE_SETTING =
+            "network_metered_multipath_preference";
     private static final String NETWORK_METERED_MULTIPATH_PREFERENCE_RES_NAME =
             "config_networkMeteredMultipathPreference";
     private static final String KEEPALIVE_ALLOWED_UNPRIVILEGED_RES_NAME =
@@ -1653,7 +1654,7 @@ public class ConnectivityManagerTest {
 
     private int getCurrentMeteredMultipathPreference(ContentResolver resolver) {
         final String rawMeteredPref = Settings.Global.getString(resolver,
-                NETWORK_METERED_MULTIPATH_PREFERENCE);
+                NETWORK_METERED_MULTIPATH_PREFERENCE_SETTING);
         return TextUtils.isEmpty(rawMeteredPref)
             ? getIntResourceForName(NETWORK_METERED_MULTIPATH_PREFERENCE_RES_NAME)
             : Integer.parseInt(rawMeteredPref);
@@ -1684,11 +1685,11 @@ public class ConnectivityManagerTest {
         final String ssid = unquoteSSID(getSSID());
         final String oldMeteredSetting = getWifiMeteredStatus(ssid);
         final String oldMeteredMultipathPreference = Settings.Global.getString(
-                resolver, NETWORK_METERED_MULTIPATH_PREFERENCE);
+                resolver, NETWORK_METERED_MULTIPATH_PREFERENCE_SETTING);
         try {
             final int initialMeteredPreference = getCurrentMeteredMultipathPreference(resolver);
             int newMeteredPreference = findNextPrefValue(resolver);
-            Settings.Global.putString(resolver, NETWORK_METERED_MULTIPATH_PREFERENCE,
+            Settings.Global.putString(resolver, NETWORK_METERED_MULTIPATH_PREFERENCE_SETTING,
                     Integer.toString(newMeteredPreference));
             // Wifi meteredness changes from unmetered to metered will disconnect and reconnect
             // since R.
@@ -1702,7 +1703,7 @@ public class ConnectivityManagerTest {
 
             final int oldMeteredPreference = newMeteredPreference;
             newMeteredPreference = findNextPrefValue(resolver);
-            Settings.Global.putString(resolver, NETWORK_METERED_MULTIPATH_PREFERENCE,
+            Settings.Global.putString(resolver, NETWORK_METERED_MULTIPATH_PREFERENCE_SETTING,
                     Integer.toString(newMeteredPreference));
             assertEquals(mCm.getNetworkCapabilities(network).hasCapability(
                     NET_CAPABILITY_NOT_METERED), false);
@@ -1716,7 +1717,7 @@ public class ConnectivityManagerTest {
             assertMultipathPreferenceIsEventually(network, newMeteredPreference,
                     ConnectivityManager.MULTIPATH_PREFERENCE_UNMETERED);
         } finally {
-            Settings.Global.putString(resolver, NETWORK_METERED_MULTIPATH_PREFERENCE,
+            Settings.Global.putString(resolver, NETWORK_METERED_MULTIPATH_PREFERENCE_SETTING,
                     oldMeteredMultipathPreference);
             setWifiMeteredStatus(ssid, oldMeteredSetting);
         }

From 0cd0ded23fa7a0802a1d6bdc3eef34aea95f9e18 Mon Sep 17 00:00:00 2001
From: Remi NGUYEN VAN <reminv@google.com>
Date: Fri, 11 Apr 2025 15:01:40 +0900
Subject: [PATCH 141/377] Remove most hidden API usage in net CTS

Replace usage of hidden API that can easily be replaced by API
equivalents in CtsNetTestCases.

Test: atest
Flag: TEST_ONLY
Bug: 410435307
Change-Id: Ia76913682eaf0590126706cdcb92b5c2cdaad561
---
 .../ConnectivityDiagnosticsManagerTest.java   |  8 ++--
 .../net/cts/ConnectivityManagerTest.java      | 19 +++------
 .../src/android/net/cts/DnsResolverTest.java  |  8 ++--
 .../net/src/android/net/cts/DscpPolicyTest.kt |  5 ++-
 .../net/src/android/net/cts/Ikev2VpnTest.java |  2 +-
 .../src/android/net/cts/NetworkAgentTest.kt   | 40 +++++++++++--------
 .../net/cts/NetworkStatsBinderTest.java       |  4 +-
 .../android/net/cts/NetworkValidationTest.kt  | 19 +++++----
 .../android/net/cts/PacProxyManagerTest.java  |  8 ++--
 9 files changed, 59 insertions(+), 54 deletions(-)

diff --git a/tests/cts/net/src/android/net/cts/ConnectivityDiagnosticsManagerTest.java b/tests/cts/net/src/android/net/cts/ConnectivityDiagnosticsManagerTest.java
index faaadeeb43..b5a31ad8c3 100644
--- a/tests/cts/net/src/android/net/cts/ConnectivityDiagnosticsManagerTest.java
+++ b/tests/cts/net/src/android/net/cts/ConnectivityDiagnosticsManagerTest.java
@@ -82,10 +82,10 @@ import androidx.test.InstrumentationRegistry;
 
 import com.android.compatibility.common.util.SystemUtil;
 import com.android.compatibility.common.util.ThrowingRunnable;
-import com.android.internal.telephony.uicc.IccUtils;
-import com.android.internal.util.ArrayUtils;
 import com.android.modules.utils.build.SdkLevel;
 import com.android.net.module.util.ArrayTrackRecord;
+import com.android.net.module.util.CollectionUtils;
+import com.android.net.module.util.HexDump;
 import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo;
 import com.android.testutils.DevSdkIgnoreRunner;
 import com.android.testutils.com.android.testutils.CarrierConfigRule;
@@ -280,7 +280,7 @@ public class ConnectivityDiagnosticsManagerTest {
                         mContext.getOpPackageName(), PackageManager.GET_SIGNATURES);
         final MessageDigest md = MessageDigest.getInstance(SHA_256);
         final byte[] certHash = md.digest(pkgInfo.signatures[0].toByteArray());
-        return IccUtils.bytesToHexString(certHash);
+        return HexDump.toHexString(certHash);
     }
 
     private void doBroadcastCarrierConfigsAndVerifyOnConnectivityReportAvailable(
@@ -680,7 +680,7 @@ public class ConnectivityDiagnosticsManagerTest {
             final String[] certs = carrierConfigs.getStringArray(
                     CarrierConfigManager.KEY_CARRIER_CERTIFICATE_STRING_ARRAY);
             try {
-                if (ArrayUtils.contains(certs, getCertHashForThisPackage())) {
+                if (CollectionUtils.contains(certs, getCertHashForThisPackage())) {
                     // Received an update for this package's cert hash - countdown and exit
                     mLatch.countDown();
                 }
diff --git a/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java b/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
index 64441c674a..95e3cb805f 100644
--- a/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
+++ b/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
@@ -191,7 +191,6 @@ import android.os.MessageQueue;
 import android.os.ParcelFileDescriptor;
 import android.os.Process;
 import android.os.RemoteException;
-import android.os.ServiceManager;
 import android.os.SystemClock;
 import android.os.UserHandle;
 import android.os.VintfRuntimeInfo;
@@ -212,7 +211,6 @@ import androidx.test.filters.RequiresDevice;
 import androidx.test.platform.app.InstrumentationRegistry;
 
 import com.android.compatibility.common.util.DynamicConfigDeviceSide;
-import com.android.internal.util.ArrayUtils;
 import com.android.modules.utils.build.SdkLevel;
 import com.android.net.module.util.CollectionUtils;
 import com.android.net.module.util.DnsPacket;
@@ -595,8 +593,9 @@ public class ConnectivityManagerTest {
         assertNotEquals(SubscriptionManager.INVALID_SUBSCRIPTION_ID, subId);
 
         // Get subscriber Id from telephony manager.
-        final TelephonyManager tm = mContext.getSystemService(TelephonyManager.class);
-        return runWithShellPermissionIdentity(() -> tm.getSubscriberId(subId),
+        final TelephonyManager tm = mContext.getSystemService(TelephonyManager.class)
+                .createForSubscriptionId(subId);
+        return runWithShellPermissionIdentity(() -> tm.getSubscriberId(),
                 android.Manifest.permission.READ_PRIVILEGED_PHONE_STATE);
     }
 
@@ -1074,14 +1073,6 @@ public class ConnectivityManagerTest {
     }
 
     private boolean hasEthernetService() {
-        // On Q creating EthernetManager from a thread that does not have a looper (like the test
-        // thread) crashes because it tried to use Looper.myLooper() through the default Handler
-        // constructor to run onAvailabilityChanged callbacks. Use ServiceManager to check whether
-        // the service exists instead.
-        // TODO: remove once Q is no longer supported in MTS, as ServiceManager is hidden API
-        if (Build.VERSION.SDK_INT <= Build.VERSION_CODES.Q) {
-            return ServiceManager.getService(Context.ETHERNET_SERVICE) != null;
-        }
         return mContext.getSystemService(Context.ETHERNET_SERVICE) != null;
     }
 
@@ -2306,7 +2297,7 @@ public class ConnectivityManagerTest {
         // Ensure that CONNECTIVITY_USE_RESTRICTED_NETWORKS isn't granted to this package.
         final PackageInfo app = mPackageManager.getPackageInfo(mContext.getPackageName(),
                 GET_PERMISSIONS);
-        final int index = ArrayUtils.indexOf(
+        final int index = CollectionUtils.indexOf(
                 app.requestedPermissions, CONNECTIVITY_USE_RESTRICTED_NETWORKS);
         assertTrue(index >= 0);
         assertTrue(app.requestedPermissionsFlags[index] != PERMISSION_GRANTED);
@@ -2667,7 +2658,7 @@ public class ConnectivityManagerTest {
         final DetailedBlockedStatusCallback otherUidCallback = new DetailedBlockedStatusCallback();
 
         final int myUid = Process.myUid();
-        final int otherUid = UserHandle.getUid(5, Process.FIRST_APPLICATION_UID);
+        final int otherUid = UserHandle.of(5).getUid(Process.FIRST_APPLICATION_UID);
         final Handler handler = new Handler(Looper.getMainLooper());
 
         networkCallbackRule.registerDefaultNetworkCallback(myUidCallback, handler);
diff --git a/tests/cts/net/src/android/net/cts/DnsResolverTest.java b/tests/cts/net/src/android/net/cts/DnsResolverTest.java
index b66b853552..31467fa54a 100644
--- a/tests/cts/net/src/android/net/cts/DnsResolverTest.java
+++ b/tests/cts/net/src/android/net/cts/DnsResolverTest.java
@@ -789,13 +789,15 @@ public class DnsResolverTest {
 
     @Test
     public void testPrivateDnsBypass() throws InterruptedException {
+        final String dataStallRecoveryOnBadNetworkSetting =
+                "data_stall_recovery_on_bad_network";
         final String dataStallSetting = Settings.Global.getString(mCR,
-                Settings.Global.DATA_STALL_RECOVERY_ON_BAD_NETWORK);
-        Settings.Global.putInt(mCR, Settings.Global.DATA_STALL_RECOVERY_ON_BAD_NETWORK, 0);
+                dataStallRecoveryOnBadNetworkSetting);
+        Settings.Global.putInt(mCR, dataStallRecoveryOnBadNetworkSetting, 0);
         try {
             doTestPrivateDnsBypass();
         } finally {
-            Settings.Global.putString(mCR, Settings.Global.DATA_STALL_RECOVERY_ON_BAD_NETWORK,
+            Settings.Global.putString(mCR, dataStallRecoveryOnBadNetworkSetting,
                     dataStallSetting);
         }
     }
diff --git a/tests/cts/net/src/android/net/cts/DscpPolicyTest.kt b/tests/cts/net/src/android/net/cts/DscpPolicyTest.kt
index 1b17c87f0f..631fdd25ef 100644
--- a/tests/cts/net/src/android/net/cts/DscpPolicyTest.kt
+++ b/tests/cts/net/src/android/net/cts/DscpPolicyTest.kt
@@ -46,6 +46,7 @@ import android.net.TestNetworkInterface
 import android.net.TestNetworkManager
 import android.net.TestNetworkManager.TestInterfaceRequest
 import android.net.cts.util.CtsNetUtils.TestNetworkCallback
+import android.os.Handler
 import android.os.HandlerThread
 import android.os.SystemClock
 import android.platform.test.annotations.AppModeFull
@@ -71,8 +72,8 @@ import com.android.testutils.CompatUtil
 import com.android.testutils.ConnectivityModuleTest
 import com.android.testutils.DevSdkIgnoreRule
 import com.android.testutils.NdResponder
-import com.android.testutils.SC_V2
 import com.android.testutils.PollPacketReader
+import com.android.testutils.SC_V2
 import com.android.testutils.TestableNetworkAgent
 import com.android.testutils.TestableNetworkAgent.CallbackEntry.OnDscpPolicyStatusUpdated
 import com.android.testutils.TestableNetworkAgent.CallbackEntry.OnNetworkCreated
@@ -175,7 +176,7 @@ class DscpPolicyTest {
 
         handlerThread.start()
         reader = PollPacketReader(
-                handlerThread.threadHandler,
+                Handler(handlerThread.looper),
                 iface.fileDescriptor.fileDescriptor,
                 MAX_PACKET_LENGTH)
         reader.startAsyncForTest()
diff --git a/tests/cts/net/src/android/net/cts/Ikev2VpnTest.java b/tests/cts/net/src/android/net/cts/Ikev2VpnTest.java
index cb55bd5dad..d948241e02 100644
--- a/tests/cts/net/src/android/net/cts/Ikev2VpnTest.java
+++ b/tests/cts/net/src/android/net/cts/Ikev2VpnTest.java
@@ -61,7 +61,7 @@ import android.text.TextUtils;
 
 import androidx.test.InstrumentationRegistry;
 
-import com.android.internal.util.HexDump;
+import com.android.net.module.util.HexDump;
 import com.android.networkstack.apishim.ConstantsShim;
 import com.android.networkstack.apishim.VpnManagerShimImpl;
 import com.android.networkstack.apishim.common.VpnManagerShim;
diff --git a/tests/cts/net/src/android/net/cts/NetworkAgentTest.kt b/tests/cts/net/src/android/net/cts/NetworkAgentTest.kt
index 7c75211151..8592ae41da 100644
--- a/tests/cts/net/src/android/net/cts/NetworkAgentTest.kt
+++ b/tests/cts/net/src/android/net/cts/NetworkAgentTest.kt
@@ -96,7 +96,6 @@ import android.telephony.SubscriptionManager
 import android.telephony.TelephonyManager
 import android.telephony.data.EpsBearerQosSessionAttributes
 import android.util.ArraySet
-import android.util.DebugUtils.valueToString
 import androidx.test.InstrumentationRegistry
 import com.android.compatibility.common.util.SystemUtil.runShellCommand
 import com.android.compatibility.common.util.SystemUtil.runWithShellPermissionIdentity
@@ -704,7 +703,9 @@ class NetworkAgentTest {
         val specifier = when {
             transports.size != 1 -> null
             TRANSPORT_ETHERNET in transports -> EthernetNetworkSpecifier("testInterface")
-            TRANSPORT_CELLULAR in transports -> TelephonyNetworkSpecifier(subId)
+            TRANSPORT_CELLULAR in transports -> {
+                TelephonyNetworkSpecifier.Builder().setSubscriptionId(subId).build()
+            }
             else -> null
         }
         val transportInfo = if (TRANSPORT_WIFI in transports && SdkLevel.isAtLeastV()) {
@@ -971,12 +972,11 @@ class NetworkAgentTest {
         // underlying networks, and because not congested, not roaming, and not suspended are the
         // default anyway. It's still useful as an extra check though.
         vpnNc = mCM.getNetworkCapabilities(agent.network!!)!!
-        for (cap in listOf(
-            NET_CAPABILITY_NOT_CONGESTED,
-            NET_CAPABILITY_NOT_ROAMING,
-            NET_CAPABILITY_NOT_SUSPENDED
+        for ((cap, capStr) in listOf(
+            NET_CAPABILITY_NOT_CONGESTED to "NET_CAPABILITY_NOT_CONGESTED",
+            NET_CAPABILITY_NOT_ROAMING to "NET_CAPABILITY_NOT_ROAMING",
+            NET_CAPABILITY_NOT_SUSPENDED to "NET_CAPABILITY_NOT_SUSPENDED"
         )) {
-            val capStr = valueToString(NetworkCapabilities::class.java, "NET_CAPABILITY_", cap)
             if (defaultNetworkCapabilities.hasCapability(cap) && !vpnNc.hasCapability(cap)) {
                 fail("$capStr not propagated from underlying: $defaultNetworkCapabilities")
             }
@@ -1265,7 +1265,7 @@ class NetworkAgentTest {
                 .addCapability(NET_CAPABILITY_NOT_VCN_MANAGED)
                 .build(),
             bestMatchingCb,
-            mHandlerThread.threadHandler
+            Handler(mHandlerThread.looper)
         )
 
         val (agent1, _) = createConnectedNetworkAgent(specifier = "AGENT-1")
@@ -1587,14 +1587,22 @@ class NetworkAgentTest {
     private fun createEpsAttributes(qci: Int = 1): EpsBearerQosSessionAttributes {
         val remoteAddresses = ArrayList<InetSocketAddress>()
         remoteAddresses.add(InetSocketAddress(REMOTE_ADDRESS, 80))
-        return EpsBearerQosSessionAttributes(
-            qci,
-            2,
-            3,
-            4,
-            5,
-            remoteAddresses
-        )
+        return EpsBearerQosSessionAttributes::class.java
+            .getConstructor(
+                Int::class.java,
+                Long::class.java,
+                Long::class.java,
+                Long::class.java,
+                Long::class.java,
+                List::class.java
+            ).newInstance(
+                qci,
+                2,
+                3,
+                4,
+                5,
+                remoteAddresses
+            )
     }
 
     fun sendAndExpectUdpPacket(
diff --git a/tests/cts/net/src/android/net/cts/NetworkStatsBinderTest.java b/tests/cts/net/src/android/net/cts/NetworkStatsBinderTest.java
index 65daf575ff..b2e2554510 100644
--- a/tests/cts/net/src/android/net/cts/NetworkStatsBinderTest.java
+++ b/tests/cts/net/src/android/net/cts/NetworkStatsBinderTest.java
@@ -36,7 +36,7 @@ import android.os.RemoteException;
 
 import androidx.test.InstrumentationRegistry;
 
-import com.android.internal.util.CollectionUtils;
+import com.android.net.module.util.CollectionUtils;
 import com.android.testutils.ConnectivityModuleTest;
 import com.android.testutils.DevSdkIgnoreRule;
 import com.android.testutils.DevSdkIgnoreRunner;
@@ -67,7 +67,7 @@ public class NetworkStatsBinderTest {
     private int getFirstAppUidThat(@NonNull Predicate<Integer> predicate) {
         PackageManager pm = InstrumentationRegistry.getContext().getPackageManager();
         List<PackageInfo> apps = pm.getInstalledPackages(0 /* flags */);
-        final PackageInfo match = CollectionUtils.find(apps,
+        final PackageInfo match = CollectionUtils.findFirst(apps,
                 it -> it.applicationInfo != null && predicate.test(it.applicationInfo.uid));
         if (match != null) return match.applicationInfo.uid;
         return INVALID_UID;
diff --git a/tests/cts/net/src/android/net/cts/NetworkValidationTest.kt b/tests/cts/net/src/android/net/cts/NetworkValidationTest.kt
index aad072c643..78d1879d90 100644
--- a/tests/cts/net/src/android/net/cts/NetworkValidationTest.kt
+++ b/tests/cts/net/src/android/net/cts/NetworkValidationTest.kt
@@ -35,6 +35,7 @@ import android.net.dhcp.DhcpPacket.DHCP_MESSAGE_TYPE
 import android.net.dhcp.DhcpPacket.DHCP_MESSAGE_TYPE_DISCOVER
 import android.net.dhcp.DhcpPacket.DHCP_MESSAGE_TYPE_REQUEST
 import android.net.dhcp.DhcpRequestPacket
+import android.os.Handler
 import android.os.HandlerThread
 import android.platform.test.annotations.AppModeFull
 import androidx.test.platform.app.InstrumentationRegistry
@@ -45,23 +46,23 @@ import com.android.net.module.util.NetworkStackConstants.IPV4_ADDR_ANY
 import com.android.testutils.AutoCloseTestInterfaceRule
 import com.android.testutils.DhcpClientPacketFilter
 import com.android.testutils.DhcpOptionFilter
-import com.android.testutils.RecorderCallback.CallbackEntry
 import com.android.testutils.PollPacketReader
+import com.android.testutils.RecorderCallback.CallbackEntry
 import com.android.testutils.TestHttpServer
 import com.android.testutils.TestableNetworkCallback
 import com.android.testutils.runAsShell
 import fi.iki.elonen.NanoHTTPD.Response.Status
+import java.net.Inet4Address
+import kotlin.test.assertEquals
+import kotlin.test.assertNotNull
+import kotlin.test.assertTrue
+import kotlin.test.fail
 import org.junit.After
 import org.junit.Assume.assumeFalse
 import org.junit.Before
 import org.junit.Rule
 import org.junit.Test
 import org.junit.runner.RunWith
-import java.net.Inet4Address
-import kotlin.test.assertEquals
-import kotlin.test.assertNotNull
-import kotlin.test.assertTrue
-import kotlin.test.fail
 
 private const val MAX_PACKET_LENGTH = 1500
 private const val TEST_TIMEOUT_MS = 10_000L
@@ -92,6 +93,7 @@ class NetworkValidationTest {
             .addTransportType(TRANSPORT_TEST).build()
     private val ethRequestCb = TestableNetworkCallback()
 
+    private var readerHandler: Handler? = null
     private lateinit var iface: TestNetworkInterface
     private lateinit var reader: PollPacketReader
     private lateinit var capportUrl: Uri
@@ -118,8 +120,9 @@ class NetworkValidationTest {
         iface = testInterfaceRule.createTapInterface()
 
         handlerThread.start()
+        readerHandler = Handler(handlerThread.looper)
         reader = PollPacketReader(
-                handlerThread.threadHandler,
+                readerHandler,
                 iface.fileDescriptor.fileDescriptor,
                 MAX_PACKET_LENGTH)
         reader.startAsyncForTest()
@@ -139,7 +142,7 @@ class NetworkValidationTest {
         runAsShell(NETWORK_SETTINGS) { eth.setIncludeTestInterfaces(false) }
 
         httpServer.stop()
-        handlerThread.threadHandler.post { reader.stop() }
+        readerHandler?.post { reader.stop() }
         handlerThread.quitSafely()
         handlerThread.join()
     }
diff --git a/tests/cts/net/src/android/net/cts/PacProxyManagerTest.java b/tests/cts/net/src/android/net/cts/PacProxyManagerTest.java
index b462f71434..0667b235b8 100644
--- a/tests/cts/net/src/android/net/cts/PacProxyManagerTest.java
+++ b/tests/cts/net/src/android/net/cts/PacProxyManagerTest.java
@@ -23,7 +23,6 @@ import static com.android.testutils.TestPermissionUtil.runAsShell;
 
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertTrue;
-import static org.junit.Assume.assumeTrue;
 
 import android.app.Instrumentation;
 import android.content.BroadcastReceiver;
@@ -45,7 +44,6 @@ import android.util.Range;
 import androidx.test.InstrumentationRegistry;
 
 import com.android.compatibility.common.util.RequiredFeatureRule;
-
 import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo;
 import com.android.testutils.DevSdkIgnoreRunner;
 import com.android.testutils.TestHttpServer;
@@ -133,8 +131,10 @@ public final class PacProxyManagerTest {
 
         @Override
         public void onReceive(Context context, Intent intent) {
-            final ProxyInfo proxy = (ProxyInfo) intent.getExtra(Proxy.EXTRA_PROXY_INFO,
-                    ProxyInfo.buildPacProxy(Uri.EMPTY));
+            ProxyInfo proxy = intent.getParcelableExtra("android.intent.extra.PROXY_INFO");
+            if (proxy == null) {
+                proxy = ProxyInfo.buildPacProxy(Uri.EMPTY);
+            }
             // ProxyTracker sends sticky broadcast which will receive the last broadcast while
             // register the intent receiver. That is, if system never receives the intent then
             // it won't receive an intent when register the receiver. How many intents will be

From 1dea0d630eba6792628e008942ae3728487a37fc Mon Sep 17 00:00:00 2001
From: Paul Hu <paulhu@google.com>
Date: Thu, 16 Jan 2025 15:05:05 +0000
Subject: [PATCH 142/377] Replace Message with related arguments in
 RealtimeScheduler

This change ensures that the Message object is created and
obtained within RealtimeScheduler, preventing modification
by the caller.

Fix: 386274963
Test: atest ConnectivityCoverageTests NetworkStaticLibTests
Flag: EXEMPT bug fix
Change-Id: I4c919857bcaa2d49717859dca9c88a243cbb7a41
---
 .../mdns/MdnsServiceTypeClient.java            |  6 +++---
 .../server/connectivity/mdns/Scheduler.java    |  6 +++---
 .../mdns/internal/MdnsRealtimeScheduler.java   |  7 ++++---
 .../net/module/util/RealtimeScheduler.java     | 11 ++++++++---
 .../net/module/util/RealtimeSchedulerTest.kt   | 15 +++++----------
 .../mdns/MdnsServiceTypeClientTests.java       | 18 ++++++++++--------
 6 files changed, 33 insertions(+), 30 deletions(-)

diff --git a/service-t/src/com/android/server/connectivity/mdns/MdnsServiceTypeClient.java b/service-t/src/com/android/server/connectivity/mdns/MdnsServiceTypeClient.java
index 55c6f70962..f4622265e6 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MdnsServiceTypeClient.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MdnsServiceTypeClient.java
@@ -233,7 +233,7 @@ public class MdnsServiceTypeClient {
                         // then remove expired services, and notify listeners.
                         if (scheduler != null) {
                             scheduler.sendDelayedMessage(
-                                    handler.obtainMessage(EVENT_REMOVE_EXPIRED_SERVICES),
+                                    EVENT_REMOVE_EXPIRED_SERVICES, 0, 0, null /* obj */,
                                     REMOVE_SERVICE_AFTER_QUERY_SENT_TIME);
                         } else {
                             dependencies.sendMessageDelayed(
@@ -387,8 +387,8 @@ public class MdnsServiceTypeClient {
 
     private void setDelayedTask(ScheduledQueryTaskArgs args, long timeToNextTaskMs) {
         scheduler.removeDelayedMessage(EVENT_START_QUERYTASK);
-        scheduler.sendDelayedMessage(
-                handler.obtainMessage(EVENT_START_QUERYTASK, args), timeToNextTaskMs);
+        scheduler.sendDelayedMessage(EVENT_START_QUERYTASK, 0, 0, args,
+                timeToNextTaskMs);
     }
 
     /**
diff --git a/service-t/src/com/android/server/connectivity/mdns/Scheduler.java b/service-t/src/com/android/server/connectivity/mdns/Scheduler.java
index 85a8e76f22..f725dd05e3 100644
--- a/service-t/src/com/android/server/connectivity/mdns/Scheduler.java
+++ b/service-t/src/com/android/server/connectivity/mdns/Scheduler.java
@@ -16,9 +16,8 @@
 
 package com.android.server.connectivity.mdns;
 
-import android.os.Message;
-
 import androidx.annotation.NonNull;
+import androidx.annotation.Nullable;
 
 /**
  * The interface for scheduler.
@@ -27,7 +26,8 @@ public interface Scheduler {
     /**
      * Set a message to be sent after a specified delay.
      */
-    boolean sendDelayedMessage(@NonNull Message message, long delayMs);
+    boolean sendDelayedMessage(int what, int arg1, int arg2, @Nullable Object obj,
+            long delayMs);
 
     /**
      * Remove a scheduled message.
diff --git a/service-t/src/com/android/server/connectivity/mdns/internal/MdnsRealtimeScheduler.java b/service-t/src/com/android/server/connectivity/mdns/internal/MdnsRealtimeScheduler.java
index eff7085809..1d73a8a7ed 100644
--- a/service-t/src/com/android/server/connectivity/mdns/internal/MdnsRealtimeScheduler.java
+++ b/service-t/src/com/android/server/connectivity/mdns/internal/MdnsRealtimeScheduler.java
@@ -17,9 +17,9 @@
 package com.android.server.connectivity.mdns.internal;
 
 import android.os.Handler;
-import android.os.Message;
 
 import androidx.annotation.NonNull;
+import androidx.annotation.Nullable;
 
 import com.android.net.module.util.RealtimeScheduler;
 import com.android.server.connectivity.mdns.Scheduler;
@@ -35,8 +35,9 @@ public class MdnsRealtimeScheduler extends RealtimeScheduler implements
         super(handler);
     }
 
-    public boolean sendDelayedMessage(@NonNull Message message, long delayMs) {
-        return super.sendDelayedMessage(message, delayMs);
+    public boolean sendDelayedMessage(int what, int arg1, int arg2, @Nullable Object obj,
+            long delayMs) {
+        return super.sendDelayedMessage(what, arg1, arg2, obj, delayMs);
     }
 
     public void removeDelayedMessage(int what) {
diff --git a/staticlibs/device/com/android/net/module/util/RealtimeScheduler.java b/staticlibs/device/com/android/net/module/util/RealtimeScheduler.java
index 2d952237fa..4b3a143106 100644
--- a/staticlibs/device/com/android/net/module/util/RealtimeScheduler.java
+++ b/staticlibs/device/com/android/net/module/util/RealtimeScheduler.java
@@ -19,6 +19,7 @@ package com.android.net.module.util;
 import static android.os.MessageQueue.OnFileDescriptorEventListener.EVENT_ERROR;
 import static android.os.MessageQueue.OnFileDescriptorEventListener.EVENT_INPUT;
 
+import android.annotation.Nullable;
 import android.os.Handler;
 import android.os.Looper;
 import android.os.Message;
@@ -218,12 +219,16 @@ public class RealtimeScheduler {
      *
      * If delayMs is less than or equal to 0, the message will be sent immediately.
      *
-     * @param msg the message to be sent
+     * @param what Value to assign to the returned Message.what field.
+     * @param arg1 Value to assign to the returned Message.arg1 field.
+     * @param arg2 Value to assign to the returned Message.arg2 field.
+     * @param obj Value to assign to the returned Message.obj field.
      * @param delayMs the delay time in milliseconds
      * @return true if the message is scheduled successfully, false otherwise.
      */
-    public boolean sendDelayedMessage(Message msg, long delayMs) {
-
+    public boolean sendDelayedMessage(int what, int arg1, int arg2, @Nullable Object obj,
+            long delayMs) {
+        final Message msg = mHandler.obtainMessage(what, arg1, arg2, obj);
         return enqueueTask(new MessageTask(msg, SystemClock.elapsedRealtime() + delayMs), delayMs);
     }
 
diff --git a/staticlibs/tests/unit/src/com/android/net/module/util/RealtimeSchedulerTest.kt b/staticlibs/tests/unit/src/com/android/net/module/util/RealtimeSchedulerTest.kt
index fb7f3d9cad..45e3ffc201 100644
--- a/staticlibs/tests/unit/src/com/android/net/module/util/RealtimeSchedulerTest.kt
+++ b/staticlibs/tests/unit/src/com/android/net/module/util/RealtimeSchedulerTest.kt
@@ -109,20 +109,15 @@ class RealtimeSchedulerTest {
             val cv = ConditionVariable()
             handler.post {
                 scheduler.sendDelayedMessage(
-                    Message.obtain(handler, MSG_ID_0, Pair(ConditionVariable(), executionTimes)), 0)
+                    MSG_ID_0, 0, 0, Pair(ConditionVariable(), executionTimes), 0)
                 scheduler.sendDelayedMessage(
-                    Message.obtain(handler, MSG_ID_1, Pair(ConditionVariable(), executionTimes)),
-                    200)
+                    MSG_ID_1, 0, 0, Pair(ConditionVariable(), executionTimes), 200)
                 scheduler.sendDelayedMessage(
-                    Message.obtain(handler, MSG_ID_4, Pair(ConditionVariable(), executionTimes)),
-                    250)
+                    MSG_ID_4, 0, 0, Pair(ConditionVariable(), executionTimes), 250)
                 scheduler.removeDelayedMessage(MSG_ID_4)
                 scheduler.sendDelayedMessage(
-                    Message.obtain(handler, MSG_ID_2, Pair(ConditionVariable(), executionTimes)),
-                    100)
-                scheduler.sendDelayedMessage(
-                    Message.obtain(handler, MSG_ID_3, Pair(cv, executionTimes)),
-                    300)
+                    MSG_ID_2, 0, 0, Pair(ConditionVariable(), executionTimes), 100)
+                scheduler.sendDelayedMessage(MSG_ID_3, 0, 0, Pair(cv, executionTimes), 300)
             }
             cv.block(TIMEOUT_MS)
             assertEquals(4, executionTimes.size)
diff --git a/tests/unit/java/com/android/server/connectivity/mdns/MdnsServiceTypeClientTests.java b/tests/unit/java/com/android/server/connectivity/mdns/MdnsServiceTypeClientTests.java
index eb1e47c54d..39e08d06da 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/MdnsServiceTypeClientTests.java
+++ b/tests/unit/java/com/android/server/connectivity/mdns/MdnsServiceTypeClientTests.java
@@ -257,13 +257,14 @@ public class MdnsServiceTypeClientTests {
         }).when(mockDeps).createScheduler(any(Handler.class));
 
         doAnswer(inv -> {
-            final Message temp = (Message) inv.getArguments()[0];
-            if (temp.what == EVENT_START_QUERYTASK) {
-                message = (Message) inv.getArguments()[0];
+            final int what = (int) inv.getArguments()[0];
+            if (what == EVENT_START_QUERYTASK) {
+                final Object obj = inv.getArguments()[3];
+                message = realHandler.obtainMessage(what, obj);
             }
-            latestDelayMs = (long) inv.getArguments()[1];
+            latestDelayMs = (long) inv.getArguments()[4];
             return null;
-        }).when(mockScheduler).sendDelayedMessage(any(), anyLong());
+        }).when(mockScheduler).sendDelayedMessage(anyInt(), anyInt(), anyInt(), any(), anyLong());
 
         client = makeMdnsServiceTypeClient(featureFlags);
     }
@@ -2208,9 +2209,9 @@ public class MdnsServiceTypeClientTests {
         verify(mockDeps, times(count)).sendMessage(
                 any(Handler.class), argThat(message -> message.what == EVENT_QUERY_RESULT));
         verify(mockScheduler, times(count)).sendDelayedMessage(
-                argThat(message -> message.what == EVENT_REMOVE_EXPIRED_SERVICES), anyLong());
+                eq(EVENT_REMOVE_EXPIRED_SERVICES), eq(0), eq(0), any(), anyLong());
         verify(mockScheduler, times(count)).sendDelayedMessage(
-                argThat(message -> message.what == EVENT_START_QUERYTASK), anyLong());
+                eq(EVENT_START_QUERYTASK), eq(0), eq(0), any(), anyLong());
     }
 
     @Test
@@ -2375,7 +2376,8 @@ public class MdnsServiceTypeClientTests {
                 .sendMessage(any(Handler.class), any(Message.class));
         // Verify the task has been scheduled.
         if (useAccurateDelayCallback) {
-            verify(mockScheduler, times(scheduledCount)).sendDelayedMessage(any(), anyLong());
+            verify(mockScheduler, times(scheduledCount)).sendDelayedMessage(
+                    anyInt(), anyInt(), anyInt(), any(), anyLong());
         } else {
             verify(mockDeps, times(scheduledCount))
                     .sendMessageDelayed(any(Handler.class), any(Message.class), anyLong());

From 3781d05054d0ea20e4eb64350e6dfd54a917c891 Mon Sep 17 00:00:00 2001
From: Yuyang Huang <yuyanghuang@google.com>
Date: Tue, 22 Apr 2025 16:42:04 +0900
Subject: [PATCH 143/377] Remove non-functional IGMPv3 test and flaky APF
 checks

This commit removes the test_igmpv3_general_query_offload() test
logic. This test fails on user builds because they run on non-rootable
devices, preventing the necessary test operations.

Additionally, the APF counter check logic is removed as it was causing
test flakiness and instability.

Bug: 406570694
Test: TH
Flag: EXEMPT test only change
Change-Id: I9f2f32c49737721e537d578d6df41d4062d0684f
---
 .../testutils/host/python/apf_test_base.py       | 16 +++++++++-------
 tests/cts/multidevices/apfv6_test.py             |  6 ++++++
 2 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/staticlibs/testutils/host/python/apf_test_base.py b/staticlibs/testutils/host/python/apf_test_base.py
index 9d1ea02bbe..c9cda417a3 100644
--- a/staticlibs/testutils/host/python/apf_test_base.py
+++ b/staticlibs/testutils/host/python/apf_test_base.py
@@ -123,14 +123,16 @@ class ApfTestBase(multi_devices_test_base.MultiDevicesTestBase):
             == 1
         )
 
-        assert_utils.expect_with_retry(
-            lambda: apf_utils.get_apf_counter(
-                self.clientDevice,
-                self.client_iface_name,
-                counter_name,
+        # TODO: re-enable once the test passes reliably.
+        if False:
+            assert_utils.expect_with_retry(
+                lambda: apf_utils.get_apf_counter(
+                    self.clientDevice,
+                    self.client_iface_name,
+                    counter_name,
+                )
+                > count_before_test
             )
-            > count_before_test
-        )
 
     finally:
         apf_utils.stop_capture_packets(self.serverDevice, self.server_iface_name)
diff --git a/tests/cts/multidevices/apfv6_test.py b/tests/cts/multidevices/apfv6_test.py
index c6e5f8de10..e06af65339 100644
--- a/tests/cts/multidevices/apfv6_test.py
+++ b/tests/cts/multidevices/apfv6_test.py
@@ -129,8 +129,14 @@ class ApfV6Test(apf_test_base.ApfTestBase):
             echo_request, "DROPPED_IPV6_ICMP6_ECHO_REQUEST_REPLIED", expected_echo_reply
         )
 
+    def is_running_as_root(self):
+        uid = adb_utils.adb_shell(self.clientDevice, "id -u")
+        return uid == "0"
+
     @apf_utils.at_least_B()
     def test_igmpv3_general_query_offload(self):
+        if not self.is_running_as_root():
+            return
         # use unicast to replace multicast ether dst to prevent flaky due to DTIM skip
         ether = Ether(src=self.server_mac_address, dst=self.client_mac_address)
         ip = IP(

From eda7af89fe71d92978eb54dc579ddb8e5a184338 Mon Sep 17 00:00:00 2001
From: Lorenzo Colitti <lorenzo@google.com>
Date: Mon, 21 Apr 2025 19:07:56 +0900
Subject: [PATCH 144/377] Add a test for NetworkCallbacks for fallback
 satellite networks.

Bug: 410731080
Flag: TEST_ONLY
Test: test-only change
Change-Id: If74f461bca2bc34b1defa841e05237849f4c1c4a
---
 .../CSSatelliteNetworkTest.kt                 | 126 +++++++++++++++---
 1 file changed, 110 insertions(+), 16 deletions(-)

diff --git a/tests/unit/java/com/android/server/connectivityservice/CSSatelliteNetworkTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSSatelliteNetworkTest.kt
index 92dd45eb59..0a881bd45c 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSSatelliteNetworkTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSSatelliteNetworkTest.kt
@@ -16,6 +16,8 @@
 
 package com.android.server
 
+import android.Manifest.permission.NETWORK_SETTINGS
+import android.annotation.SuppressLint
 import android.net.INetd
 import android.net.NativeNetworkConfig
 import android.net.NativeNetworkType
@@ -26,12 +28,18 @@ import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_RESTRICTED
 import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_ROAMING
 import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_SUSPENDED
 import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_VCN_MANAGED
+import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_VPN
 import android.net.NetworkCapabilities.TRANSPORT_SATELLITE
+import android.net.NetworkCapabilities.TRANSPORT_WIFI
+import android.net.NetworkRequest
 import android.net.UidRange
 import android.net.UidRangeParcel
 import android.net.VpnManager
 import android.net.netd.aidl.NativeUidRangeConfig
 import android.os.Build
+import android.os.Handler
+import android.os.Looper
+import android.os.Process
 import android.os.UserHandle
 import android.util.ArraySet
 import com.android.net.module.util.CollectionUtils
@@ -39,7 +47,10 @@ import com.android.server.ConnectivityService.PREFERENCE_ORDER_SATELLITE_FALLBAC
 import com.android.testutils.DevSdkIgnoreRule
 import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
 import com.android.testutils.DevSdkIgnoreRunner
+import com.android.testutils.RecorderCallback.CallbackEntry.Losing
+import com.android.testutils.RecorderCallback.CallbackEntry.Lost
 import com.android.testutils.TestableNetworkCallback
+import com.android.testutils.runAsShell
 import com.android.testutils.visibleOnHandlerThread
 import kotlin.test.assertEquals
 import kotlin.test.assertTrue
@@ -160,8 +171,9 @@ class CSSatelliteNetworkTest : CSTest() {
         doTestSatelliteNeverBecomeDefaultNetwork(restricted = false)
     }
 
-    private fun doTestUnregisterAfterReplacementSatisfier(destroyBeforeRequest: Boolean = false,
-                                                          destroyAfterRequest: Boolean = false
+    private fun doTestUnregisterAfterReplacementSatisfier(
+        destroyBeforeRequest: Boolean = false,
+        destroyAfterRequest: Boolean = false
     ) {
         val satelliteAgent = createSatelliteAgent("satellite0")
         satelliteAgent.connect()
@@ -220,6 +232,78 @@ class CSSatelliteNetworkTest : CSTest() {
         doTestUnregisterAfterReplacementSatisfier()
     }
 
+    @SuppressLint("MissingPermission")
+    @Test @IgnoreUpTo(Build.VERSION_CODES.UPSIDE_DOWN_CAKE)
+    fun testFallbackNetworkCallbacks() {
+        val handler = Handler(Looper.getMainLooper())
+        val myUid = Process.myUid()
+        val otherUid = Process.myUid() + 1
+        val defaultCb = TestableNetworkCallback().also { cm.registerDefaultNetworkCallback(it) }
+        val otherUidCb = TestableNetworkCallback().also {
+            runAsShell(NETWORK_SETTINGS) {
+                cm.registerDefaultNetworkCallbackForUid(otherUid, it, handler)
+            }
+        }
+        val allNetworksCb = TestableNetworkCallback().also {
+            cm.registerNetworkCallback(NetworkRequest.Builder().clearCapabilities().build(), it)
+        }
+
+        updateSatelliteNetworkFallbackUids(setOf(myUid))
+        defaultCb.assertNoCallback()
+
+        val satelliteAgent = createSatelliteAgent(
+            "satellite0",
+            restricted = false,
+            keepConnected = false
+        ).apply { connect() }
+        val satelliteNetwork = satelliteAgent.network
+
+        allNetworksCb.expectAvailableCallbacks(satelliteNetwork, validated = false)
+        defaultCb.expectAvailableCallbacks(satelliteNetwork, validated = false)
+        otherUidCb.assertNoCallback()
+
+        val wifiAgent = Agent(
+            lp = defaultLp().apply { interfaceName = "wlan0" },
+                nc = ncForTransport(TRANSPORT_WIFI)
+        ).apply { connect() }
+        val wifiNetwork = wifiAgent.network
+
+        allNetworksCb.expectAvailableCallbacks(wifiNetwork, validated = false)
+        defaultCb.expectAvailableCallbacks(wifiNetwork, validated = false)
+        otherUidCb.expectAvailableCallbacks(wifiNetwork, validated = false)
+        // BUG: satellite should disconnect because there are no requests for it.
+        // cb.expect<Losing>(satelliteNetwork)
+        // cb.expect<Lost>(satelliteNetwork)
+        allNetworksCb.assertNoCallback()
+
+        wifiAgent.disconnect()
+        allNetworksCb.expect<Lost>(wifiNetwork)
+        defaultCb.expect<Lost>(wifiNetwork)
+        otherUidCb.expect<Lost>(wifiNetwork)
+
+        val satelliteAgent2 = createSatelliteAgent(
+            "satellite0",
+            restricted = false,
+            keepConnected = false
+        )
+        satelliteAgent2.connect()
+        val satelliteNetwork2 = satelliteAgent2.network
+
+        allNetworksCb.expectAvailableCallbacks(satelliteNetwork2, validated = false)
+        // BUG: this should be satelliteNetwork2, because satelliteNetwork should have gone down.
+        defaultCb.expectAvailableCallbacks(satelliteNetwork, validated = false)
+
+        updateSatelliteNetworkFallbackUids(setOf())
+
+        // BUG: satelliteNetwork2 should disconnect because there are no requests for it.
+        // cb.expect<Lost>(satelliteNetwork2)
+        // defaultCb.expect<Lost>(satelliteNetwork2)
+        allNetworksCb.expect<Lost>(satelliteNetwork)
+        defaultCb.expect<Lost>(satelliteNetwork)
+
+        otherUidCb.assertNoCallback()
+    }
+
     private fun assertCreateMultiLayerNrisFromSatelliteNetworkPreferredUids(uids: Set<Int>) {
         val nris: Set<ConnectivityService.NetworkRequestInfo> =
             service.createMultiLayerNrisFromSatelliteNetworkFallbackUids(uids)
@@ -248,9 +332,13 @@ class CSSatelliteNetworkTest : CSTest() {
             false /* excludeLocalRoutes */
         )
 
-    private fun createSatelliteAgent(name: String, restricted: Boolean = true): CSAgentWrapper {
+    private fun createSatelliteAgent(
+        name: String,
+        restricted: Boolean = true,
+        keepConnected: Boolean = true
+    ): CSAgentWrapper {
         return Agent(
-            score = keepScore(),
+            score = if (keepConnected) keepScore() else defaultScore(),
             lp = defaultLp().apply { interfaceName = name },
             nc = satelliteNc(restricted)
         )
@@ -276,17 +364,23 @@ class CSSatelliteNetworkTest : CSTest() {
         return uidRangesForUids(*CollectionUtils.toIntArray(uids))
     }
 
-    private fun satelliteNc(restricted: Boolean) =
-            NetworkCapabilities.Builder().apply {
-                addTransportType(TRANSPORT_SATELLITE)
+    private fun ncForTransport(transport: Int) =
+        NetworkCapabilities.Builder().apply {
+            addTransportType(transport)
+            addCapability(NET_CAPABILITY_INTERNET)
+            addCapability(NET_CAPABILITY_NOT_SUSPENDED)
+            addCapability(NET_CAPABILITY_NOT_ROAMING)
+            addCapability(NET_CAPABILITY_NOT_VCN_MANAGED)
+            addCapability(NET_CAPABILITY_NOT_VPN)
+        }.build()
 
-                addCapability(NET_CAPABILITY_INTERNET)
-                addCapability(NET_CAPABILITY_NOT_SUSPENDED)
-                addCapability(NET_CAPABILITY_NOT_ROAMING)
-                addCapability(NET_CAPABILITY_NOT_VCN_MANAGED)
-                if (restricted) {
-                    removeCapability(NET_CAPABILITY_NOT_RESTRICTED)
-                }
-                removeCapability(NET_CAPABILITY_NOT_BANDWIDTH_CONSTRAINED)
-            }.build()
+    private fun satelliteNc(restricted: Boolean): NetworkCapabilities {
+        val nc = ncForTransport(TRANSPORT_SATELLITE)
+        if (restricted) {
+            nc.removeCapability(NET_CAPABILITY_NOT_RESTRICTED)
+        } else {
+            nc.removeCapability(NET_CAPABILITY_NOT_BANDWIDTH_CONSTRAINED)
+        }
+        return nc
+    }
 }

From f984b780ac58e68628164a0f0637312815b7718e Mon Sep 17 00:00:00 2001
From: Lorenzo Colitti <lorenzo@google.com>
Date: Mon, 21 Apr 2025 17:05:28 +0900
Subject: [PATCH 145/377] Simplify NetworkRequestInfo constructors.

There are currently 6 or 7 contructors, and some code duplication.
Reduce this to one constructor per use case (callback-based;
PendingIntent based; internal), and use a private constructor to
reduce code duplication.

Bug: 410731080
Flag: EXEMPT refactor
Test: refactor covered by existing tests
Change-Id: I49337374990d646bf5526354cceeea83f3b9c980
---
 .../android/server/ConnectivityService.java   | 120 ++++++++----------
 1 file changed, 53 insertions(+), 67 deletions(-)

diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index dd1edfeecf..447c2c4591 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -1880,9 +1880,8 @@ public class ConnectivityService extends IConnectivityManager.Stub {
         mNetworkRequestStateStatsMetrics = mDeps.makeNetworkRequestStateStatsMetrics(mContext);
         final NetworkRequest defaultInternetRequest = createDefaultRequest();
         mDefaultRequest = new NetworkRequestInfo(
-                Process.myUid(), defaultInternetRequest, null,
-                null /* binder */, NetworkCallback.FLAG_INCLUDE_LOCATION_INFO,
-                null /* attributionTags */, DECLARED_METHODS_NONE);
+                Process.myUid(), Collections.singletonList(defaultInternetRequest),
+                PREFERENCE_ORDER_INVALID);
         mNetworkRequests.put(defaultInternetRequest, mDefaultRequest);
         mDefaultNetworkRequests.add(mDefaultRequest);
         mNetworkRequestInfoLogs.log("REGISTER " + mDefaultRequest);
@@ -2291,10 +2290,8 @@ public class ConnectivityService extends IConnectivityManager.Stub {
         }
 
         if (enable) {
-            handleRegisterNetworkRequest(new NetworkRequestInfo(
-                    Process.myUid(), networkRequest, null /* messenger */, null /* binder */,
-                    NetworkCallback.FLAG_INCLUDE_LOCATION_INFO,
-                    null /* attributionTags */, DECLARED_METHODS_NONE));
+            handleRegisterNetworkRequest(new NetworkRequestInfo(Process.myUid(),
+                    Collections.singletonList(networkRequest), PREFERENCE_ORDER_INVALID));
         } else {
             handleReleaseNetworkRequest(networkRequest, Process.SYSTEM_UID,
                     /* callOnUnavailable */ false);
@@ -8009,69 +8006,68 @@ public class ConnectivityService extends IConnectivityManager.Stub {
             return (null == uids) ? new ArraySet<>() : uids;
         }
 
-        NetworkRequestInfo(int asUid, @NonNull final NetworkRequest r,
-                @Nullable final PendingIntent pi, @Nullable String callingAttributionTag) {
-            this(asUid, Collections.singletonList(r), r, pi, callingAttributionTag,
-                    PREFERENCE_ORDER_INVALID);
-        }
-
-        NetworkRequestInfo(int asUid, @NonNull final List<NetworkRequest> r,
+        /** Internal-only constructor, used by the other constructors. */
+        private NetworkRequestInfo(int asUid, @NonNull final List<NetworkRequest> r,
                 @NonNull final NetworkRequest requestForCallback, @Nullable final PendingIntent pi,
+                @Nullable Messenger messenger, @Nullable IBinder binder,
+                @NetworkCallback.Flag int callbackFlags, int declaredMethodsFlags,
                 @Nullable String callingAttributionTag, final int preferenceOrder) {
+            if (pi != null) {
+                // Got passed a PendingIntent.
+                if (messenger != null || binder != null
+                        || callbackFlags != NetworkCallback.FLAG_NONE
+                        || declaredMethodsFlags != DECLARED_METHODS_NONE) {
+                    throw new IllegalArgumentException(
+                            "NRI with PendingIntent cannot pass in callback parameters");
+                }
+            }
             ensureAllNetworkRequestsHaveSupportedType(r);
             mRequests = initializeRequests(r);
             mNetworkRequestForCallback = requestForCallback;
             mPendingIntent = pi;
-            mMessenger = null;
-            mBinder = null;
-            mPid = getCallingPid();
-            mUid = mDeps.getCallingUid();
-            mAsUid = asUid;
-            mPerUidCounter = getRequestCounter(this);
-            /**
-             * Location sensitive data not included in pending intent. Only included in
-             * {@link NetworkCallback}.
-             */
-            mCallbackFlags = NetworkCallback.FLAG_NONE;
-            mCallingAttributionTag = callingAttributionTag;
-            mPreferenceOrder = preferenceOrder;
-            mDeclaredMethodsFlags = DECLARED_METHODS_NONE;
-        }
-
-        NetworkRequestInfo(int asUid, @NonNull final NetworkRequest r, @Nullable final Messenger m,
-                @Nullable final IBinder binder,
-                @NetworkCallback.Flag int callbackFlags,
-                @Nullable String callingAttributionTag, int declaredMethodsFlags) {
-            this(asUid, Collections.singletonList(r), r, m, binder, callbackFlags,
-                    callingAttributionTag, declaredMethodsFlags);
-        }
-
-        NetworkRequestInfo(int asUid, @NonNull final List<NetworkRequest> r,
-                @NonNull final NetworkRequest requestForCallback, @Nullable final Messenger m,
-                @Nullable final IBinder binder,
-                @NetworkCallback.Flag int callbackFlags,
-                @Nullable String callingAttributionTag, int declaredMethodsFlags) {
-            super();
-            ensureAllNetworkRequestsHaveSupportedType(r);
-            mRequests = initializeRequests(r);
-            mNetworkRequestForCallback = requestForCallback;
-            mMessenger = m;
+            mMessenger = messenger;
             mBinder = binder;
             mPid = getCallingPid();
             mUid = mDeps.getCallingUid();
             mAsUid = asUid;
-            mPendingIntent = null;
             mPerUidCounter = getRequestCounter(this);
             mCallbackFlags = callbackFlags;
             mCallingAttributionTag = callingAttributionTag;
-            mPreferenceOrder = PREFERENCE_ORDER_INVALID;
+            mPreferenceOrder = preferenceOrder;
             mDeclaredMethodsFlags = declaredMethodsFlags;
             linkDeathRecipient();
         }
 
+        /** Constructs a NetworkRequestInfo for a PendingIntent-based API */
+        NetworkRequestInfo(int asUid, @NonNull final NetworkRequest request,
+                @Nullable final PendingIntent pi, @Nullable String callingAttributionTag) {
+            this(asUid, Collections.singletonList(request), request, pi, null /* messenger */,
+                    null /* binder */, NetworkCallback.FLAG_NONE, DECLARED_METHODS_NONE,
+                    callingAttributionTag, PREFERENCE_ORDER_INVALID);
+        }
+
+        /* Constructs a NetworkRequestInfo for a NetworkCallback-based API */
+        NetworkRequestInfo(int asUid, @NonNull final List<NetworkRequest> r,
+                @NonNull final NetworkRequest requestForCallback, @Nullable final Messenger m,
+                @Nullable final IBinder b,
+                @NetworkCallback.Flag int callbackFlags,
+                @Nullable String callingAttributionTag, int declaredMethodsFlags) {
+            // In multilayer request, or for a TRACK_DEFAULT request that tracks a per-app default
+            // network, requestForCallback is not the same as the first request.
+            this(asUid, r, requestForCallback, null /* pi */, m, b, callbackFlags,
+                    declaredMethodsFlags, callingAttributionTag, PREFERENCE_ORDER_INVALID);
+        }
+
+        /* Constructs a NetworkRequestInfo for internal system usage */
+        NetworkRequestInfo(int asUid, @NonNull final List<NetworkRequest> r, int preferenceOrder) {
+            this(asUid, r, r.get(0), null /* pi */, null /* messenger */,
+                    null /* binder */, NetworkCallback.FLAG_NONE, DECLARED_METHODS_NONE,
+                    null /* callingAttributionTag */, preferenceOrder);
+
+        }
+
         NetworkRequestInfo(@NonNull final NetworkRequestInfo nri,
                 @NonNull final List<NetworkRequest> r) {
-            super();
             ensureAllNetworkRequestsHaveSupportedType(r);
             mRequests = initializeRequests(r);
             mNetworkRequestForCallback = nri.getNetworkRequestForCallback();
@@ -8112,16 +8108,6 @@ public class ConnectivityService extends IConnectivityManager.Stub {
             linkDeathRecipient();
         }
 
-        NetworkRequestInfo(int asUid, @NonNull final NetworkRequest r) {
-            this(asUid, Collections.singletonList(r), PREFERENCE_ORDER_INVALID);
-        }
-
-        NetworkRequestInfo(int asUid, @NonNull final List<NetworkRequest> r,
-                final int preferenceOrder) {
-            this(asUid, r, r.get(0), null /* pi */, null /* callingAttributionTag */,
-                    preferenceOrder);
-        }
-
         // True if this NRI is being satisfied. It also accounts for if the nri has its satisifer
         // set to the mNoServiceNetwork in which case mActiveRequest will be null thus returning
         // false.
@@ -9033,7 +9019,8 @@ public class ConnectivityService extends IConnectivityManager.Stub {
         NetworkRequest networkRequest = new NetworkRequest(nc, TYPE_NONE, nextNetworkRequestId(),
                 NetworkRequest.Type.LISTEN);
         NetworkRequestInfo nri =
-                new NetworkRequestInfo(callingUid, networkRequest, messenger, binder, callbackFlags,
+                new NetworkRequestInfo(callingUid, Collections.singletonList(networkRequest),
+                        networkRequest, messenger, binder, callbackFlags,
                         callingAttributionTag, declaredMethodsFlag);
         if (VDBG) log("listenForNetwork for " + nri);
 
@@ -10772,10 +10759,8 @@ public class ConnectivityService extends IConnectivityManager.Stub {
             final NetworkRequest nr = new NetworkRequest(newCaps, ConnectivityManager.TYPE_NONE,
                     nextNetworkRequestId(), LISTEN_FOR_BEST);
             configBuilder.setUpstreamSelector(nr);
-            final NetworkRequestInfo nri = new NetworkRequestInfo(
-                    nai.creatorUid, nr, null /* messenger */, null /* binder */,
-                    0 /* callbackFlags */, null /* attributionTag */,
-                    DECLARED_METHODS_NONE);
+            final NetworkRequestInfo nri = new NetworkRequestInfo(nai.creatorUid,
+                    Collections.singletonList(nr), PREFERENCE_ORDER_INVALID);
             if (null != oldSatisfier) {
                 // Set the old satisfier in the new NRI so that the rematch will see any changes
                 nri.setSatisfier(oldSatisfier, nr);
@@ -13519,7 +13504,8 @@ public class ConnectivityService extends IConnectivityManager.Stub {
         // nri is not bound to the death of callback. Instead, callback.bindToDeath() is set in
         // handleRegisterConnectivityDiagnosticsCallback(). nri will be cleaned up as part of the
         // callback's binder death.
-        final NetworkRequestInfo nri = new NetworkRequestInfo(callingUid, requestWithId);
+        final NetworkRequestInfo nri = new NetworkRequestInfo(callingUid /* asUid */,
+                Collections.singletonList(requestWithId), PREFERENCE_ORDER_INVALID);
         nri.mPerUidCounter.incrementCountOrThrow(nri.mUid);
         final ConnectivityDiagnosticsCallbackInfo cbInfo =
                 new ConnectivityDiagnosticsCallbackInfo(callback, nri, callingPackageName);

From dd577efddef065e9555d2b4c496368f58c7b978c Mon Sep 17 00:00:00 2001
From: Lorenzo Colitti <lorenzo@google.com>
Date: Mon, 21 Apr 2025 11:14:56 +0900
Subject: [PATCH 146/377] Simplify and correct isNetworkPotentialSatisfier.

This makes the code clearer, and also fixes a bug: currently, a
TRACK_DEFAULT request in a multilayer request can cause a network
to remain needed. This is incorrect: only requests should be able
to keep a network up.

This prevents satellite networking from disconnecting when the
default network reappears (see changes in unit test).

This CL removes the code before the loop that special-cases
non-multilayer listens because it is not very useful. Any
non-multilayer listen will either:
- Immediately return false, if it's the active request, or:
- Cause the code to continue (because it's not the active
  request), and because mRequests only has one element, will
  hit the "return false" statement after the loop.

Flag: EXEMPT bug fix
Test: covered by existing tests
Change-Id: I7295ce469335af924aa20b7976cc4a9136ef5d61
---
 .../android/server/ConnectivityService.java   | 76 ++++++++++---------
 .../CSSatelliteNetworkTest.kt                 | 17 ++---
 2 files changed, 44 insertions(+), 49 deletions(-)

diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index 447c2c4591..fa01218b06 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -6018,46 +6018,48 @@ public class ConnectivityService extends IConnectivityManager.Stub {
         // For example, declaring it a potential satisfier would keep an unvalidated destroyed
         // candidate after it's been replaced by another unvalidated network.
         if (candidate.isDestroyed()) return false;
-        // Listen requests won't keep up a network satisfying it. If this is not a multilayer
-        // request, return immediately. For multilayer requests, check to see if any of the
-        // multilayer requests may have a potential satisfier.
-        if (!nri.isMultilayerRequest() && (nri.mRequests.get(0).isListen()
-                || nri.mRequests.get(0).isListenForBest())) {
-            return false;
-        }
+
         for (final NetworkRequest req : nri.mRequests) {
-            // This multilayer listen request is satisfied therefore no further requests need to be
-            // evaluated deeming this network not a potential satisfier.
-            if ((req.isListen() || req.isListenForBest()) && nri.getActiveRequest() == req) {
+            // If the active request is of a type that does not cause the network to be kept up,
+            // the network cannot be a potential satisfier: even if there are requests after this
+            // request in the list, they cannot become the active request, and therefore, cannot
+            // cause this network to be kept up.
+            // Note that this determination can only be made after evaluating previous requests in
+            // the array, because those requests might make the network a potential satisfier even
+            // if they are not currently active (e.g., they might currently be satisfied by another
+            // network with a higher score than this one).
+            if (!req.isRequest() && nri.getActiveRequest() == req) {
                 return false;
             }
-            // As non-multilayer listen requests have already returned, the below would only happen
-            // for a multilayer request therefore continue to the next request if available.
-            if (req.isListen() || req.isListenForBest()) {
-                continue;
-            }
-            // If there is hope for this network might validate and subsequently become the best
-            // network for that request, then it is needed. Note that this network can't already
-            // be the best for this request, or it would be the current satisfier, and therefore
-            // there would be no need to call this method to find out if it is a *potential*
-            // satisfier ("unneeded", the only caller, only calls this if this network currently
-            // satisfies no request).
-            if (candidate.satisfies(req)) {
-                // As soon as a network is found that satisfies a request, return. Specifically for
-                // multilayer requests, returning as soon as a NetworkAgentInfo satisfies a request
-                // is important so as to not evaluate lower priority requests further in
-                // nri.mRequests.
-                final NetworkAgentInfo champion = req.equals(nri.getActiveRequest())
-                        ? nri.getSatisfier() : null;
-                // Note that this catches two important cases:
-                // 1. Unvalidated cellular will not be reaped when unvalidated WiFi
-                //    is currently satisfying the request.  This is desirable when
-                //    cellular ends up validating but WiFi does not.
-                // 2. Unvalidated WiFi will not be reaped when validated cellular
-                //    is currently satisfying the request.  This is desirable when
-                //    WiFi ends up validating and out scoring cellular.
-                return mNetworkRanker.mightBeat(req, champion, candidate.getValidatedScoreable());
-            }
+
+            // This request type does not cause the network to be kept up and therefore does not
+            // cause the network to be a potential satisfier. Later requests in the list might.
+            if (!req.isRequest()) continue;
+
+            // The network can never be a potential satisfier for the request because it does not
+            // satisfy it. Later requests in the list might.
+            if (!candidate.satisfies(req)) continue;
+
+            // This request could cause the network to be kept up if and only if it could become the
+            // best network for the request by validating.
+            // Note that this network can't already be the best for this request, or it would be the
+            // current satisfier. Because this code is only called if the candidate network is
+            // satisfying zero requests, there are only two cases here:
+            // - The request is not being satisfied by any network (i.e., getActiveRequest() is not
+            //   this request).
+            // - The request is satisfied by another network and this network might (or might not)
+            //   beat it by validating.
+            // Note that this catches two important cases:
+            // 1. Unvalidated cellular will not be reaped when unvalidated WiFi
+            //    is currently satisfying the request.  This is desirable when
+            //    cellular ends up validating but WiFi does not.
+            // 2. Unvalidated WiFi will not be reaped when validated cellular
+            //    is currently satisfying the request.  This is desirable when
+            //    WiFi ends up validating and out scoring cellular.
+            if (req != nri.getActiveRequest()) return true;
+
+            final NetworkAgentInfo champion = nri.getSatisfier();
+            return mNetworkRanker.mightBeat(req, champion, candidate.getValidatedScoreable());
         }
 
         return false;
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSSatelliteNetworkTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSSatelliteNetworkTest.kt
index 0a881bd45c..a417a3f149 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSSatelliteNetworkTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSSatelliteNetworkTest.kt
@@ -271,10 +271,8 @@ class CSSatelliteNetworkTest : CSTest() {
         allNetworksCb.expectAvailableCallbacks(wifiNetwork, validated = false)
         defaultCb.expectAvailableCallbacks(wifiNetwork, validated = false)
         otherUidCb.expectAvailableCallbacks(wifiNetwork, validated = false)
-        // BUG: satellite should disconnect because there are no requests for it.
-        // cb.expect<Losing>(satelliteNetwork)
-        // cb.expect<Lost>(satelliteNetwork)
-        allNetworksCb.assertNoCallback()
+        allNetworksCb.expect<Losing>(satelliteNetwork)
+        allNetworksCb.expect<Lost>(satelliteNetwork)
 
         wifiAgent.disconnect()
         allNetworksCb.expect<Lost>(wifiNetwork)
@@ -290,17 +288,12 @@ class CSSatelliteNetworkTest : CSTest() {
         val satelliteNetwork2 = satelliteAgent2.network
 
         allNetworksCb.expectAvailableCallbacks(satelliteNetwork2, validated = false)
-        // BUG: this should be satelliteNetwork2, because satelliteNetwork should have gone down.
-        defaultCb.expectAvailableCallbacks(satelliteNetwork, validated = false)
+        defaultCb.expectAvailableCallbacks(satelliteNetwork2, validated = false)
 
         updateSatelliteNetworkFallbackUids(setOf())
 
-        // BUG: satelliteNetwork2 should disconnect because there are no requests for it.
-        // cb.expect<Lost>(satelliteNetwork2)
-        // defaultCb.expect<Lost>(satelliteNetwork2)
-        allNetworksCb.expect<Lost>(satelliteNetwork)
-        defaultCb.expect<Lost>(satelliteNetwork)
-
+        allNetworksCb.expect<Lost>(satelliteNetwork2)
+        defaultCb.expect<Lost>(satelliteNetwork2)
         otherUidCb.assertNoCallback()
     }
 

From 4a8e41d2ae9de48d9017d219aec17fc9cd09b397 Mon Sep 17 00:00:00 2001
From: Lorenzo Colitti <lorenzo@google.com>
Date: Fri, 18 Apr 2025 13:00:28 +0900
Subject: [PATCH 147/377] Add a shell command to set an app's fallback default
 network.

This adds two new shell commands to ConnectivityService that sets
a given UID to fall back to a given transport type if there is no
system default network. The syntax is:

  cmd connectivity set-debug-fallback-network-for-uid <uid> <transport>
  cmd connectivity clear-debug-fallback-network-for-uid <uid>

This works only on debug builds and should be used only for
manual testing.

Test: none yet
Bug: 410731080
Flag: TEST_ONLY
Change-Id: I9e0ac0713dbb95e59b22faa7cd45bdc8c1070f08
---
 .../android/server/ConnectivityService.java   |  72 ++++++++++
 .../CSShellCommandsTest.kt                    | 123 ++++++++++++++++++
 2 files changed, 195 insertions(+)
 create mode 100644 tests/unit/java/com/android/server/connectivityservice/CSShellCommandsTest.kt

diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index fa01218b06..bdb9e5b790 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -653,6 +653,8 @@ public class ConnectivityService extends IConnectivityManager.Stub {
     static final int PREFERENCE_ORDER_INVALID = Integer.MAX_VALUE;
     // As a security feature, VPNs have the top priority.
     static final int PREFERENCE_ORDER_VPN = 0; // Netd supports only 0 for VPN.
+    // Shell command has the next highest priority.
+    static final int PREFERENCE_ORDER_DEBUG_FALLBACK = 3;
     // Order of per-app OEM preference. See {@link #setOemNetworkPreference}.
     @VisibleForTesting
     static final int PREFERENCE_ORDER_OEM = 10;
@@ -12754,6 +12756,32 @@ public class ConnectivityService extends IConnectivityManager.Stub {
             }
         }
 
+        private void setDebugFallbackNetworkForUid(int uid, int transportType) {
+            final NetworkCapabilities nc = new NetworkCapabilities()
+                    .addTransportType(transportType)
+                    .addCapability(NET_CAPABILITY_INTERNET)
+                    .removeCapability(NET_CAPABILITY_NOT_RESTRICTED)
+                    .removeCapability(NET_CAPABILITY_NOT_BANDWIDTH_CONSTRAINED);
+            Set<Integer> uids = Set.of(uid);
+            Set<NetworkRequestInfo> nris = createNrisForFallbackDefault(uids, nc,
+                    PREFERENCE_ORDER_DEBUG_FALLBACK);
+            addPerAppDefaultNetworkRequests(nris);
+        }
+
+        private void clearDebugFallbackNetworkForUid(int uid) {
+            removeDefaultNetworkRequests((nri) ->
+                    nri.getPreferenceOrderForNetd() == PREFERENCE_ORDER_DEBUG_FALLBACK
+                    && nri.getUids().equals(Set.of(new UidRange(uid, uid))));
+            // Calling addPerAppDefaultNetworkRequests with an empty set here is necessary to
+            // make sure that the default network callbacks filed by this UID track the
+            // correct default network request.
+            // ConnectivityService makes sure that default network callbacks filed by UIDs track
+            // the correct default requests by removing and re-filing all of these requests
+            // whenever any of the default requests change. This work is done by
+            // addPerAppDefaultNetworkRequests. See its implementation for details.
+            addPerAppDefaultNetworkRequests(new ArraySet<>());
+        }
+
         @Override
         public int onCommand(String cmd) {
             if (cmd == null) {
@@ -12902,6 +12930,24 @@ public class ConnectivityService extends IConnectivityManager.Stub {
                         pw.println(ret);
                         return 0;
                     }
+                    case "set-debug-fallback-network-for-uid":
+                    case "clear-debug-fallback-network-for-uid": {
+                        if (!Build.isDebuggable()) {
+                            throw new SecurityException(
+                                    "Setting per-UID fallback network requires debuggable build");
+                        }
+                        final int uid = Integer.parseInt(getNextArg());
+                        boolean set = cmd.startsWith("set");
+                        final int transportType = set ? Integer.parseInt(getNextArg()) : TYPE_NONE;
+                        mHandler.post(() -> {
+                            clearDebugFallbackNetworkForUid(uid);
+                            if (set) {
+                                setDebugFallbackNetworkForUid(uid, transportType);
+                            }
+                            rematchAllNetworksAndRequests();
+                        });
+                        return 0;
+                    }
                     default:
                         return handleDefaultCommands(cmd);
                 }
@@ -12934,6 +12980,13 @@ public class ConnectivityService extends IConnectivityManager.Stub {
             pw.println("    Set the allow bit in FIREWALL_CHAIN_BACKGROUND for the given uid.");
             pw.println("  get-background-networking-enabled-for-uid [uid]");
             pw.println("    Get the allow bit in FIREWALL_CHAIN_BACKGROUND for the given uid.");
+            if (Build.isDebuggable()) {
+                pw.println("  set-debug-fallback-network-for-uid [uid] [transport]");
+                pw.println("    Sets [uid] to use [transport] as its default network when there is"
+                        + " no system default network.");
+                pw.println("  clear-per-debug-fallback-network-for-uid [uid]");
+                pw.println("    Clears a previous set-debug-fallback-network-for-uid command");
+            }
         }
     }
 
@@ -14612,9 +14665,28 @@ public class ConnectivityService extends IConnectivityManager.Stub {
     private void removeDefaultNetworkRequestsForPreference(final int preferenceOrder) {
         removeDefaultNetworkRequests((nri) -> nri.mPreferenceOrder == preferenceOrder);
     }
+
+    /**
+     * Add a list of NRIs as default requests, and update per-app callbacks that track them.
+     */
+    // TODO : this method gathers and updates the callbacks tracking the per-app NRIs, which
+    // is confusing for a method called "add". Importantly, callers of the
+    // removeDefaultNetworkRequest* methods above must call this after they call the remove
+    // method, or any callback tracking a removed method will not be updated.
+    // Adding the defaults to mDefaultNetworkRequests must happen before gathering the callbacks
+    // to update, but registering the nris in the argument must happen after doing so.
     private void addPerAppDefaultNetworkRequests(@NonNull final Set<NetworkRequestInfo> nris) {
         ensureRunningOnConnectivityServiceThread();
         mDefaultNetworkRequests.addAll(nris);
+        // getPerAppCallbackRequestsToUpdate gathers all the per-app callbacks that either
+        // - have been tracking a per-app default nri so far (see isPerAppTrackedNri), or
+        // - should now be tracking a per-app default nri (which is why mDefaultNetworkRequests
+        //   need to be updated before calling it).
+        // All of these requests will be removed below and re-created in such a way as to
+        // now track the new default nri for this UID (including if this is the system
+        // default nri), by copying the list of requests in the default nri, but copying
+        // the callbackForRequest (so it can continue updating the same callback) and the
+        // current satisfier (so the rematch will know what the old satisfier was).
         final ArraySet<NetworkRequestInfo> perAppCallbackRequestsToUpdate =
                 getPerAppCallbackRequestsToUpdate();
         final ArraySet<NetworkRequestInfo> nrisToRegister = new ArraySet<>(nris);
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSShellCommandsTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSShellCommandsTest.kt
new file mode 100644
index 0000000000..97eac6a364
--- /dev/null
+++ b/tests/unit/java/com/android/server/connectivityservice/CSShellCommandsTest.kt
@@ -0,0 +1,123 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.server
+
+import android.annotation.SuppressLint
+import android.net.NetworkCapabilities
+import android.net.NetworkCapabilities.NET_CAPABILITY_INTERNET
+import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_BANDWIDTH_CONSTRAINED
+import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_ROAMING
+import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_SUSPENDED
+import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_VCN_MANAGED
+import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_VPN
+import android.net.NetworkCapabilities.TRANSPORT_SATELLITE
+import android.net.NetworkCapabilities.TRANSPORT_WIFI
+import android.net.NetworkRequest
+import android.os.Build
+import android.os.ParcelFileDescriptor
+import android.os.Process
+import androidx.test.filters.SmallTest
+import com.android.testutils.DevSdkIgnoreRule
+import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
+import com.android.testutils.DevSdkIgnoreRunner
+import com.android.testutils.RecorderCallback.CallbackEntry.Losing
+import com.android.testutils.RecorderCallback.CallbackEntry.Lost
+import com.android.testutils.TestableNetworkCallback
+import java.io.File
+import org.junit.Assume.assumeTrue
+import org.junit.Rule
+import org.junit.Test
+import org.junit.runner.RunWith
+
+@DevSdkIgnoreRunner.MonitorThreadLeak
+@RunWith(DevSdkIgnoreRunner::class)
+@SmallTest
+@IgnoreUpTo(Build.VERSION_CODES.R)
+class CSShellCommandsTest : CSTest() {
+
+    @get:Rule
+    val ignoreRule = DevSdkIgnoreRule()
+
+    fun handleShellCommand(args: String) {
+        val pfd = ParcelFileDescriptor.open(File("/dev/null"), ParcelFileDescriptor.MODE_READ_WRITE)
+        service.handleShellCommand(pfd, pfd, pfd, args.split(" ").toTypedArray())
+    }
+
+    fun ncForTransport(transport: Int, otherCaps: IntArray = intArrayOf()): NetworkCapabilities {
+        return NetworkCapabilities.Builder().apply {
+            addTransportType(transport)
+            addCapability(NET_CAPABILITY_INTERNET)
+            addCapability(NET_CAPABILITY_NOT_ROAMING)
+            addCapability(NET_CAPABILITY_NOT_SUSPENDED)
+            addCapability(NET_CAPABILITY_NOT_VCN_MANAGED)
+            addCapability(NET_CAPABILITY_NOT_VPN)
+            removeCapability(NET_CAPABILITY_NOT_BANDWIDTH_CONSTRAINED)
+            for (i in otherCaps) addCapability(i)
+        }.build()
+    }
+
+    @SuppressLint("MissingPermission")
+    @Test @IgnoreUpTo(Build.VERSION_CODES.UPSIDE_DOWN_CAKE)
+    fun testDebugFallbackNetwork() {
+        assumeTrue(Build.isDebuggable())
+
+        val cb = TestableNetworkCallback()
+        cm.registerNetworkCallback(NetworkRequest.Builder().clearCapabilities().build(), cb)
+
+        val defaultCb = TestableNetworkCallback()
+        cm.registerDefaultNetworkCallback(defaultCb)
+
+        // Set myUid to default to satellite.
+        handleShellCommand(
+            "set-debug-fallback-network-for-uid ${Process.myUid()} $TRANSPORT_SATELLITE"
+        )
+
+        // When satellite connects, it becomes the default network for myUid.
+        val satelliteAgent = Agent(ncForTransport(TRANSPORT_SATELLITE))
+        satelliteAgent.connect()
+        cb.expectAvailableCallbacks(satelliteAgent.network, validated = false)
+        defaultCb.expectAvailableCallbacks(satelliteAgent.network, validated = false)
+
+        // When wifi connects, satellite is no longer myUid's default and gets torn down.
+        val wifiAgent = Agent(ncForTransport(
+            TRANSPORT_WIFI,
+            intArrayOf(NET_CAPABILITY_NOT_BANDWIDTH_CONSTRAINED)
+        ))
+        wifiAgent.connect()
+        cb.expectAvailableCallbacks(wifiAgent.network, validated = false)
+        defaultCb.expectAvailableCallbacks(wifiAgent.network, validated = false)
+
+        cb.expect<Losing>(satelliteAgent.network)
+        cb.expect<Lost>(satelliteAgent.network)
+
+        // When wifi disconnects, satellite becomes the default again.
+        wifiAgent.disconnect()
+        cb.expect<Lost>(wifiAgent.network)
+        defaultCb.expect<Lost>(wifiAgent.network)
+
+        val satelliteAgent2 = Agent(ncForTransport(TRANSPORT_SATELLITE))
+        satelliteAgent2.connect()
+        cb.expectAvailableCallbacks(satelliteAgent2.network, validated = false)
+        defaultCb.expectAvailableCallbacks(satelliteAgent2.network, validated = false)
+
+        // Set myUid to no longer default to satellite, and expect satellite to disconnect.
+        // It cannot be the system default network because it's bandwidth constrained.
+        handleShellCommand("clear-debug-fallback-network-for-uid ${Process.myUid()}")
+        cb.expect<Lost>(satelliteAgent2.network)
+        defaultCb.expect<Lost>(satelliteAgent2.network)
+    }
+}

From 0721786efed72088f647eb7c87c80e4115ef711f Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Tue, 22 Apr 2025 13:01:59 -0700
Subject: [PATCH 148/377] Add test to ensure clat drops multicast

Test: TH
Flag: EXEMPT mainline
Bug: 406956456
Change-Id: If47f7787b0826259157eb328ddf35c8c91b46fc6
---
 tests/integration/src/android/net/ClatTest.kt | 25 +++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/tests/integration/src/android/net/ClatTest.kt b/tests/integration/src/android/net/ClatTest.kt
index c7754f8b75..1c279b24ee 100644
--- a/tests/integration/src/android/net/ClatTest.kt
+++ b/tests/integration/src/android/net/ClatTest.kt
@@ -60,6 +60,7 @@ import org.junit.Test
 import org.junit.runner.RunWith
 
 private const val TAG = "ClatTest"
+private const val SHORT_TIMEOUT_MS = 200L
 private const val TIMEOUT_MS = 2000L
 
 private val REQUEST: NetworkRequest = NetworkRequest.Builder()
@@ -169,6 +170,19 @@ class ClatTest {
         assertThat(p).isNotNull()
     }
 
+    /** Assert that no packet from the clat source address was received */
+    fun expectNoClatPacket() {
+        val p = iface.packetReader.poll(SHORT_TIMEOUT_MS) {
+            val src = ByteArray(16)
+            val buf = ByteBuffer.wrap(it)
+            buf.position(14 + 8)
+            buf.get(src)
+            val srcAddr = Inet6Address.getByAddress(src)
+            clatV6Addr.equals(srcAddr)
+        }
+        assertThat(p).isNull()
+    }
+
     @Test
     fun testClatEgress() {
         socket = Os.socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP)
@@ -207,4 +221,15 @@ class ClatTest {
         Os.read(socket, buf)
         assertThat(buf.array()).isEqualTo(data.toByteArray())
     }
+
+    @Test
+    fun testEgressDropsMulticast() {
+        socket = Os.socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP)
+        network.bindSocket(socket)
+
+        val buf = ByteBuffer.wrap("test".toByteArray())
+        Os.sendto(socket, buf, 0 /*flags*/, InetAddress.getByName("224.0.0.251"), 12345 /*port*/)
+        Os.sendto(socket, buf, 0 /*flags*/, InetAddress.getByName("234.42.42.42"), 123 /*port*/)
+        expectNoClatPacket()
+    }
 }

From c9baec41019b5256aefbc9cfe5fa8053a7c9315d Mon Sep 17 00:00:00 2001
From: Lorenzo Colitti <lorenzo@google.com>
Date: Fri, 18 Apr 2025 13:00:28 +0900
Subject: [PATCH 149/377] Improve the tests for the fallback network shell
 command.

- Also verify the netd operations that add and remove UID ranges.
- Don't set the network to keep connected, since that is not
  representative of what happens on a real device.

Test: test-only change
Bug: 410731080
Flag: TEST_ONLY
Change-Id: Ib4305748b5f1627546b7a63fb9596308b14155e0
---
 .../android/server/ConnectivityService.java   |  1 +
 .../CSShellCommandsTest.kt                    | 71 +++++++++++++++----
 2 files changed, 59 insertions(+), 13 deletions(-)

diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index bdb9e5b790..e0bbe017e6 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -654,6 +654,7 @@ public class ConnectivityService extends IConnectivityManager.Stub {
     // As a security feature, VPNs have the top priority.
     static final int PREFERENCE_ORDER_VPN = 0; // Netd supports only 0 for VPN.
     // Shell command has the next highest priority.
+    @VisibleForTesting
     static final int PREFERENCE_ORDER_DEBUG_FALLBACK = 3;
     // Order of per-app OEM preference. See {@link #setOemNetworkPreference}.
     @VisibleForTesting
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSShellCommandsTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSShellCommandsTest.kt
index 97eac6a364..f94e858377 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSShellCommandsTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSShellCommandsTest.kt
@@ -17,6 +17,9 @@
 package com.android.server
 
 import android.annotation.SuppressLint
+import android.net.INetd
+import android.net.NativeNetworkConfig
+import android.net.NativeNetworkType
 import android.net.NetworkCapabilities
 import android.net.NetworkCapabilities.NET_CAPABILITY_INTERNET
 import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_BANDWIDTH_CONSTRAINED
@@ -27,10 +30,14 @@ import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_VPN
 import android.net.NetworkCapabilities.TRANSPORT_SATELLITE
 import android.net.NetworkCapabilities.TRANSPORT_WIFI
 import android.net.NetworkRequest
+import android.net.UidRangeParcel
+import android.net.VpnManager
+import android.net.netd.aidl.NativeUidRangeConfig
 import android.os.Build
 import android.os.ParcelFileDescriptor
 import android.os.Process
 import androidx.test.filters.SmallTest
+import com.android.server.ConnectivityService.PREFERENCE_ORDER_DEBUG_FALLBACK
 import com.android.testutils.DevSdkIgnoreRule
 import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
 import com.android.testutils.DevSdkIgnoreRunner
@@ -42,6 +49,7 @@ import org.junit.Assume.assumeTrue
 import org.junit.Rule
 import org.junit.Test
 import org.junit.runner.RunWith
+import org.mockito.Mockito.inOrder
 
 @DevSdkIgnoreRunner.MonitorThreadLeak
 @RunWith(DevSdkIgnoreRunner::class)
@@ -70,11 +78,35 @@ class CSShellCommandsTest : CSTest() {
         }.build()
     }
 
+    private fun nativeNetworkConfigPhysical(netId: Int) =
+        NativeNetworkConfig(
+            netId,
+            NativeNetworkType.PHYSICAL,
+            INetd.PERMISSION_NONE,
+            false, // secure
+            VpnManager.TYPE_VPN_NONE,
+            false // excludeLocalRoutes
+        )
+
+    private fun uidRangeConfig(netId: Int, uid: Int) = NativeUidRangeConfig(
+        netId,
+        arrayOf(UidRangeParcel(uid, uid)),
+        PREFERENCE_ORDER_DEBUG_FALLBACK
+    )
+
+    private fun createSatelliteNetwork() = Agent(
+        lp = defaultLp().apply{ interfaceName = "satellite0" },
+        nc = ncForTransport(TRANSPORT_SATELLITE),
+        score = defaultScore() // Do not keep connected if there are no requests.
+    ).apply { connect() }.network
+
     @SuppressLint("MissingPermission")
     @Test @IgnoreUpTo(Build.VERSION_CODES.UPSIDE_DOWN_CAKE)
     fun testDebugFallbackNetwork() {
         assumeTrue(Build.isDebuggable())
 
+        val myUid = Process.myUid()
+        val inOrder = inOrder(netd)
         val cb = TestableNetworkCallback()
         cm.registerNetworkCallback(NetworkRequest.Builder().clearCapabilities().build(), cb)
 
@@ -83,14 +115,17 @@ class CSShellCommandsTest : CSTest() {
 
         // Set myUid to default to satellite.
         handleShellCommand(
-            "set-debug-fallback-network-for-uid ${Process.myUid()} $TRANSPORT_SATELLITE"
+            "set-debug-fallback-network-for-uid $myUid $TRANSPORT_SATELLITE"
         )
 
         // When satellite connects, it becomes the default network for myUid.
-        val satelliteAgent = Agent(ncForTransport(TRANSPORT_SATELLITE))
-        satelliteAgent.connect()
-        cb.expectAvailableCallbacks(satelliteAgent.network, validated = false)
-        defaultCb.expectAvailableCallbacks(satelliteAgent.network, validated = false)
+        val satelliteNetwork = createSatelliteNetwork()
+        val satelliteNetId = satelliteNetwork.netId
+        cb.expectAvailableCallbacks(satelliteNetwork, validated = false)
+        defaultCb.expectAvailableCallbacks(satelliteNetwork, validated = false)
+
+        inOrder.verify(netd).networkCreate(nativeNetworkConfigPhysical(satelliteNetId))
+        inOrder.verify(netd).networkAddUidRangesParcel(uidRangeConfig(satelliteNetId, myUid))
 
         // When wifi connects, satellite is no longer myUid's default and gets torn down.
         val wifiAgent = Agent(ncForTransport(
@@ -101,23 +136,33 @@ class CSShellCommandsTest : CSTest() {
         cb.expectAvailableCallbacks(wifiAgent.network, validated = false)
         defaultCb.expectAvailableCallbacks(wifiAgent.network, validated = false)
 
-        cb.expect<Losing>(satelliteAgent.network)
-        cb.expect<Lost>(satelliteAgent.network)
+        cb.expect<Losing>(satelliteNetwork)
+        cb.expect<Lost>(satelliteNetwork)
+        inOrder.verify(netd).networkRemoveUidRangesParcel(uidRangeConfig(satelliteNetId, myUid))
+        waitForIdle() // Network teardown is not guaranteed to have happened when onLost fires.
+        inOrder.verify(netd).networkDestroy(satelliteNetId)
 
         // When wifi disconnects, satellite becomes the default again.
         wifiAgent.disconnect()
         cb.expect<Lost>(wifiAgent.network)
         defaultCb.expect<Lost>(wifiAgent.network)
 
-        val satelliteAgent2 = Agent(ncForTransport(TRANSPORT_SATELLITE))
-        satelliteAgent2.connect()
-        cb.expectAvailableCallbacks(satelliteAgent2.network, validated = false)
-        defaultCb.expectAvailableCallbacks(satelliteAgent2.network, validated = false)
+        val satelliteNetwork2 = createSatelliteNetwork()
+        val satelliteNetId2 = satelliteNetwork2.netId
+        cb.expectAvailableCallbacks(satelliteNetwork2, validated = false)
+        defaultCb.expectAvailableCallbacks(satelliteNetwork2, validated = false)
+
+        inOrder.verify(netd).networkCreate(nativeNetworkConfigPhysical(satelliteNetId2))
+        inOrder.verify(netd).networkAddUidRangesParcel(uidRangeConfig(satelliteNetId2, myUid))
 
         // Set myUid to no longer default to satellite, and expect satellite to disconnect.
         // It cannot be the system default network because it's bandwidth constrained.
         handleShellCommand("clear-debug-fallback-network-for-uid ${Process.myUid()}")
-        cb.expect<Lost>(satelliteAgent2.network)
-        defaultCb.expect<Lost>(satelliteAgent2.network)
+        cb.expect<Lost>(satelliteNetwork2)
+        defaultCb.expect<Lost>(satelliteNetwork2)
+
+        inOrder.verify(netd).networkRemoveUidRangesParcel(uidRangeConfig(satelliteNetId2, myUid))
+        waitForIdle() // Network teardown is not guaranteed to have happened when onLost fires.
+        inOrder.verify(netd).networkDestroy(satelliteNetId2)
     }
 }

From 7a8f4b9da585615ab93715b6a876c0bf8105ca11 Mon Sep 17 00:00:00 2001
From: Paul Hu <paulhu@google.com>
Date: Wed, 23 Apr 2025 10:00:37 +0000
Subject: [PATCH 150/377] Add tests to verify OffloadEngine behaviors

Bug: 410734687
Test: atest ConnectivityCoverageTests
Flag: EXEMPT test only update
Change-Id: If7a15e181a185e4c1a55b252d57d7f464aa6baac
---
 .../connectivity/mdns/MdnsAdvertiser.java     |  2 +-
 .../com/android/server/NsdServiceTest.java    | 64 ++++++++++++++++++-
 2 files changed, 63 insertions(+), 3 deletions(-)

diff --git a/service-t/src/com/android/server/connectivity/mdns/MdnsAdvertiser.java b/service-t/src/com/android/server/connectivity/mdns/MdnsAdvertiser.java
index bd00b706e8..e251ec2375 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MdnsAdvertiser.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MdnsAdvertiser.java
@@ -643,7 +643,7 @@ public class MdnsAdvertiser {
         public final @NonNull OffloadServiceInfo mOffloadServiceInfo;
         public final int mServiceId;
 
-        OffloadServiceInfoWrapper(int serviceId, OffloadServiceInfo offloadServiceInfo) {
+        public OffloadServiceInfoWrapper(int serviceId, OffloadServiceInfo offloadServiceInfo) {
             mOffloadServiceInfo = offloadServiceInfo;
             mServiceId = serviceId;
         }
diff --git a/tests/unit/java/com/android/server/NsdServiceTest.java b/tests/unit/java/com/android/server/NsdServiceTest.java
index 6e8809ff6a..8b9a00d6a7 100644
--- a/tests/unit/java/com/android/server/NsdServiceTest.java
+++ b/tests/unit/java/com/android/server/NsdServiceTest.java
@@ -59,6 +59,7 @@ import static org.mockito.ArgumentMatchers.anyInt;
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.ArgumentMatchers.argThat;
 import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.doAnswer;
 import static org.mockito.Mockito.doCallRealMethod;
 import static org.mockito.Mockito.doReturn;
 import static org.mockito.Mockito.eq;
@@ -96,6 +97,7 @@ import android.net.nsd.NsdManager.ResolveListener;
 import android.net.nsd.NsdManager.ServiceInfoCallback;
 import android.net.nsd.NsdServiceInfo;
 import android.net.nsd.OffloadEngine;
+import android.net.nsd.OffloadServiceInfo;
 import android.net.wifi.WifiManager;
 import android.os.Binder;
 import android.os.Build;
@@ -203,6 +205,7 @@ public class NsdServiceTest {
     HandlerThread mThread;
     TestHandler mHandler;
     NsdService mService;
+    MdnsAdvertiser.AdvertiserCallback mAdvertiserCallback;
 
     private static class LinkToDeathRecorder extends Binder {
         IBinder.DeathRecipient mDr;
@@ -244,8 +247,10 @@ public class NsdServiceTest {
         doReturn(mSocketProvider).when(mDeps).makeMdnsSocketProvider(any(), any(), any(), any());
         doReturn(DEFAULT_RUNNING_APP_ACTIVE_IMPORTANCE_CUTOFF).when(mDeps).getDeviceConfigInt(
                 eq(NsdService.MDNS_CONFIG_RUNNING_APP_ACTIVE_IMPORTANCE_CUTOFF), anyInt());
-        doReturn(mAdvertiser).when(mDeps).makeMdnsAdvertiser(any(), any(), any(), any(), any(),
-                any());
+        doAnswer(inv -> {
+            mAdvertiserCallback = (MdnsAdvertiser.AdvertiserCallback) inv.getArguments()[2];
+            return mAdvertiser;
+        }).when(mDeps).makeMdnsAdvertiser(any(), any(), any(), any(), any(), any());
         doReturn(mMetrics).when(mDeps).makeNetworkNsdReportedMetrics(anyInt());
         doReturn(mClock).when(mDeps).makeClock();
         doReturn(TEST_TIME_MS).when(mClock).elapsedRealtime();
@@ -2034,6 +2039,61 @@ public class NsdServiceTest {
         client.unregisterOffloadEngine(offloadEngine);
     }
 
+    private OffloadEngine registerOffloadEngine(String interfaceName) {
+        final NsdManager client = connectClient(mService);
+        final OffloadEngine offloadEngine = mock(OffloadEngine.class);
+        doReturn(PERMISSION_GRANTED).when(mContext).checkCallingOrSelfPermission(
+                REGISTER_NSD_OFFLOAD_ENGINE);
+        client.registerOffloadEngine(interfaceName, OffloadEngine.OFFLOAD_TYPE_REPLY,
+                OffloadEngine.OFFLOAD_CAPABILITY_BYPASS_MULTICAST_LOCK, Runnable::run,
+                offloadEngine);
+        waitForIdle();
+        return offloadEngine;
+    }
+
+    @Test
+    @EnableCompatChanges(ENABLE_PLATFORM_MDNS_BACKEND)
+    @DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.UPSIDE_DOWN_CAKE)
+    public void testRegisterOffloadEngine_sendAllOffloadServiceInfos() {
+        final String interfaceName = "iface";
+        final OffloadServiceInfo info = new OffloadServiceInfo(
+                new OffloadServiceInfo.Key("_testService", "_testType"), List.of("_sub1", "_sub2"),
+                "Android.local", new byte[] { 0x1, 0x2, 0x3 }, 1 /* priority */,
+                OffloadEngine.OFFLOAD_TYPE_REPLY);
+        doReturn(List.of(new MdnsAdvertiser.OffloadServiceInfoWrapper(123, info)))
+                .when(mAdvertiser).getAllInterfaceOffloadServiceInfos(interfaceName);
+        final OffloadEngine offloadEngine = registerOffloadEngine(interfaceName);
+        // Verify that the OffloadServiceInfo retrieves from the advertiser and then sends it to
+        // the OffloadEngine.
+        verify(mAdvertiser).getAllInterfaceOffloadServiceInfos(interfaceName);
+        verify(offloadEngine).onOffloadServiceUpdated(info);
+    }
+
+    @Test
+    @EnableCompatChanges(ENABLE_PLATFORM_MDNS_BACKEND)
+    @DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.UPSIDE_DOWN_CAKE)
+    public void testRegisterOffloadEngine_OffloadServiceUpdatedAndRemoved() {
+        final String interfaceName = "iface";
+        final OffloadServiceInfo info = new OffloadServiceInfo(
+                new OffloadServiceInfo.Key("_testService", "_testType"), List.of("_sub1", "_sub2"),
+                "Android.local", new byte[] { 0x1, 0x2, 0x3 }, 1 /* priority */,
+                OffloadEngine.OFFLOAD_TYPE_REPLY);
+        doReturn(Collections.emptyList()).when(mAdvertiser)
+                .getAllInterfaceOffloadServiceInfos(anyString());
+        final OffloadEngine offloadEngine = registerOffloadEngine(interfaceName);
+        // Verify that the OffloadServiceInfo retrieves from the advertiser and that no info is
+        // sent to the OffloadEngine.
+        verify(mAdvertiser).getAllInterfaceOffloadServiceInfos(interfaceName);
+        verify(offloadEngine, never()).onOffloadServiceUpdated(any());
+        // onOffloadStartOrUpdate callback triggered. The OffloadServiceInfo update should be sent
+        // to the OffloadEngine.
+        mAdvertiserCallback.onOffloadStartOrUpdate(interfaceName, info);
+        verify(offloadEngine).onOffloadServiceUpdated(info);
+        // onOffloadStop callback triggered. The OffloadServiceInfo removal should be sent to the
+        // OffloadEngine.
+        mAdvertiserCallback.onOffloadStop(interfaceName, info);
+        verify(offloadEngine).onOffloadServiceRemoved(info);
+    }
 
     private void waitForIdle() {
         HandlerUtils.waitForIdle(mHandler, TIMEOUT_MS);

From 8b1fe1976b963280d9774197ea971bf048f0a26e Mon Sep 17 00:00:00 2001
From: Junyu Lai <junyulai@google.com>
Date: Tue, 15 Apr 2025 15:32:54 +0800
Subject: [PATCH 151/377] Move user/package intent reception out of
 PermissionMonitor

This is a no-op refactoring that moves the reception of
package and user-related intents in PermissionMonitor to
BroadcastReceiveHelper.
It then dispatches these events to the PermissionMonitor.
This change is necessary to centralize intent receivers
from other subclasses to ConnectivityService in
subsequent modifications.

This reverts the design change introduced in aosp/2183343, which
had PermissionMonitor listening to user change events instead
of ConnectivityService.

Flag: EXEMPT refactor
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.connectivity.PermissionMonitorTest \
      ConnectivityCoverageTests:android.net.connectivity.com.android.server.ConnectivityServiceTest \
      ConnectivityCoverageTests:android.net.connectivity.com.android.server.connectivity.BroadcastReceiveHelperTest \
      --update-device
Bug: 410731080
Change-Id: Ic79afc18a6e8603ddf8d48a1f78cf8d98f2447ae
---
 .../android/server/ConnectivityService.java   |  96 +++---
 .../connectivity/BroadcastReceiveHelper.java  | 230 ++++++++++++++
 .../connectivity/PermissionMonitor.java       |  92 +-----
 .../BroadcastReceiveHelperTest.kt             | 284 ++++++++++++++++++
 .../connectivity/PermissionMonitorTest.java   |  84 ++----
 5 files changed, 583 insertions(+), 203 deletions(-)
 create mode 100644 service/src/com/android/server/connectivity/BroadcastReceiveHelper.java
 create mode 100644 tests/unit/java/com/android/server/connectivity/BroadcastReceiveHelperTest.kt

diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index 647455611c..218e8f9b6e 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -362,6 +362,7 @@ import com.android.server.connectivity.ApplicationSelfCertifiedNetworkCapabiliti
 import com.android.server.connectivity.AutodestructReference;
 import com.android.server.connectivity.AutomaticOnOffKeepaliveTracker;
 import com.android.server.connectivity.AutomaticOnOffKeepaliveTracker.AutomaticOnOffKeepalive;
+import com.android.server.connectivity.BroadcastReceiveHelper;
 import com.android.server.connectivity.CarrierPrivilegeAuthenticator;
 import com.android.server.connectivity.ClatCoordinator;
 import com.android.server.connectivity.ConnectivityFlags;
@@ -439,7 +440,8 @@ import java.util.function.Predicate;
  * @hide
  */
 @TargetApi(Build.VERSION_CODES.S)
-public class ConnectivityService extends IConnectivityManager.Stub {
+public class ConnectivityService extends IConnectivityManager.Stub
+        implements BroadcastReceiveHelper.Delegate {
     private static final String TAG = ConnectivityService.class.getSimpleName();
 
     private static final String DIAG_ARG = "--diag";
@@ -528,6 +530,8 @@ public class ConnectivityService extends IConnectivityManager.Stub {
 
     private final PermissionMonitor mPermissionMonitor;
 
+    private final BroadcastReceiveHelper mBroadcastReceiveHelper;
+
     @VisibleForTesting
     final RequestInfoPerUidCounter mNetworkRequestCounter;
     @VisibleForTesting
@@ -1942,6 +1946,7 @@ public class ConnectivityService extends IConnectivityManager.Stub {
         mTrackerHandler = new NetworkStateTrackerHandler(mHandlerThread.getLooper());
         mConnectivityDiagnosticsHandler =
                 new ConnectivityDiagnosticsHandler(mHandlerThread.getLooper());
+        mBroadcastReceiveHelper = new BroadcastReceiveHelper(mContext, mHandler, this);
 
         mReleasePendingIntentDelayMs = Settings.Secure.getInt(context.getContentResolver(),
                 ConnectivitySettingsManager.CONNECTIVITY_RELEASE_PENDING_INTENT_DELAY_MS, 5_000);
@@ -2009,22 +2014,8 @@ public class ConnectivityService extends IConnectivityManager.Stub {
         mUserManager = (UserManager) context.getSystemService(Context.USER_SERVICE);
 
         mUserAllContext = mContext.createContextAsUser(UserHandle.ALL, 0 /* flags */);
-        // Listen for user add/removes to inform PermissionMonitor.
-        // Should run on mHandler to avoid any races.
-        final IntentFilter userIntentFilter = new IntentFilter();
-        userIntentFilter.addAction(Intent.ACTION_USER_ADDED);
-        userIntentFilter.addAction(Intent.ACTION_USER_REMOVED);
-        mUserAllContext.registerReceiver(mUserIntentReceiver, userIntentFilter,
-                null /* broadcastPermission */, mHandler);
-
-        // Listen to package add/removes for netd
-        final IntentFilter packageIntentFilter = new IntentFilter();
-        packageIntentFilter.addAction(Intent.ACTION_PACKAGE_ADDED);
-        packageIntentFilter.addAction(Intent.ACTION_PACKAGE_REMOVED);
-        packageIntentFilter.addAction(Intent.ACTION_PACKAGE_REPLACED);
-        packageIntentFilter.addDataScheme("package");
-        mUserAllContext.registerReceiver(mPackageIntentReceiver, packageIntentFilter,
-                null /* broadcastPermission */, mHandler);
+        // TODO: Move all intent receivers to the helper class.
+        mBroadcastReceiveHelper.registerReceivers();
 
         // This is needed for pre-V devices to propagate the data saver status
         // to the BPF map. This isn't supported before Android T because BPF maps are
@@ -7720,14 +7711,17 @@ public class ConnectivityService extends IConnectivityManager.Stub {
         }
     }
 
-    private void onUserAdded(@NonNull final UserHandle user) {
+    @Override
+    public void onUserAdded(@NonNull final UserHandle user) {
         if (mOemNetworkPreferences.getNetworkPreferences().size() > 0) {
             handleSetOemNetworkPreference(mOemNetworkPreferences, null);
         }
         updateProfileAllowedNetworks();
+        mPermissionMonitor.onUserAdded(user);
     }
 
-    private void onUserRemoved(@NonNull final UserHandle user) {
+    @Override
+    public void onUserRemoved(@NonNull final UserHandle user) {
         // If there was a network preference for this user, remove it.
         handleSetProfileNetworkPreference(
                 List.of(new ProfileNetworkPreferenceInfo(user, null, true,
@@ -7736,9 +7730,32 @@ public class ConnectivityService extends IConnectivityManager.Stub {
         if (mOemNetworkPreferences.getNetworkPreferences().size() > 0) {
             handleSetOemNetworkPreference(mOemNetworkPreferences, null);
         }
+        mPermissionMonitor.onUserRemoved(user);
     }
 
-    private void onPackageChanged(@NonNull final String packageName) {
+    @Override
+    public void onPackageAdded(@NonNull final String packageName, final int uid) {
+        handlePackageChanged(packageName);
+        mPermissionMonitor.onPackageAdded(packageName, uid);
+    }
+
+    @Override
+    public void onPackageRemoved(@NonNull final String packageName, final int uid) {
+        handlePackageChanged(packageName);
+        mPermissionMonitor.onPackageRemoved(packageName, uid);
+    }
+
+    @Override
+    public void onPackageReplaced(@NonNull final String packageName, final int uid) {
+        handlePackageChanged(packageName);
+    }
+
+    @Override
+    public void onExternalApplicationsAvailable(@Nullable String[] pkgList) {
+        mPermissionMonitor.onExternalApplicationsAvailable(pkgList);
+    }
+
+    private void handlePackageChanged(@NonNull final String packageName) {
         // This is necessary in case a package is added or removed, but also when it's replaced to
         // run as a new UID by its manifest rules. Also, if a separate package shares the same UID
         // as one in the preferences, then it should follow the same routing as that other package,
@@ -7754,45 +7771,6 @@ public class ConnectivityService extends IConnectivityManager.Stub {
         }
     }
 
-    private final BroadcastReceiver mUserIntentReceiver = new BroadcastReceiver() {
-        @Override
-        public void onReceive(Context context, Intent intent) {
-            ensureRunningOnConnectivityServiceThread();
-            final String action = intent.getAction();
-            final UserHandle user = intent.getParcelableExtra(Intent.EXTRA_USER);
-
-            // User should be filled for below intents, check the existence.
-            if (user == null) {
-                Log.wtf(TAG, intent.getAction() + " broadcast without EXTRA_USER");
-                return;
-            }
-
-            if (Intent.ACTION_USER_ADDED.equals(action)) {
-                onUserAdded(user);
-            } else if (Intent.ACTION_USER_REMOVED.equals(action)) {
-                onUserRemoved(user);
-            }  else {
-                Log.wtf(TAG, "received unexpected intent: " + action);
-            }
-        }
-    };
-
-    private final BroadcastReceiver mPackageIntentReceiver = new BroadcastReceiver() {
-        @Override
-        public void onReceive(Context context, Intent intent) {
-            ensureRunningOnConnectivityServiceThread();
-            switch (intent.getAction()) {
-                case Intent.ACTION_PACKAGE_ADDED:
-                case Intent.ACTION_PACKAGE_REMOVED:
-                case Intent.ACTION_PACKAGE_REPLACED:
-                    onPackageChanged(intent.getData().getSchemeSpecificPart());
-                    break;
-                default:
-                    Log.wtf(TAG, "received unexpected intent: " + intent.getAction());
-            }
-        }
-    };
-
     @RequiresApi(Build.VERSION_CODES.TIRAMISU)
     private final BroadcastReceiver mDataSaverReceiver = new BroadcastReceiver() {
         @Override
diff --git a/service/src/com/android/server/connectivity/BroadcastReceiveHelper.java b/service/src/com/android/server/connectivity/BroadcastReceiveHelper.java
new file mode 100644
index 0000000000..fe430437f1
--- /dev/null
+++ b/service/src/com/android/server/connectivity/BroadcastReceiveHelper.java
@@ -0,0 +1,230 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.server.connectivity;
+
+import android.annotation.NonNull;
+import android.content.BroadcastReceiver;
+import android.content.Context;
+import android.content.Intent;
+import android.content.IntentFilter;
+import android.net.Uri;
+import android.os.Handler;
+import android.os.HandlerThread;
+import android.os.UserHandle;
+import android.util.Log;
+
+import com.android.net.module.util.HandlerUtils;
+
+/**
+ * Helper class for ConnectivityService to listen for broadcast intents and
+ * provide callbacks on a given {@link HandlerThread}.
+ */
+public class BroadcastReceiveHelper {
+    private static final String TAG = BroadcastReceiveHelper.class.getSimpleName();
+    private final Context mContext;
+    private final Handler mHandler;
+    private final Delegate mCallback;
+
+    /**
+     * Interface defining the callback methods for package and user related events.
+     */
+    public interface Delegate {
+        /**
+         * Called when a new package has been installed.
+         *
+         * @param packageName The name of the package that was added.
+         * @param uid         The user ID of the application that was added.
+         */
+        void onPackageAdded(String packageName, int uid);
+
+        /**
+         * Called when a package has been uninstalled.
+         *
+         * @param packageName The name of the package that was removed.
+         * @param uid         The user ID of the application that was removed.
+         */
+        void onPackageRemoved(String packageName, int uid);
+
+        /**
+         * Called when an existing package has been replaced with a new version.
+         *
+         * @param packageName The name of the package that was replaced.
+         * @param uid         The user ID of the application that was replaced.
+         */
+        void onPackageReplaced(String packageName, int uid);
+
+        /**
+         * Called when the availability of external applications changes.
+         *
+         * @param pkgList An array of package names that have become available.
+         */
+        void onExternalApplicationsAvailable(String[] pkgList);
+
+        /**
+         * Called when a new user has been added to the device.
+         *
+         * @param userHandle The {@link UserHandle} of the user that was added.
+         */
+        void onUserAdded(UserHandle userHandle);
+
+        /**
+         * Called when a user has been removed from the device.
+         *
+         * @param userHandle The {@link UserHandle} of the user that was removed.
+         */
+        void onUserRemoved(UserHandle userHandle);
+    }
+
+    /**
+     * Constructs a new {@code ConnectivityBroadcastReceiveHelper}.
+     *
+     * @param context The {@link Context} to register the broadcast receiver.
+     * @param handler The handler where the callback methods will be executed.
+     * @param callback The {@link Delegate} implementation that will receive the broadcast events.
+     */
+    public BroadcastReceiveHelper(@NonNull Context context,
+            @NonNull final Handler handler, @NonNull Delegate callback) {
+        this.mContext = context;
+        this.mHandler = handler;
+        this.mCallback = callback;
+    }
+
+    /**
+     * Registers the broadcast receivers for package and user related intents.
+     * The callbacks for these events will be executed on the {@link HandlerThread}
+     * provided in the constructor.
+     */
+    public void registerReceivers() {
+        final Context userAllContext = mContext.createContextAsUser(UserHandle.ALL, 0 /* flags */);
+
+        // Listen to user events.
+        // TODO: Receive intents inline and post them to the handler.
+        final IntentFilter userIntentFilter = new IntentFilter();
+        userIntentFilter.addAction(Intent.ACTION_USER_ADDED);
+        userIntentFilter.addAction(Intent.ACTION_USER_REMOVED);
+        userAllContext.registerReceiver(mUserIntentReceiver, userIntentFilter,
+                null /* broadcastPermission */, mHandler);
+
+        // Listen to package change events.
+        final IntentFilter packageIntentFilter = new IntentFilter();
+        packageIntentFilter.addAction(Intent.ACTION_PACKAGE_ADDED);
+        packageIntentFilter.addAction(Intent.ACTION_PACKAGE_REMOVED);
+        packageIntentFilter.addAction(Intent.ACTION_PACKAGE_REPLACED);
+        packageIntentFilter.addDataScheme("package");
+        userAllContext.registerReceiver(mPackageIntentReceiver, packageIntentFilter,
+                null /* broadcastPermission */, mHandler);
+
+        // For PermissionMonitor, listen to EXTERNAL_APPLICATIONS_AVAILABLE is that an app
+        // becoming available means it may need to gain a permission. But an app that becomes
+        // unavailable can neither gain nor lose permissions on that account, it just can no
+        // longer run. Thus, doesn't need to listen to EXTERNAL_APPLICATIONS_UNAVAILABLE.
+        final IntentFilter externalIntentFilter =
+                new IntentFilter(Intent.ACTION_EXTERNAL_APPLICATIONS_AVAILABLE);
+        userAllContext.registerReceiver(mExternalAppIntentReceiver, externalIntentFilter,
+                null /* broadcastPermission */, mHandler);
+    }
+
+    /**
+     * Unregisters the broadcast receiver, stopping the listener from receiving further events.
+     * It's important to call this method when the listener is no longer needed to avoid
+     * potential resource leaks.
+     */
+    public void unregisterReceivers() {
+        try {
+            mContext.unregisterReceiver(mPackageIntentReceiver);
+            mContext.unregisterReceiver(mUserIntentReceiver);
+            mContext.unregisterReceiver(mExternalAppIntentReceiver);
+        } catch (IllegalArgumentException e) {
+            // Receiver was not registered
+        }
+    }
+
+    private final BroadcastReceiver mPackageIntentReceiver = new BroadcastReceiver() {
+        @Override
+        public void onReceive(Context context, Intent intent) {
+            HandlerUtils.ensureRunningOnHandlerThread(mHandler);
+
+            final int uid = intent.getIntExtra(Intent.EXTRA_UID, -1);
+            final Uri packageData = intent.getData();
+            // AOSP never sends null data in the intent (see
+            // BroadcastHelper#sendPostInstallBroadcasts)
+            // but OEMs may have modified this code.
+            if (packageData == null) {
+                Log.wtf(TAG, "Intent received with null data: " + intent);
+                return;
+            }
+            final String packageName = packageData.getSchemeSpecificPart();
+
+            switch (intent.getAction()) {
+                case Intent.ACTION_PACKAGE_ADDED: {
+                    mCallback.onPackageAdded(packageName, uid);
+                    break;
+                }
+                case Intent.ACTION_PACKAGE_REMOVED: {
+                    mCallback.onPackageRemoved(packageName, uid);
+                    break;
+                }
+                case Intent.ACTION_PACKAGE_REPLACED: {
+                    mCallback.onPackageReplaced(packageName, uid);
+                    break;
+                }
+                default:
+                    Log.wtf(TAG, "received unexpected intent: " + intent.getAction());
+            }
+        }
+    };
+
+    private final BroadcastReceiver mExternalAppIntentReceiver = new BroadcastReceiver() {
+        @Override
+        public void onReceive(Context context, Intent intent) {
+            HandlerUtils.ensureRunningOnHandlerThread(mHandler);
+            switch (intent.getAction()) {
+                case Intent.ACTION_EXTERNAL_APPLICATIONS_AVAILABLE: {
+                    final String[] pkgList =
+                            intent.getStringArrayExtra(Intent.EXTRA_CHANGED_PACKAGE_LIST);
+                    mCallback.onExternalApplicationsAvailable(pkgList);
+                    break;
+                }
+                default:
+                    Log.wtf(TAG, "received unexpected intent: " + intent.getAction());
+            }
+        }
+    };
+
+    private final BroadcastReceiver mUserIntentReceiver = new BroadcastReceiver() {
+        @Override
+        public void onReceive(Context context, Intent intent) {
+            HandlerUtils.ensureRunningOnHandlerThread(mHandler);
+            final String action = intent.getAction();
+            final UserHandle user = intent.getParcelableExtra(Intent.EXTRA_USER);
+
+            // User should be filled for below intents, check the existence.
+            if (user == null) {
+                Log.wtf(TAG, intent.getAction() + " broadcast without EXTRA_USER");
+                return;
+            }
+
+            if (Intent.ACTION_USER_ADDED.equals(action)) {
+                mCallback.onUserAdded(user);
+            } else if (Intent.ACTION_USER_REMOVED.equals(action)) {
+                mCallback.onUserRemoved(user);
+            }  else {
+                Log.wtf(TAG, "received unexpected intent: " + action);
+            }
+        }
+    };
+}
diff --git a/service/src/com/android/server/connectivity/PermissionMonitor.java b/service/src/com/android/server/connectivity/PermissionMonitor.java
index bb0ee83076..f055c5df08 100755
--- a/service/src/com/android/server/connectivity/PermissionMonitor.java
+++ b/service/src/com/android/server/connectivity/PermissionMonitor.java
@@ -42,10 +42,7 @@ import android.annotation.NonNull;
 import android.annotation.Nullable;
 import android.app.compat.CompatChanges;
 import android.content.AttributionSource;
-import android.content.BroadcastReceiver;
 import android.content.Context;
-import android.content.Intent;
-import android.content.IntentFilter;
 import android.content.pm.ApplicationInfo;
 import android.content.pm.PackageInfo;
 import android.content.pm.PackageManager;
@@ -164,49 +161,6 @@ public class PermissionMonitor {
     private static final int MAX_PERMISSION_UPDATE_LOGS = 40;
     private final SharedLog mPermissionUpdateLogs = new SharedLog(MAX_PERMISSION_UPDATE_LOGS, TAG);
 
-    private BroadcastReceiver mIntentReceiver = new BroadcastReceiver() {
-        @Override
-        public void onReceive(Context context, Intent intent) {
-            final String action = intent.getAction();
-
-            if (Intent.ACTION_PACKAGE_ADDED.equals(action)) {
-                final int uid = intent.getIntExtra(Intent.EXTRA_UID, -1);
-                final Uri packageData = intent.getData();
-                final String packageName =
-                        packageData != null ? packageData.getSchemeSpecificPart() : null;
-                onPackageAdded(packageName, uid);
-            } else if (Intent.ACTION_PACKAGE_REMOVED.equals(action)) {
-                final int uid = intent.getIntExtra(Intent.EXTRA_UID, -1);
-                final Uri packageData = intent.getData();
-                final String packageName =
-                        packageData != null ? packageData.getSchemeSpecificPart() : null;
-                onPackageRemoved(packageName, uid);
-            } else if (Intent.ACTION_EXTERNAL_APPLICATIONS_AVAILABLE.equals(action)) {
-                final String[] pkgList =
-                        intent.getStringArrayExtra(Intent.EXTRA_CHANGED_PACKAGE_LIST);
-                onExternalApplicationsAvailable(pkgList);
-            } else if (Intent.ACTION_USER_ADDED.equals(action)) {
-                final UserHandle user = intent.getParcelableExtra(Intent.EXTRA_USER);
-                // User should be filled for below intents, check the existence.
-                if (user == null) {
-                    Log.wtf(TAG, action + " broadcast without EXTRA_USER");
-                    return;
-                }
-                onUserAdded(user);
-            } else if (Intent.ACTION_USER_REMOVED.equals(action)) {
-                final UserHandle user = intent.getParcelableExtra(Intent.EXTRA_USER);
-                // User should be filled for below intents, check the existence.
-                if (user == null) {
-                    Log.wtf(TAG, action + " broadcast without EXTRA_USER");
-                    return;
-                }
-                onUserRemoved(user);
-            } else {
-                Log.wtf(TAG, "received unexpected intent: " + action);
-            }
-        }
-    };
-
     /**
      * Dependencies of PermissionMonitor, for injection in tests.
      */
@@ -462,28 +416,6 @@ public class PermissionMonitor {
 
         final Handler handler = new Handler(mThread.getLooper());
         final Context userAllContext = mContext.createContextAsUser(UserHandle.ALL, 0 /* flags */);
-        final IntentFilter intentFilter = new IntentFilter();
-        intentFilter.addAction(Intent.ACTION_PACKAGE_ADDED);
-        intentFilter.addAction(Intent.ACTION_PACKAGE_REMOVED);
-        intentFilter.addDataScheme("package");
-        userAllContext.registerReceiver(
-                mIntentReceiver, intentFilter, null /* broadcastPermission */, handler);
-
-        // Listen to EXTERNAL_APPLICATIONS_AVAILABLE is that an app becoming available means it may
-        // need to gain a permission. But an app that becomes unavailable can neither gain nor lose
-        // permissions on that account, it just can no longer run. Thus, doesn't need to listen to
-        // EXTERNAL_APPLICATIONS_UNAVAILABLE.
-        final IntentFilter externalIntentFilter =
-                new IntentFilter(Intent.ACTION_EXTERNAL_APPLICATIONS_AVAILABLE);
-        userAllContext.registerReceiver(
-                mIntentReceiver, externalIntentFilter, null /* broadcastPermission */, handler);
-
-        // Listen for user add/remove.
-        final IntentFilter userIntentFilter = new IntentFilter();
-        userIntentFilter.addAction(Intent.ACTION_USER_ADDED);
-        userIntentFilter.addAction(Intent.ACTION_USER_REMOVED);
-        userAllContext.registerReceiver(
-                mIntentReceiver, userIntentFilter, null /* broadcastPermission */, handler);
 
         // Register UIDS_ALLOWED_ON_RESTRICTED_NETWORKS setting observer
         mDeps.registerContentObserver(
@@ -625,8 +557,8 @@ public class PermissionMonitor {
      *
      * @hide
      */
-    @VisibleForTesting
-    synchronized void onUserAdded(@NonNull UserHandle user) {
+    public synchronized void onUserAdded(@NonNull UserHandle user) {
+        ensureRunningOnHandlerThread();
         mUsers.add(user);
 
         final List<PackageInfo> apps = getInstalledPackagesAsUser(user);
@@ -657,8 +589,8 @@ public class PermissionMonitor {
      *
      * @hide
      */
-    @VisibleForTesting
-    synchronized void onUserRemoved(@NonNull UserHandle user) {
+    public synchronized void onUserRemoved(@NonNull UserHandle user) {
+        ensureRunningOnHandlerThread();
         mUsers.remove(user);
 
         // Remove uids network permissions that belongs to the user.
@@ -843,8 +775,8 @@ public class PermissionMonitor {
      *
      * @hide
      */
-    @VisibleForTesting
-    synchronized void onPackageAdded(@NonNull final String packageName, final int uid) {
+    public synchronized void onPackageAdded(@NonNull final String packageName, final int uid) {
+        ensureRunningOnHandlerThread();
         // Update uid permission.
         updateAppIdTrafficPermission(uid);
         // Get the appId permission from all users then send the latest permission to netd.
@@ -908,8 +840,8 @@ public class PermissionMonitor {
      *
      * @hide
      */
-    @VisibleForTesting
-    synchronized void onPackageRemoved(@NonNull final String packageName, final int uid) {
+    public synchronized void onPackageRemoved(@NonNull final String packageName, final int uid) {
+        ensureRunningOnHandlerThread();
         // Update uid permission.
         updateAppIdTrafficPermission(uid);
         if (BpfNetMaps.isAtLeast25Q2()) {
@@ -1307,7 +1239,13 @@ public class PermissionMonitor {
                 + ", remove=" + removedUids);
     }
 
-    private synchronized void onExternalApplicationsAvailable(String[] pkgList) {
+    /**
+     * Called when external applications are available.
+     *
+     * @param pkgList The package names of the external applications.
+     */
+    public synchronized void onExternalApplicationsAvailable(String[] pkgList) {
+        ensureRunningOnHandlerThread();
         if (CollectionUtils.isEmpty(pkgList)) {
             Log.e(TAG, "No available external application.");
             return;
diff --git a/tests/unit/java/com/android/server/connectivity/BroadcastReceiveHelperTest.kt b/tests/unit/java/com/android/server/connectivity/BroadcastReceiveHelperTest.kt
new file mode 100644
index 0000000000..88370ed307
--- /dev/null
+++ b/tests/unit/java/com/android/server/connectivity/BroadcastReceiveHelperTest.kt
@@ -0,0 +1,284 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.server.connectivity
+
+import android.content.BroadcastReceiver
+import android.content.Context
+import android.content.Intent
+import android.content.Intent.ACTION_EXTERNAL_APPLICATIONS_AVAILABLE
+import android.content.Intent.ACTION_PACKAGE_ADDED
+import android.content.Intent.ACTION_PACKAGE_REMOVED
+import android.content.Intent.ACTION_PACKAGE_REPLACED
+import android.content.Intent.ACTION_USER_ADDED
+import android.content.Intent.ACTION_USER_REMOVED
+import android.content.Intent.EXTRA_CHANGED_PACKAGE_LIST
+import android.content.Intent.EXTRA_UID
+import android.content.Intent.EXTRA_USER
+import android.net.Uri
+import android.os.Handler
+import android.os.HandlerThread
+import android.os.UserHandle
+import com.android.compatibility.common.util.MoreMatchers.anyOrNull
+import com.android.server.connectivity.BroadcastReceiveHelper.Delegate
+import com.android.testutils.DevSdkIgnoreRunner
+import com.android.testutils.waitForIdle
+import org.junit.After
+import org.junit.Before
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.mockito.ArgumentCaptor
+import org.mockito.ArgumentMatchers.argThat
+import org.mockito.ArgumentMatchers.eq
+import org.mockito.Mockito.doReturn
+import org.mockito.Mockito.mock
+import org.mockito.Mockito.times
+import org.mockito.Mockito.verify
+
+private const val TEST_PACKAGE_NAME = "com.example.app"
+private const val TEST_UID = 1000
+private const val TIMEOUT_MS = 2000
+
+private inline fun <reified T> any() = org.mockito.Mockito.any(T::class.java)
+
+@DevSdkIgnoreRunner.MonitorThreadLeak
+@RunWith(DevSdkIgnoreRunner::class)
+class BroadcastReceiveHelperTest {
+
+    private val mockContext = mock(Context::class.java)
+    private val mockDelegate = mock(Delegate::class.java)
+
+    // Create an InOrder object to verify the sequence of delegate calls.
+    private val delegateInOrderVerifier = org.mockito.Mockito.inOrder(mockDelegate)
+
+    // lateinit is used here because thread and handler need to be initialized in the
+    // @Before setUp method.
+    private lateinit var handlerThread: HandlerThread
+    private lateinit var handler: Handler
+    private lateinit var broadcastReceiveHelper: BroadcastReceiveHelper
+    private lateinit var packageReceiver: BroadcastReceiver
+    private lateinit var externalAppReceiver: BroadcastReceiver
+    private lateinit var userReceiver: BroadcastReceiver
+
+    @Before
+    fun setUp() {
+        handlerThread = HandlerThread("TestThread")
+        handlerThread.start()
+        handler = Handler(handlerThread.looper)
+        broadcastReceiveHelper = BroadcastReceiveHelper(mockContext, handler, mockDelegate)
+
+        // Capture intent receivers.
+        doReturn(mockContext).`when`(mockContext).createContextAsUser(UserHandle.ALL, 0)
+        broadcastReceiveHelper.registerReceivers()
+        userReceiver = captureIntentReceiver(ACTION_USER_ADDED)
+        packageReceiver = captureIntentReceiver(ACTION_PACKAGE_ADDED)
+        externalAppReceiver = captureIntentReceiver(ACTION_EXTERNAL_APPLICATIONS_AVAILABLE)
+    }
+
+    private fun captureIntentReceiver(action: String): BroadcastReceiver {
+        val receiverCaptor = ArgumentCaptor.forClass(BroadcastReceiver::class.java)
+        verify(mockContext, times(1)).registerReceiver(
+                receiverCaptor.capture(),
+                argThat { it.hasAction(action) },
+                anyOrNull(String::class.java),
+                eq(handler)
+        )
+        // Return the first match.
+        return receiverCaptor.value
+    }
+
+    @After
+    fun tearDown() {
+        broadcastReceiveHelper.unregisterReceivers()
+        handlerThread.quitSafely()
+        handlerThread.join()
+    }
+
+    @Test
+    fun testPackageAdded() {
+        val intent = Intent(ACTION_PACKAGE_ADDED).apply {
+            data = Uri.fromParts("package", TEST_PACKAGE_NAME, null)
+            putExtra(EXTRA_UID, TEST_UID)
+        }
+        processOnHandlerThread { packageReceiver.onReceive(mockContext, intent) }
+        delegateInOrderVerifier.verify(mockDelegate).onPackageAdded(TEST_PACKAGE_NAME, TEST_UID)
+        delegateInOrderVerifier.verifyNoMoreInteractions()
+    }
+
+    @Test
+    fun testPackageRemoved() {
+        val intent = Intent(ACTION_PACKAGE_REMOVED).apply {
+            data = Uri.fromParts("package", TEST_PACKAGE_NAME, null)
+            putExtra(EXTRA_UID, TEST_UID)
+        }
+        processOnHandlerThread { packageReceiver.onReceive(mockContext, intent) }
+        delegateInOrderVerifier.verify(mockDelegate).onPackageRemoved(TEST_PACKAGE_NAME, TEST_UID)
+        delegateInOrderVerifier.verifyNoMoreInteractions()
+    }
+
+    @Test
+    fun testPackageReplaced() {
+        val intent = Intent(ACTION_PACKAGE_REPLACED).apply {
+            data = Uri.fromParts("package", TEST_PACKAGE_NAME, null)
+            putExtra(EXTRA_UID, TEST_UID)
+        }
+        processOnHandlerThread { packageReceiver.onReceive(mockContext, intent) }
+        delegateInOrderVerifier.verify(mockDelegate).onPackageReplaced(TEST_PACKAGE_NAME, TEST_UID)
+        delegateInOrderVerifier.verifyNoMoreInteractions()
+    }
+
+    @Test
+    fun testExternalAppsAvailable() {
+        val packageList = arrayOf("com.example.app1", "com.example.app2")
+        val intent = Intent(ACTION_EXTERNAL_APPLICATIONS_AVAILABLE).apply {
+            putExtra(EXTRA_CHANGED_PACKAGE_LIST, packageList)
+        }
+        processOnHandlerThread { externalAppReceiver.onReceive(mockContext, intent) }
+        delegateInOrderVerifier.verify(mockDelegate).onExternalApplicationsAvailable(packageList)
+        delegateInOrderVerifier.verifyNoMoreInteractions()
+    }
+
+    @Test
+    fun testUserAdded() {
+        val userHandle = mock(UserHandle::class.java)
+        val intent = Intent(ACTION_USER_ADDED).apply {
+            putExtra(EXTRA_USER, userHandle)
+        }
+        processOnHandlerThread { userReceiver.onReceive(mockContext, intent) }
+        delegateInOrderVerifier.verify(mockDelegate).onUserAdded(userHandle)
+        delegateInOrderVerifier.verifyNoMoreInteractions()
+    }
+
+    @Test
+    fun testUserRemoved() {
+        val userHandle = mock(UserHandle::class.java)
+        val intent = Intent(ACTION_USER_REMOVED).apply {
+            putExtra(EXTRA_USER, userHandle)
+        }
+        processOnHandlerThread { userReceiver.onReceive(mockContext, intent) }
+        delegateInOrderVerifier.verify(mockDelegate).onUserRemoved(userHandle)
+        delegateInOrderVerifier.verifyNoMoreInteractions()
+    }
+
+    @Test
+    fun testUnregisterReceivers() {
+        broadcastReceiveHelper.unregisterReceivers()
+        verify(mockContext).unregisterReceiver(userReceiver)
+        verify(mockContext).unregisterReceiver(packageReceiver)
+        verify(mockContext).unregisterReceiver(externalAppReceiver)
+    }
+
+    @Test
+    fun testBroadcastOrder() {
+        val numEvents = 50
+        val random = java.util.Random()
+        val eventList = mutableListOf<Intent>()
+
+        // Function to append a test package name extra.
+        fun Intent.withPackageNameForIndex(index: Int): Intent {
+            data = Uri.fromParts("package", "com.example.app$index", null)
+            putExtra(EXTRA_UID, index)
+            return this
+        }
+
+        // Function to append a mock UserHandle extra.
+        fun Intent.withUserHandleForIndex(index: Int): Intent {
+            putExtra(EXTRA_USER, UserHandle.of(index))
+            return this
+        }
+
+        // Generate a list of 50 random actions and their corresponding intents.
+        repeat(numEvents) { index ->
+            val intent = when (random.nextInt(6)) {
+                0 -> Intent(ACTION_PACKAGE_ADDED).withPackageNameForIndex(index)
+                1 -> Intent(ACTION_PACKAGE_REMOVED).withPackageNameForIndex(index)
+                2 -> Intent(ACTION_PACKAGE_REPLACED).withPackageNameForIndex(index)
+                3 -> Intent(ACTION_EXTERNAL_APPLICATIONS_AVAILABLE).apply {
+                    val packageList = arrayOf("com.example.app$index")
+                    putExtra(EXTRA_CHANGED_PACKAGE_LIST, packageList)
+                }
+
+                4 -> Intent(ACTION_USER_ADDED).withUserHandleForIndex(index)
+                5 -> Intent(ACTION_USER_REMOVED).withUserHandleForIndex(index)
+
+                else -> throw IllegalStateException("Unexpected random number")
+            }
+            eventList.add(intent)
+        }
+
+        // Post all intents to the handler thread at once.
+        eventList.forEach {
+            handler.post {
+                when (it.action) {
+                    ACTION_PACKAGE_ADDED, ACTION_PACKAGE_REMOVED, ACTION_PACKAGE_REPLACED ->
+                        packageReceiver.onReceive(mockContext, it)
+
+                    ACTION_EXTERNAL_APPLICATIONS_AVAILABLE ->
+                        externalAppReceiver.onReceive(mockContext, it)
+
+                    ACTION_USER_ADDED, ACTION_USER_REMOVED ->
+                        userReceiver.onReceive(mockContext, it)
+                }
+            }
+        }
+
+        // Wait for all intents to be processed at once.
+        handler.waitForIdle(TIMEOUT_MS)
+
+        // Verify the order of delegate calls.
+        eventList.forEach {
+            when (it.action) {
+                ACTION_PACKAGE_ADDED -> delegateInOrderVerifier.verify(mockDelegate)
+                        .onPackageAdded(
+                                it.data?.schemeSpecificPart!!,
+                                it.getIntExtra(EXTRA_UID, -1)
+                        )
+
+                ACTION_PACKAGE_REMOVED -> delegateInOrderVerifier.verify(mockDelegate)
+                        .onPackageRemoved(
+                                it.data?.schemeSpecificPart!!,
+                                it.getIntExtra(EXTRA_UID, -1)
+                        )
+
+                ACTION_PACKAGE_REPLACED -> delegateInOrderVerifier.verify(mockDelegate)
+                        .onPackageReplaced(
+                                it.data?.schemeSpecificPart!!,
+                                it.getIntExtra(EXTRA_UID, -1)
+                        )
+
+                ACTION_EXTERNAL_APPLICATIONS_AVAILABLE ->
+                    delegateInOrderVerifier.verify(mockDelegate)
+                            .onExternalApplicationsAvailable(it.getStringArrayExtra(
+                                    EXTRA_CHANGED_PACKAGE_LIST
+                            )!!)
+
+                ACTION_USER_ADDED -> delegateInOrderVerifier.verify(mockDelegate)
+                        .onUserAdded(it.getParcelableExtra(EXTRA_USER)!!)
+
+                ACTION_USER_REMOVED -> delegateInOrderVerifier.verify(mockDelegate)
+                        .onUserRemoved(it.getParcelableExtra(EXTRA_USER)!!)
+            }
+        }
+
+        // Ensure no other calls were made to the delegate.
+        delegateInOrderVerifier.verifyNoMoreInteractions()
+    }
+
+    private fun processOnHandlerThread(function: Runnable) {
+        handler.post { function.run() }
+        handler.waitForIdle(HANDLER_TIMEOUT_MS)
+    }
+}
diff --git a/tests/unit/java/com/android/server/connectivity/PermissionMonitorTest.java b/tests/unit/java/com/android/server/connectivity/PermissionMonitorTest.java
index ec9c6b0e48..3d474dfd82 100644
--- a/tests/unit/java/com/android/server/connectivity/PermissionMonitorTest.java
+++ b/tests/unit/java/com/android/server/connectivity/PermissionMonitorTest.java
@@ -47,7 +47,6 @@ import static android.permission.PermissionManager.PERMISSION_GRANTED;
 
 import static com.android.server.connectivity.PermissionMonitor.isHigherNetworkPermission;
 import static com.android.testutils.TestPermissionUtil.runAsShell;
-import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo;
 
 import static junit.framework.Assert.fail;
 
@@ -76,9 +75,7 @@ import static org.mockito.Mockito.when;
 
 import android.compat.testing.PlatformCompatChangeRule;
 import android.content.AttributionSource;
-import android.content.BroadcastReceiver;
 import android.content.Context;
-import android.content.Intent;
 import android.content.pm.ApplicationInfo;
 import android.content.pm.PackageInfo;
 import android.content.pm.PackageManager;
@@ -109,6 +106,7 @@ import com.android.networkstack.apishim.ProcessShimImpl;
 import com.android.networkstack.apishim.common.ProcessShim;
 import com.android.server.BpfNetMaps;
 import com.android.testutils.DevSdkIgnoreRule;
+import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo;
 import com.android.testutils.DevSdkIgnoreRunner;
 import com.android.testutils.HandlerUtils;
 
@@ -361,6 +359,10 @@ public class PermissionMonitorTest {
         processOnHandlerThread(() -> mPermissionMonitor.onPackageRemoved(packageName, uid));
     }
 
+    private void onExternalApplicationsAvailable(String [] pkgList) {
+        processOnHandlerThread(() -> mPermissionMonitor.onExternalApplicationsAvailable(pkgList));
+    }
+
     private void sendAppIdsTrafficPermission(SparseIntArray netdPermissionsAppIds) {
         processOnHandlerThread(() ->
                 mPermissionMonitor.sendAppIdsTrafficPermission(netdPermissionsAppIds));
@@ -1433,27 +1435,6 @@ public class PermissionMonitorTest {
         mBpfMapMonitor.expectTrafficPerm(PERMISSION_TRAFFIC_ALL, MOCK_APPID2);
     }
 
-    private BroadcastReceiver expectBroadcastReceiver(String... actions) {
-        final ArgumentCaptor<BroadcastReceiver> receiverCaptor =
-                ArgumentCaptor.forClass(BroadcastReceiver.class);
-        verify(mContext, times(1)).registerReceiver(receiverCaptor.capture(),
-                argThat(filter -> {
-                    for (String action : actions) {
-                        if (!filter.hasAction(action)) {
-                            return false;
-                        }
-                    }
-                    return true;
-                }), any(), any());
-        final BroadcastReceiver originalReceiver = receiverCaptor.getValue();
-        return new BroadcastReceiver() {
-            @Override
-            public void onReceive(Context context, Intent intent) {
-                processOnHandlerThread(() -> originalReceiver.onReceive(context, intent));
-            }
-        };
-    }
-
     private void processOnHandlerThread(Runnable function) {
         final Handler handler = mHandlerThread.getThreadHandler();
         handler.post(() -> function.run());
@@ -1462,26 +1443,13 @@ public class PermissionMonitorTest {
 
     @Test
     @EnableCompatChanges(RESTRICT_LOCAL_NETWORK)
-    public void testIntentReceiver() throws Exception {
+    public void testUidPermissionWhenPackageAddedRemoved() throws Exception {
         startMonitoring();
-        final BroadcastReceiver receiver = expectBroadcastReceiver(
-                Intent.ACTION_PACKAGE_ADDED, Intent.ACTION_PACKAGE_REMOVED);
 
-        // Verify receiving PACKAGE_ADDED intent.
-        final Intent addedIntent = new Intent(Intent.ACTION_PACKAGE_ADDED,
-                Uri.fromParts("package", MOCK_PACKAGE1, null /* fragment */));
-        addedIntent.putExtra(Intent.EXTRA_UID, MOCK_UID11);
-        buildAndMockPackageInfoWithPermissions(MOCK_PACKAGE1, MOCK_UID11, INTERNET,
-                UPDATE_DEVICE_STATS);
-        receiver.onReceive(mContext, addedIntent);
+        // Add/Remove package and verify uid permissions.
+        addPackage(MOCK_PACKAGE1, MOCK_UID11, INTERNET, UPDATE_DEVICE_STATS);
         mBpfMapMonitor.expectTrafficPerm(PERMISSION_TRAFFIC_ALL, MOCK_APPID1);
-
-        // Verify receiving PACKAGE_REMOVED intent.
-        when(mPackageManager.getPackagesForUid(MOCK_UID11)).thenReturn(new String[]{});
-        final Intent removedIntent = new Intent(Intent.ACTION_PACKAGE_REMOVED,
-                Uri.fromParts("package", MOCK_PACKAGE1, null /* fragment */));
-        removedIntent.putExtra(Intent.EXTRA_UID, MOCK_UID11);
-        receiver.onReceive(mContext, removedIntent);
+        removePackage(MOCK_PACKAGE1, MOCK_UID11);
         mBpfMapMonitor.expectTrafficPerm(PERMISSION_UNINSTALLED, MOCK_APPID1);
     }
 
@@ -1634,17 +1602,12 @@ public class PermissionMonitorTest {
         mNetdMonitor.expectNoNetworkPerm(new UserHandle[]{MOCK_USER1}, MOCK_APPID1, MOCK_APPID2);
         mBpfMapMonitor.expectTrafficPerm(PERMISSION_NONE, MOCK_APPID1, MOCK_APPID2);
 
-        final BroadcastReceiver receiver = expectBroadcastReceiver(
-                Intent.ACTION_EXTERNAL_APPLICATIONS_AVAILABLE);
-        // Verify receiving EXTERNAL_APPLICATIONS_AVAILABLE intent and update permission to netd.
-        final Intent externalIntent = new Intent(Intent.ACTION_EXTERNAL_APPLICATIONS_AVAILABLE);
-        externalIntent.putExtra(Intent.EXTRA_CHANGED_PACKAGE_LIST,
-                new String[] { MOCK_PACKAGE1 , MOCK_PACKAGE2});
+        // Call onExternalApplicationsAvailable and verify update permission to netd.
         buildAndMockPackageInfoWithPermissions(MOCK_PACKAGE1, MOCK_UID11,
                 CONNECTIVITY_USE_RESTRICTED_NETWORKS, INTERNET);
         buildAndMockPackageInfoWithPermissions(MOCK_PACKAGE2, MOCK_UID12, CHANGE_NETWORK_STATE,
                 UPDATE_DEVICE_STATS);
-        receiver.onReceive(mContext, externalIntent);
+        onExternalApplicationsAvailable(new String[] { MOCK_PACKAGE1 , MOCK_PACKAGE2});
         mNetdMonitor.expectNetworkPerm(PERMISSION_SYSTEM, new UserHandle[]{MOCK_USER1},
                 MOCK_APPID1);
         mNetdMonitor.expectNetworkPerm(PERMISSION_NETWORK, new UserHandle[]{MOCK_USER1},
@@ -1658,8 +1621,6 @@ public class PermissionMonitorTest {
     public void testOnExternalApplicationsAvailable_AppsNotRegisteredOnStartMonitoring()
             throws Exception {
         startMonitoring();
-        final BroadcastReceiver receiver = expectBroadcastReceiver(
-                Intent.ACTION_EXTERNAL_APPLICATIONS_AVAILABLE);
 
         // Initial the permission state. MOCK_PACKAGE1 and MOCK_PACKAGE2 are installed on external
         // and have different uids. There has no permission for both uids.
@@ -1668,11 +1629,8 @@ public class PermissionMonitorTest {
         buildAndMockPackageInfoWithPermissions(MOCK_PACKAGE2, MOCK_UID12, CHANGE_NETWORK_STATE,
                 UPDATE_DEVICE_STATS);
 
-        // Verify receiving EXTERNAL_APPLICATIONS_AVAILABLE intent and update permission to netd.
-        final Intent externalIntent = new Intent(Intent.ACTION_EXTERNAL_APPLICATIONS_AVAILABLE);
-        externalIntent.putExtra(Intent.EXTRA_CHANGED_PACKAGE_LIST,
-                new String[] { MOCK_PACKAGE1 , MOCK_PACKAGE2});
-        receiver.onReceive(mContext, externalIntent);
+        // Call onExternalApplicationsAvailable and verify update permission to netd.
+        onExternalApplicationsAvailable(new String[] { MOCK_PACKAGE1 , MOCK_PACKAGE2});
         mNetdMonitor.expectNetworkPerm(PERMISSION_SYSTEM, new UserHandle[]{MOCK_USER1},
                 MOCK_APPID1);
         mNetdMonitor.expectNetworkPerm(PERMISSION_NETWORK, new UserHandle[]{MOCK_USER1},
@@ -1695,14 +1653,10 @@ public class PermissionMonitorTest {
         mNetdMonitor.expectNoNetworkPerm(new UserHandle[]{MOCK_USER1}, MOCK_APPID1);
         mBpfMapMonitor.expectTrafficPerm(PERMISSION_NONE, MOCK_APPID1);
 
-        final BroadcastReceiver receiver = expectBroadcastReceiver(
-                Intent.ACTION_EXTERNAL_APPLICATIONS_AVAILABLE);
-        // Verify receiving EXTERNAL_APPLICATIONS_AVAILABLE intent and update permission to netd.
-        final Intent externalIntent = new Intent(Intent.ACTION_EXTERNAL_APPLICATIONS_AVAILABLE);
-        externalIntent.putExtra(Intent.EXTRA_CHANGED_PACKAGE_LIST, new String[] {MOCK_PACKAGE1});
+        // Call onExternalApplicationsAvailable and verify update permission to netd.
         buildAndMockPackageInfoWithPermissions(MOCK_PACKAGE1, MOCK_UID11, CHANGE_NETWORK_STATE);
         buildAndMockPackageInfoWithPermissions(MOCK_PACKAGE2, MOCK_UID11, UPDATE_DEVICE_STATS);
-        receiver.onReceive(mContext, externalIntent);
+        onExternalApplicationsAvailable(new String[] {MOCK_PACKAGE1});
         mNetdMonitor.expectNetworkPerm(PERMISSION_NETWORK, new UserHandle[]{MOCK_USER1},
                 MOCK_APPID1);
         mBpfMapMonitor.expectTrafficPerm(PERMISSION_UPDATE_DEVICE_STATS, MOCK_APPID1);
@@ -1724,16 +1678,12 @@ public class PermissionMonitorTest {
                 MOCK_APPID1);
         mBpfMapMonitor.expectTrafficPerm(PERMISSION_INTERNET, MOCK_APPID1);
 
-        final BroadcastReceiver receiver = expectBroadcastReceiver(
-                Intent.ACTION_EXTERNAL_APPLICATIONS_AVAILABLE);
-        // Verify receiving EXTERNAL_APPLICATIONS_AVAILABLE intent and update permission to netd.
-        final Intent externalIntent = new Intent(Intent.ACTION_EXTERNAL_APPLICATIONS_AVAILABLE);
-        externalIntent.putExtra(Intent.EXTRA_CHANGED_PACKAGE_LIST, new String[] {MOCK_PACKAGE1});
+        // Call onExternalApplicationsAvailable and verify update permission to netd.
         buildAndMockPackageInfoWithPermissions(MOCK_PACKAGE1, MOCK_UID11,
                 CONNECTIVITY_USE_RESTRICTED_NETWORKS, UPDATE_DEVICE_STATS);
         buildAndMockPackageInfoWithPermissions(MOCK_PACKAGE2, MOCK_UID11, CHANGE_NETWORK_STATE,
                 INTERNET);
-        receiver.onReceive(mContext, externalIntent);
+        onExternalApplicationsAvailable(new String[] {MOCK_PACKAGE1});
         mNetdMonitor.expectNetworkPerm(PERMISSION_SYSTEM, new UserHandle[]{MOCK_USER1},
                 MOCK_APPID1);
         mBpfMapMonitor.expectTrafficPerm(PERMISSION_TRAFFIC_ALL, MOCK_APPID1);

From b14633ea2fad1375d87e7e861020141d83088589 Mon Sep 17 00:00:00 2001
From: Junyu Lai <junyulai@google.com>
Date: Wed, 16 Apr 2025 14:03:08 +0800
Subject: [PATCH 152/377] Move user intent reception out of
 SatelliteAccessController

This is a no-op refactoring that moves the reception of
user-related intents in SatelliteAccessController to
ConnectivityService.
It then dispatches these events to the SatelliteAccessController.

Flag: EXEMPT refactor
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.connectivity.SatelliteAccessControllerTest \
  ConnectivityCoverageTests:android.net.connectivity.com.android.server.ConnectivityServiceTest
Bug: 410731080
Change-Id: I9ace3ed09a161446dc92d40bc0d400e32051de32
---
 .../android/server/ConnectivityService.java   |  3 ++
 .../connectivity/PermissionMonitor.java       | 18 ++---------
 .../SatelliteAccessController.java            | 30 ++++++-------------
 .../SatelliteAccessControllerTest.kt          | 29 +++++++-----------
 4 files changed, 24 insertions(+), 56 deletions(-)

diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index 218e8f9b6e..4a3f155c1c 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -7731,6 +7731,9 @@ public class ConnectivityService extends IConnectivityManager.Stub
             handleSetOemNetworkPreference(mOemNetworkPreferences, null);
         }
         mPermissionMonitor.onUserRemoved(user);
+        if (mSatelliteAccessController != null) {
+            mSatelliteAccessController.onUserRemoved(user);
+        }
     }
 
     @Override
diff --git a/service/src/com/android/server/connectivity/PermissionMonitor.java b/service/src/com/android/server/connectivity/PermissionMonitor.java
index f055c5df08..f11888c628 100755
--- a/service/src/com/android/server/connectivity/PermissionMonitor.java
+++ b/service/src/com/android/server/connectivity/PermissionMonitor.java
@@ -87,8 +87,6 @@ import java.util.Set;
 /**
  * A utility class to inform Netd of UID permissions.
  * Does a mass update at boot and then monitors for app install/remove.
- *
- * @hide
  */
 public class PermissionMonitor {
     private static final String TAG = "PermissionMonitor";
@@ -553,9 +551,7 @@ public class PermissionMonitor {
     /**
      * Called when a user is added. See {link #ACTION_USER_ADDED}.
      *
-     * @param user The integer userHandle of the added user. See {@link #EXTRA_USER_HANDLE}.
-     *
-     * @hide
+     * @param user The userHandle of the added user. See {@link #EXTRA_USER_HANDLE}.
      */
     public synchronized void onUserAdded(@NonNull UserHandle user) {
         ensureRunningOnHandlerThread();
@@ -585,9 +581,7 @@ public class PermissionMonitor {
     /**
      * Called when an user is removed. See {link #ACTION_USER_REMOVED}.
      *
-     * @param user The integer userHandle of the removed user. See {@link #EXTRA_USER_HANDLE}.
-     *
-     * @hide
+     * @param user The userHandle of the removed user. See {@link #EXTRA_USER_HANDLE}.
      */
     public synchronized void onUserRemoved(@NonNull UserHandle user) {
         ensureRunningOnHandlerThread();
@@ -772,8 +766,6 @@ public class PermissionMonitor {
      *
      * @param packageName The name of the new package.
      * @param uid The uid of the new package.
-     *
-     * @hide
      */
     public synchronized void onPackageAdded(@NonNull final String packageName, final int uid) {
         ensureRunningOnHandlerThread();
@@ -837,8 +829,6 @@ public class PermissionMonitor {
      *
      * @param packageName The name of the removed package or null.
      * @param uid containing the integer uid previously assigned to the package.
-     *
-     * @hide
      */
     public synchronized void onPackageRemoved(@NonNull final String packageName, final int uid) {
         ensureRunningOnHandlerThread();
@@ -1117,8 +1107,6 @@ public class PermissionMonitor {
      *
      * @param appId the appId of the package installed
      * @param permissions the permissions the app requested and netd cares about.
-     *
-     * @hide
      */
     @VisibleForTesting
     void sendPackagePermissionsForAppId(int appId, int permissions) {
@@ -1136,8 +1124,6 @@ public class PermissionMonitor {
      *
      * @param netdPermissionsAppIds integer pairs of appIds and the permission granted to it. If the
      * permission is 0, revoke all permissions of that appId.
-     *
-     * @hide
      */
     @VisibleForTesting
     void sendAppIdsTrafficPermission(SparseIntArray netdPermissionsAppIds) {
diff --git a/service/src/com/android/server/connectivity/SatelliteAccessController.java b/service/src/com/android/server/connectivity/SatelliteAccessController.java
index 2cdc932a12..65993909a1 100644
--- a/service/src/com/android/server/connectivity/SatelliteAccessController.java
+++ b/service/src/com/android/server/connectivity/SatelliteAccessController.java
@@ -20,10 +20,7 @@ import android.Manifest;
 import android.annotation.NonNull;
 import android.app.role.OnRoleHoldersChangedListener;
 import android.app.role.RoleManager;
-import android.content.BroadcastReceiver;
 import android.content.Context;
-import android.content.Intent;
-import android.content.IntentFilter;
 import android.content.pm.ApplicationInfo;
 import android.content.pm.PackageManager;
 import android.os.Handler;
@@ -45,7 +42,6 @@ import java.util.function.Consumer;
  * Tracks the uid of all the default messaging application which are role_sms role and
  * satellite_communication permission complaint and requests ConnectivityService to create multi
  * layer request with satellite internet access support for the default message application.
- * @hide
  */
 public class SatelliteAccessController {
     private static final String TAG = SatelliteAccessController.class.getSimpleName();
@@ -217,23 +213,6 @@ public class SatelliteAccessController {
 
         // register sms OnRoleHoldersChangedListener
         mDefaultMessageRoleListener.register();
-
-        // Monitor for User removal intent, to update satellite fallback uids.
-        IntentFilter userRemovedFilter = new IntentFilter(Intent.ACTION_USER_REMOVED);
-        mContext.registerReceiver(new BroadcastReceiver() {
-            @Override
-            public void onReceive(Context context, Intent intent) {
-                final String action = intent.getAction();
-                if (Intent.ACTION_USER_REMOVED.equals(action)) {
-                    final UserHandle userHandle = intent.getParcelableExtra(Intent.EXTRA_USER);
-                    if (userHandle == null) return;
-                    updateSatelliteFallbackUidListOnUserRemoval(userHandle.getIdentifier());
-                } else {
-                    Log.wtf(TAG, "received unexpected intent: " + action);
-                }
-            }
-        }, userRemovedFilter, null, mConnectivityServiceHandler);
-
     }
 
     private void updateAllUserRoleSmsUids() {
@@ -249,6 +228,15 @@ public class SatelliteAccessController {
         }
     }
 
+    /**
+     * Called when a user is removed. See {link #ACTION_USER_REMOVED}.
+     *
+     * @param userHandle The userHandle of the removed user. See {@link #EXTRA_USER_HANDLE}.
+     */
+    public void onUserRemoved(@NonNull UserHandle userHandle) {
+        updateSatelliteFallbackUidListOnUserRemoval(userHandle.getIdentifier());
+    }
+
     private void updateSatelliteFallbackUidListOnUserRemoval(int userIdRemoved) {
         Log.i(TAG, "user id removed:" + userIdRemoved);
         if (mAllUsersSatelliteNetworkFallbackUidCache.contains(userIdRemoved)) {
diff --git a/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt b/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt
index 788532565f..f5d1ddddb9 100644
--- a/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt
+++ b/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt
@@ -18,10 +18,7 @@ package com.android.server.connectivity
 import android.Manifest
 import android.app.role.OnRoleHoldersChangedListener
 import android.app.role.RoleManager
-import android.content.BroadcastReceiver
 import android.content.Context
-import android.content.Intent
-import android.content.IntentFilter
 import android.content.pm.ApplicationInfo
 import android.content.pm.PackageManager
 import android.os.Build
@@ -32,6 +29,7 @@ import android.os.UserManager
 import android.util.ArraySet
 import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
 import com.android.testutils.DevSdkIgnoreRunner
+import java.util.concurrent.CompletableFuture
 import java.util.concurrent.Executor
 import java.util.function.Consumer
 import org.junit.Before
@@ -41,7 +39,6 @@ import org.mockito.ArgumentCaptor
 import org.mockito.ArgumentMatchers.any
 import org.mockito.ArgumentMatchers.anyInt
 import org.mockito.ArgumentMatchers.eq
-import org.mockito.ArgumentMatchers.isNull
 import org.mockito.Mockito.doReturn
 import org.mockito.Mockito.mock
 import org.mockito.Mockito.never
@@ -87,7 +84,6 @@ class SatelliteAccessControllerTest {
     private var mSatelliteAccessController =
         SatelliteAccessController(context, mDeps, mCallback, mHandler)
     private lateinit var mRoleHolderChangedListener: OnRoleHoldersChangedListener
-    private lateinit var mUserRemovedReceiver: BroadcastReceiver
 
     private fun <T> mockService(name: String, clazz: Class<T>, service: T) {
         doReturn(name).`when`(context).getSystemServiceName(clazz)
@@ -290,13 +286,18 @@ class SatelliteAccessControllerTest {
         )
         mRoleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, SECONDARY_USER_HANDLE)
         verify(mCallback).accept(setOf(PRIMARY_USER_SMS_APP_UID2, SECONDARY_USER_SMS_APP_UID1))
-
-        val userRemovalIntent = Intent(Intent.ACTION_USER_REMOVED)
-        userRemovalIntent.putExtra(Intent.EXTRA_USER, SECONDARY_USER_HANDLE)
-        mUserRemovedReceiver.onReceive(context, userRemovalIntent)
+        processOnHandlerThread {
+            mSatelliteAccessController.onUserRemoved(SECONDARY_USER_HANDLE)
+        }
         verify(mCallback, times(2)).accept(setOf(PRIMARY_USER_SMS_APP_UID2))
     }
 
+    private fun <T : Any> processOnHandlerThread(function: () -> T): T {
+        val future = CompletableFuture<T>()
+        mHandler.post { future.complete(function()) }
+        return future.get()
+    }
+
     @Test
     fun testOnStartUpCallbackSatelliteFallbackUidWithExistingUsers() {
         doReturn(
@@ -320,15 +321,5 @@ class SatelliteAccessControllerTest {
             any(UserHandle::class.java)
         )
         mRoleHolderChangedListener = listenerCaptor.value
-
-        // Get registered receiver using captor
-        val userRemovedReceiverCaptor = ArgumentCaptor.forClass(BroadcastReceiver::class.java)
-        verify(context).registerReceiver(
-            userRemovedReceiverCaptor.capture(),
-            any(IntentFilter::class.java),
-            isNull(),
-            any(Handler::class.java)
-        )
-         mUserRemovedReceiver = userRemovedReceiverCaptor.value
     }
 }

From 244f3e3df2dcdfef07619a8990236de6cf987cc3 Mon Sep 17 00:00:00 2001
From: Junyu Lai <junyulai@google.com>
Date: Wed, 23 Apr 2025 15:16:26 +0800
Subject: [PATCH 153/377] Add light-weight DefferedBroadcastReceiver for
 handling broadcast events

This commit introduces the DeferredBroadcastReceiver class, which
defers received Intent handling using a Handler. It prevents
Application Not Responding (ANR) errors by offloading potentially
time-consuming or blocking operations triggered by broadcast
event handling, even if `onReceive` takes a long time on the
handler thread.

Flag: EXEMPT refactor
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.connectivity.PermissionMonitorTest \
      ConnectivityCoverageTests:android.net.connectivity.com.android.server.ConnectivityServiceTest \
      ConnectivityCoverageTests:android.net.connectivity.com.android.server.connectivity.BroadcastReceiveHelperTest \
      --update-device
Bug: 410731080
Change-Id: Id6191d5ad9ae9f17fca3236110573340aa713048
---
 .../connectivity/BroadcastReceiveHelper.java  | 163 ++++++++++--------
 .../BroadcastReceiveHelperTest.kt             |   3 +
 2 files changed, 96 insertions(+), 70 deletions(-)

diff --git a/service/src/com/android/server/connectivity/BroadcastReceiveHelper.java b/service/src/com/android/server/connectivity/BroadcastReceiveHelper.java
index fe430437f1..7df29ea8ee 100644
--- a/service/src/com/android/server/connectivity/BroadcastReceiveHelper.java
+++ b/service/src/com/android/server/connectivity/BroadcastReceiveHelper.java
@@ -29,6 +29,8 @@ import android.util.Log;
 
 import com.android.net.module.util.HandlerUtils;
 
+import java.util.function.Consumer;
+
 /**
  * Helper class for ConnectivityService to listen for broadcast intents and
  * provide callbacks on a given {@link HandlerThread}.
@@ -38,6 +40,9 @@ public class BroadcastReceiveHelper {
     private final Context mContext;
     private final Handler mHandler;
     private final Delegate mCallback;
+    private final DeferredBroadcastReceiver mPackageIntentReceiver;
+    private final DeferredBroadcastReceiver mUserIntentReceiver;
+    private final DeferredBroadcastReceiver mExternalAppIntentReceiver;
 
     /**
      * Interface defining the callback methods for package and user related events.
@@ -98,9 +103,13 @@ public class BroadcastReceiveHelper {
      */
     public BroadcastReceiveHelper(@NonNull Context context,
             @NonNull final Handler handler, @NonNull Delegate callback) {
-        this.mContext = context;
-        this.mHandler = handler;
-        this.mCallback = callback;
+        mContext = context;
+        mHandler = handler;
+        mCallback = callback;
+        mPackageIntentReceiver = new DeferredBroadcastReceiver(mHandler, this::handlePackageIntent);
+        mExternalAppIntentReceiver =
+                new DeferredBroadcastReceiver(mHandler, this::handleExternalAppIntent);
+        mUserIntentReceiver = new DeferredBroadcastReceiver(mHandler, this::handleUserIntent);
     }
 
     /**
@@ -112,7 +121,6 @@ public class BroadcastReceiveHelper {
         final Context userAllContext = mContext.createContextAsUser(UserHandle.ALL, 0 /* flags */);
 
         // Listen to user events.
-        // TODO: Receive intents inline and post them to the handler.
         final IntentFilter userIntentFilter = new IntentFilter();
         userIntentFilter.addAction(Intent.ACTION_USER_ADDED);
         userIntentFilter.addAction(Intent.ACTION_USER_REMOVED);
@@ -153,78 +161,93 @@ public class BroadcastReceiveHelper {
         }
     }
 
-    private final BroadcastReceiver mPackageIntentReceiver = new BroadcastReceiver() {
-        @Override
-        public void onReceive(Context context, Intent intent) {
-            HandlerUtils.ensureRunningOnHandlerThread(mHandler);
+    /**
+     * A light-weighted {@link BroadcastReceiver} that dispatches the
+     * received {@link Intent} handling using a {@link Handler}.
+     *
+     * <p>This class is for offloading potentially time-consuming or blocking
+     * operations triggered by broadcast events, preventing Application Not Responding
+     * (ANR) errors.</p>
+     */
+    private static class DeferredBroadcastReceiver extends BroadcastReceiver {
+        private final Handler mHandler;
+        private final Consumer<Intent> mIntentConsumer;
 
-            final int uid = intent.getIntExtra(Intent.EXTRA_UID, -1);
-            final Uri packageData = intent.getData();
-            // AOSP never sends null data in the intent (see
-            // BroadcastHelper#sendPostInstallBroadcasts)
-            // but OEMs may have modified this code.
-            if (packageData == null) {
-                Log.wtf(TAG, "Intent received with null data: " + intent);
-                return;
-            }
-            final String packageName = packageData.getSchemeSpecificPart();
-
-            switch (intent.getAction()) {
-                case Intent.ACTION_PACKAGE_ADDED: {
-                    mCallback.onPackageAdded(packageName, uid);
-                    break;
-                }
-                case Intent.ACTION_PACKAGE_REMOVED: {
-                    mCallback.onPackageRemoved(packageName, uid);
-                    break;
-                }
-                case Intent.ACTION_PACKAGE_REPLACED: {
-                    mCallback.onPackageReplaced(packageName, uid);
-                    break;
-                }
-                default:
-                    Log.wtf(TAG, "received unexpected intent: " + intent.getAction());
-            }
+        DeferredBroadcastReceiver(@NonNull Handler handler,
+                @NonNull Consumer<Intent> intentConsumer) {
+            mHandler = handler;
+            mIntentConsumer = intentConsumer;
         }
-    };
 
-    private final BroadcastReceiver mExternalAppIntentReceiver = new BroadcastReceiver() {
         @Override
-        public void onReceive(Context context, Intent intent) {
+        public void onReceive(Context context, @NonNull Intent intent) {
             HandlerUtils.ensureRunningOnHandlerThread(mHandler);
-            switch (intent.getAction()) {
-                case Intent.ACTION_EXTERNAL_APPLICATIONS_AVAILABLE: {
-                    final String[] pkgList =
-                            intent.getStringArrayExtra(Intent.EXTRA_CHANGED_PACKAGE_LIST);
-                    mCallback.onExternalApplicationsAvailable(pkgList);
-                    break;
-                }
-                default:
-                    Log.wtf(TAG, "received unexpected intent: " + intent.getAction());
-            }
+            mHandler.post(() -> mIntentConsumer.accept(intent));
         }
-    };
+    }
 
-    private final BroadcastReceiver mUserIntentReceiver = new BroadcastReceiver() {
-        @Override
-        public void onReceive(Context context, Intent intent) {
-            HandlerUtils.ensureRunningOnHandlerThread(mHandler);
-            final String action = intent.getAction();
-            final UserHandle user = intent.getParcelableExtra(Intent.EXTRA_USER);
-
-            // User should be filled for below intents, check the existence.
-            if (user == null) {
-                Log.wtf(TAG, intent.getAction() + " broadcast without EXTRA_USER");
-                return;
-            }
-
-            if (Intent.ACTION_USER_ADDED.equals(action)) {
-                mCallback.onUserAdded(user);
-            } else if (Intent.ACTION_USER_REMOVED.equals(action)) {
-                mCallback.onUserRemoved(user);
-            }  else {
-                Log.wtf(TAG, "received unexpected intent: " + action);
-            }
+    private void handlePackageIntent(Intent intent) {
+        HandlerUtils.ensureRunningOnHandlerThread(mHandler);
+        final int uid = intent.getIntExtra(Intent.EXTRA_UID, -1);
+        final Uri packageData = intent.getData();
+        // AOSP never sends null data in the intent (see
+        // BroadcastHelper#sendPostInstallBroadcasts)
+        // but OEMs may have modified this code.
+        if (packageData == null) {
+            Log.wtf(TAG, "Intent received with null data: " + intent);
+            return;
         }
-    };
+        final String packageName = packageData.getSchemeSpecificPart();
+
+        switch (intent.getAction()) {
+            case Intent.ACTION_PACKAGE_ADDED: {
+                mCallback.onPackageAdded(packageName, uid);
+                break;
+            }
+            case Intent.ACTION_PACKAGE_REMOVED: {
+                mCallback.onPackageRemoved(packageName, uid);
+                break;
+            }
+            case Intent.ACTION_PACKAGE_REPLACED: {
+                mCallback.onPackageReplaced(packageName, uid);
+                break;
+            }
+            default:
+                Log.wtf(TAG, "received unexpected intent: " + intent.getAction());
+        }
+    }
+
+    private void handleExternalAppIntent(Intent intent) {
+        HandlerUtils.ensureRunningOnHandlerThread(mHandler);
+        switch (intent.getAction()) {
+            case Intent.ACTION_EXTERNAL_APPLICATIONS_AVAILABLE: {
+                final String[] pkgList =
+                        intent.getStringArrayExtra(Intent.EXTRA_CHANGED_PACKAGE_LIST);
+                mCallback.onExternalApplicationsAvailable(pkgList);
+                break;
+            }
+            default:
+                Log.wtf(TAG, "received unexpected intent: " + intent.getAction());
+        }
+    }
+
+    private void handleUserIntent(Intent intent) {
+        HandlerUtils.ensureRunningOnHandlerThread(mHandler);
+        final String action = intent.getAction();
+        final UserHandle user = intent.getParcelableExtra(Intent.EXTRA_USER);
+
+        // User should be filled for below intents, check the existence.
+        if (user == null) {
+            Log.wtf(TAG, intent.getAction() + " broadcast without EXTRA_USER");
+            return;
+        }
+
+        if (Intent.ACTION_USER_ADDED.equals(action)) {
+            mCallback.onUserAdded(user);
+        } else if (Intent.ACTION_USER_REMOVED.equals(action)) {
+            mCallback.onUserRemoved(user);
+        }  else {
+            Log.wtf(TAG, "received unexpected intent: " + action);
+        }
+    }
 }
diff --git a/tests/unit/java/com/android/server/connectivity/BroadcastReceiveHelperTest.kt b/tests/unit/java/com/android/server/connectivity/BroadcastReceiveHelperTest.kt
index 88370ed307..e5efd34e71 100644
--- a/tests/unit/java/com/android/server/connectivity/BroadcastReceiveHelperTest.kt
+++ b/tests/unit/java/com/android/server/connectivity/BroadcastReceiveHelperTest.kt
@@ -279,6 +279,9 @@ class BroadcastReceiveHelperTest {
 
     private fun processOnHandlerThread(function: Runnable) {
         handler.post { function.run() }
+        // Wait twice since the onReceive defers actual handling logic to another message.
+        // See BroadcastReceiveHelper#HandlerPostReceiver.
+        handler.waitForIdle(HANDLER_TIMEOUT_MS)
         handler.waitForIdle(HANDLER_TIMEOUT_MS)
     }
 }

From 830b5790816069c0902078ae8ad563896936b6ed Mon Sep 17 00:00:00 2001
From: Junyu Lai <junyulai@google.com>
Date: Thu, 17 Apr 2025 15:23:36 +0800
Subject: [PATCH 154/377] Move package enumeration out of PermissionMonitor

The PackageManager#getInstallPackagesAsUser method is time
consuming (30~200ms) and blocks boot time while it executes.
This change moves the getInstallPackagesAsUser
method from PermissionMonitor. This is a performance-focused
refactoring to allow for efficient sharing of package enumeration
results in subsequent changes, avoiding redundant time-consuming
operations.

Flag: EXEMPT refactor
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.connectivity.SatelliteAccessControllerTest \
      ConnectivityCoverageTests: android.net.connectivity.com.android.server.ConnectivityServiceTest
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.connectivity.PermissionMonitorTest \
      ConnectivityCoverageTests:android.net.connectivity.com.android.server.connectivity.BroadcastReceiveHelperTest \
      --update-device
Bug: 410731080
Change-Id: I3929fa28ff9419329622f3abdf10336289730607
---
 .../android/server/ConnectivityService.java   |  21 +-
 .../connectivity/BroadcastReceiveHelper.java  |  25 +++
 .../connectivity/PermissionMonitor.java       |  32 +--
 .../BroadcastReceiveHelperTest.kt             |  21 +-
 .../connectivity/PermissionMonitorTest.java   | 207 ++++++++----------
 5 files changed, 172 insertions(+), 134 deletions(-)

diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index 4a3f155c1c..f1b701f25e 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -23,6 +23,7 @@ import static android.content.pm.PackageManager.FEATURE_LEANBACK;
 import static android.content.pm.PackageManager.FEATURE_WATCH;
 import static android.content.pm.PackageManager.FEATURE_WIFI;
 import static android.content.pm.PackageManager.FEATURE_WIFI_DIRECT;
+import static android.content.pm.PackageManager.GET_PERMISSIONS;
 import static android.content.pm.PackageManager.PERMISSION_GRANTED;
 import static android.net.BpfNetMapsConstants.METERED_ALLOW_CHAINS;
 import static android.net.BpfNetMapsConstants.METERED_DENY_CHAINS;
@@ -186,6 +187,7 @@ import android.content.ContentResolver;
 import android.content.Context;
 import android.content.Intent;
 import android.content.IntentFilter;
+import android.content.pm.PackageInfo;
 import android.content.pm.PackageManager;
 import android.content.res.XmlResourceParser;
 import android.database.ContentObserver;
@@ -4166,7 +4168,20 @@ public class ConnectivityService extends IConnectivityManager.Stub
         // to ensure the tracking will be initialized correctly.
         final ConditionVariable startMonitoringDone = new ConditionVariable();
         mHandler.post(() -> {
-            mPermissionMonitor.startMonitoring();
+            mPermissionMonitor.initialize();
+            // Calling mBroadcastReceiveHelper.callCallbackForInitialUsers() after
+            // PermissionMonitor.startMonitoring() ensures that the internal lists
+            // (mUidsAllowedOnRestrictedNetworks and mUsersTrafficPermissions) in
+            // PermissionMonitor are prepared before processing initial users.
+            // While technically the onUserAdded callback (triggered by
+            // callCallbackForInitialUsers) handles sending network and traffic
+            // permissions to netd and bpf, which depend on these lists, moving
+            // this call before startMonitoring would necessitate performing these
+            // actions again within startMonitoring, leading to redundant work.
+            // Therefore, keeping callCallbackForInitialUsers() in this order is the
+            // safest approach to avoid duplicated operations and ensure the
+            // permission lists are ready when the initial user callbacks are invoked.
+            mBroadcastReceiveHelper.callOnUserAddedForExistingUsers();
             startMonitoringDone.open();
         });
         mProxyTracker.loadGlobalProxy();
@@ -7717,7 +7732,9 @@ public class ConnectivityService extends IConnectivityManager.Stub
             handleSetOemNetworkPreference(mOemNetworkPreferences, null);
         }
         updateProfileAllowedNetworks();
-        mPermissionMonitor.onUserAdded(user);
+        final List<PackageInfo> apps = mContext.getPackageManager()
+                .getInstalledPackagesAsUser(GET_PERMISSIONS, user.getIdentifier());
+        mPermissionMonitor.onUserAddedWithInstalledPackageList(user, apps);
     }
 
     @Override
diff --git a/service/src/com/android/server/connectivity/BroadcastReceiveHelper.java b/service/src/com/android/server/connectivity/BroadcastReceiveHelper.java
index 7df29ea8ee..988d33f099 100644
--- a/service/src/com/android/server/connectivity/BroadcastReceiveHelper.java
+++ b/service/src/com/android/server/connectivity/BroadcastReceiveHelper.java
@@ -17,6 +17,7 @@
 package com.android.server.connectivity;
 
 import android.annotation.NonNull;
+import android.annotation.SuppressLint;
 import android.content.BroadcastReceiver;
 import android.content.Context;
 import android.content.Intent;
@@ -25,10 +26,12 @@ import android.net.Uri;
 import android.os.Handler;
 import android.os.HandlerThread;
 import android.os.UserHandle;
+import android.os.UserManager;
 import android.util.Log;
 
 import com.android.net.module.util.HandlerUtils;
 
+import java.util.List;
 import java.util.function.Consumer;
 
 /**
@@ -82,6 +85,12 @@ public class BroadcastReceiveHelper {
         /**
          * Called when a new user has been added to the device.
          *
+         * Note that {@link #callOnUserAddedForExistingUsers} will iterate through all
+         * existing users on the device and triggers the {@link Delegate#onUserAdded(UserHandle)}
+         * callback inline for each user.
+         * This is needed to ensure the callback is invoked for users
+         * that were present before this listener was started.
+         *
          * @param userHandle The {@link UserHandle} of the user that was added.
          */
         void onUserAdded(UserHandle userHandle);
@@ -146,6 +155,22 @@ public class BroadcastReceiveHelper {
                 null /* broadcastPermission */, mHandler);
     }
 
+    /**
+     * Iterates through all existing users on the device and trigger the
+     * {@link Delegate#onUserAdded(UserHandle)} callback inline for each user.
+     * This method should be called to ensure the callback is invoked for users
+     * that were present before this listener was started.
+     */
+    @SuppressLint("MissingPermission")
+    public void callOnUserAddedForExistingUsers() {
+        HandlerUtils.ensureRunningOnHandlerThread(mHandler);
+        final UserManager userManager = mContext.getSystemService(UserManager.class);
+        final List<UserHandle> users = userManager.getUserHandles(true /* excludeDying */);
+        for (final UserHandle user : users) {
+            mCallback.onUserAdded(user);
+        }
+    }
+
     /**
      * Unregisters the broadcast receiver, stopping the listener from receiving further events.
      * It's important to call this method when the listener is no longer needed to avoid
diff --git a/service/src/com/android/server/connectivity/PermissionMonitor.java b/service/src/com/android/server/connectivity/PermissionMonitor.java
index f11888c628..9e4bb689a6 100755
--- a/service/src/com/android/server/connectivity/PermissionMonitor.java
+++ b/service/src/com/android/server/connectivity/PermissionMonitor.java
@@ -60,7 +60,6 @@ import android.os.RemoteException;
 import android.os.ServiceSpecificException;
 import android.os.SystemConfigManager;
 import android.os.UserHandle;
-import android.os.UserManager;
 import android.permission.PermissionManager;
 import android.provider.Settings;
 import android.util.ArrayMap;
@@ -94,7 +93,6 @@ public class PermissionMonitor {
     private static final int VERSION_Q = Build.VERSION_CODES.Q;
 
     private final PackageManager mPackageManager;
-    private final UserManager mUserManager;
     private final SystemConfigManager mSystemConfigManager;
     private final PermissionManager mPermissionManager;
     private final PermissionChangeListener mPermissionChangeListener;
@@ -237,7 +235,6 @@ public class PermissionMonitor {
             @NonNull final Dependencies deps,
             @NonNull final HandlerThread thread) {
         mPackageManager = context.getPackageManager();
-        mUserManager = (UserManager) context.getSystemService(Context.USER_SERVICE);
         mSystemConfigManager = context.getSystemService(SystemConfigManager.class);
         mPermissionManager = context.getSystemService(PermissionManager.class);
         mPermissionChangeListener = new PermissionChangeListener();
@@ -299,10 +296,6 @@ public class PermissionMonitor {
         return targetPermission > currentPermission;
     }
 
-    private List<PackageInfo> getInstalledPackagesAsUser(final UserHandle user) {
-        return mPackageManager.getInstalledPackagesAsUser(GET_PERMISSIONS, user.getIdentifier());
-    }
-
     private synchronized void updateAllApps(final List<PackageInfo> apps) {
         for (PackageInfo app : apps) {
             final int appId = app.applicationInfo != null
@@ -407,10 +400,14 @@ public class PermissionMonitor {
         return appIdsPerm;
     }
 
-    // Intended to be called only once at startup, after the system is ready. Installs a broadcast
-    // receiver to monitor ongoing UID changes, so this shouldn't/needn't be called again.
-    public synchronized void startMonitoring() {
-        log("Monitoring");
+    /**
+     * Initializer of this class.
+     *
+     * Intended to be called only once at startup, in the systemReady phase.
+     * This shouldn't/needn't be called again.
+     */
+    public synchronized void initialize() {
+        log("Initialize");
 
         final Handler handler = new Handler(mThread.getLooper());
         final Context userAllContext = mContext.createContextAsUser(UserHandle.ALL, 0 /* flags */);
@@ -435,12 +432,7 @@ public class PermissionMonitor {
         // are not specific to any particular user.
         mUsersTrafficPermissions.put(UserHandle.ALL, getSystemTrafficPerm());
 
-        final List<UserHandle> usrs = mUserManager.getUserHandles(true /* excludeDying */);
-        // Update netd permissions for all users.
-        for (UserHandle user : usrs) {
-            onUserAdded(user);
-        }
-        log("Users: " + mUsers.size() + ", UidToNetworkPerm: " + mUidToNetworkPerm.size());
+        log("UidToNetworkPerm: " + mUidToNetworkPerm.size());
     }
 
     @VisibleForTesting
@@ -552,13 +544,13 @@ public class PermissionMonitor {
      * Called when a user is added. See {link #ACTION_USER_ADDED}.
      *
      * @param user The userHandle of the added user. See {@link #EXTRA_USER_HANDLE}.
+     * @param apps The list of packages which is installed on the user.
      */
-    public synchronized void onUserAdded(@NonNull UserHandle user) {
+    public synchronized void onUserAddedWithInstalledPackageList(@NonNull UserHandle user,
+            @NonNull List<PackageInfo> apps) {
         ensureRunningOnHandlerThread();
         mUsers.add(user);
 
-        final List<PackageInfo> apps = getInstalledPackagesAsUser(user);
-
         // Save all apps in mAllApps
         updateAllApps(apps);
 
diff --git a/tests/unit/java/com/android/server/connectivity/BroadcastReceiveHelperTest.kt b/tests/unit/java/com/android/server/connectivity/BroadcastReceiveHelperTest.kt
index e5efd34e71..70dc322a86 100644
--- a/tests/unit/java/com/android/server/connectivity/BroadcastReceiveHelperTest.kt
+++ b/tests/unit/java/com/android/server/connectivity/BroadcastReceiveHelperTest.kt
@@ -32,6 +32,7 @@ import android.net.Uri
 import android.os.Handler
 import android.os.HandlerThread
 import android.os.UserHandle
+import android.os.UserManager
 import com.android.compatibility.common.util.MoreMatchers.anyOrNull
 import com.android.server.connectivity.BroadcastReceiveHelper.Delegate
 import com.android.testutils.DevSdkIgnoreRunner
@@ -57,9 +58,9 @@ private inline fun <reified T> any() = org.mockito.Mockito.any(T::class.java)
 @DevSdkIgnoreRunner.MonitorThreadLeak
 @RunWith(DevSdkIgnoreRunner::class)
 class BroadcastReceiveHelperTest {
-
     private val mockContext = mock(Context::class.java)
     private val mockDelegate = mock(Delegate::class.java)
+    private val mockUserManager = mock(UserManager::class.java)
 
     // Create an InOrder object to verify the sequence of delegate calls.
     private val delegateInOrderVerifier = org.mockito.Mockito.inOrder(mockDelegate)
@@ -81,6 +82,7 @@ class BroadcastReceiveHelperTest {
         broadcastReceiveHelper = BroadcastReceiveHelper(mockContext, handler, mockDelegate)
 
         // Capture intent receivers.
+        doReturn(mockUserManager).`when`(mockContext).getSystemService(UserManager::class.java)
         doReturn(mockContext).`when`(mockContext).createContextAsUser(UserHandle.ALL, 0)
         broadcastReceiveHelper.registerReceivers()
         userReceiver = captureIntentReceiver(ACTION_USER_ADDED)
@@ -284,4 +286,21 @@ class BroadcastReceiveHelperTest {
         handler.waitForIdle(HANDLER_TIMEOUT_MS)
         handler.waitForIdle(HANDLER_TIMEOUT_MS)
     }
+
+    @Test
+    fun testCallOnUserAddedForInitialUsers() {
+        // Mock existing users.
+        val existingUser1 = mock(UserHandle::class.java)
+        val existingUser2 = mock(UserHandle::class.java)
+        val existingUsers = listOf(existingUser1, existingUser2)
+        doReturn(existingUsers).`when`(mockUserManager).getUserHandles(any())
+        // Make sure there is no interactions.
+        delegateInOrderVerifier.verifyNoMoreInteractions()
+
+        // Verify that onUserAdded is called for each existing user.
+        processOnHandlerThread { broadcastReceiveHelper.callOnUserAddedForExistingUsers() }
+        delegateInOrderVerifier.verify(mockDelegate).onUserAdded(existingUser1)
+        delegateInOrderVerifier.verify(mockDelegate).onUserAdded(existingUser2)
+        delegateInOrderVerifier.verifyNoMoreInteractions()
+    }
 }
diff --git a/tests/unit/java/com/android/server/connectivity/PermissionMonitorTest.java b/tests/unit/java/com/android/server/connectivity/PermissionMonitorTest.java
index 3d474dfd82..a2a9422e6c 100644
--- a/tests/unit/java/com/android/server/connectivity/PermissionMonitorTest.java
+++ b/tests/unit/java/com/android/server/connectivity/PermissionMonitorTest.java
@@ -201,7 +201,6 @@ public class PermissionMonitorTest {
         MockitoAnnotations.initMocks(this);
         when(mContext.getPackageManager()).thenReturn(mPackageManager);
         when(mContext.getSystemService(eq(Context.USER_SERVICE))).thenReturn(mUserManager);
-        doReturn(List.of(MOCK_USER1)).when(mUserManager).getUserHandles(eq(true));
         when(mContext.getSystemService(PermissionManager.class)).thenReturn(mPermissionManager);
         when(mContext.getSystemServiceName(SystemConfigManager.class))
                 .thenReturn(Context.SYSTEM_CONFIG_SERVICE);
@@ -232,9 +231,6 @@ public class PermissionMonitorTest {
 
         // Start the HandlerThread after PermissionMonitor created as CS current behavior.
         mHandlerThread.start();
-
-        doReturn(List.of()).when(mPackageManager).getInstalledPackagesAsUser(anyInt(), anyInt());
-        onUserAdded(MOCK_USER1);
     }
 
     @After
@@ -339,12 +335,13 @@ public class PermissionMonitorTest {
         return packageInfo;
     }
 
-    private void startMonitoring() {
-        processOnHandlerThread(() -> mPermissionMonitor.startMonitoring());
+    private void initialize() {
+        processOnHandlerThread(() -> mPermissionMonitor.initialize());
     }
 
-    private void onUserAdded(UserHandle user) {
-        processOnHandlerThread(() -> mPermissionMonitor.onUserAdded(user));
+    private void onUserAddedWithInstalledPackageList(UserHandle user, List<PackageInfo> apps) {
+        processOnHandlerThread(() ->
+                mPermissionMonitor.onUserAddedWithInstalledPackageList(user, apps));
     }
 
     private void onUserRemoved(UserHandle user) {
@@ -801,7 +798,7 @@ public class PermissionMonitorTest {
                 CHANGE_NETWORK_STATE);
 
         // Add user MOCK_USER1.
-        onUserAdded(MOCK_USER1);
+        onUserAddedWithInstalledPackageList(MOCK_USER1, List.of());
         // Add SYSTEM_PACKAGE2, expect only have network permission.
         addPackageForUsers(new UserHandle[]{MOCK_USER1}, SYSTEM_PACKAGE2, SYSTEM_APPID1);
         mNetdMonitor.expectNetworkPerm(PERMISSION_NETWORK, new UserHandle[]{MOCK_USER1},
@@ -816,10 +813,8 @@ public class PermissionMonitorTest {
                 buildPackageInfo(SYSTEM_PACKAGE1, SYSTEM_APP_UID21,
                         CONNECTIVITY_USE_RESTRICTED_NETWORKS),
                 buildPackageInfo(SYSTEM_PACKAGE2, SYSTEM_APP_UID21, CHANGE_NETWORK_STATE));
-        doReturn(pkgs).when(mPackageManager).getInstalledPackagesAsUser(eq(GET_PERMISSIONS),
-                eq(MOCK_USER_ID2));
         // Add user MOCK_USER2.
-        onUserAdded(MOCK_USER2);
+        onUserAddedWithInstalledPackageList(MOCK_USER2, pkgs);
         mNetdMonitor.expectNetworkPerm(PERMISSION_SYSTEM, new UserHandle[]{MOCK_USER1, MOCK_USER2},
                 SYSTEM_APPID1);
 
@@ -890,9 +885,7 @@ public class PermissionMonitorTest {
         final PackageInfo packageInfo = buildAndMockPackageInfoWithPermissions(
                 MOCK_PACKAGE1, MOCK_UID11, CHANGE_NETWORK_STATE);
         // Set package for all users on devices
-        doReturn(List.of(packageInfo)).when(mPackageManager)
-                .getInstalledPackagesAsUser(anyInt(), eq(MOCK_USER1.getIdentifier()));
-        onUserAdded(MOCK_USER1);
+        onUserAddedWithInstalledPackageList(MOCK_USER1, List.of(packageInfo));
 
         assertFalse(mBpfMapMonitor.hasLocalNetPermissions(MOCK_UID11));
         if (hasSdkSandbox(MOCK_UID11)) {
@@ -912,9 +905,7 @@ public class PermissionMonitorTest {
         final PackageInfo packageInfo = buildAndMockPackageInfoWithPermissions(
                 MOCK_PACKAGE1, MOCK_UID11, CHANGE_NETWORK_STATE);
         // Set package for all users on devices
-        doReturn(List.of(packageInfo)).when(mPackageManager)
-                .getInstalledPackagesAsUser(anyInt(), eq(MOCK_USER1.getIdentifier()));
-        onUserAdded(MOCK_USER1);
+        onUserAddedWithInstalledPackageList(MOCK_USER1, List.of(packageInfo));
         assertFalse(mBpfMapMonitor.hasLocalNetPermissions(MOCK_UID11));
 
         onUserRemoved(MOCK_USER1);
@@ -923,15 +914,14 @@ public class PermissionMonitorTest {
 
     private void doTestUidFilteringDuringVpnConnectDisconnectAndUidUpdates(@Nullable String ifName)
             throws Exception {
-        doReturn(List.of(
+        final List<PackageInfo> pkgs = List.of(
                 buildPackageInfo(SYSTEM_PACKAGE1, SYSTEM_APP_UID11, CHANGE_NETWORK_STATE,
                         CONNECTIVITY_USE_RESTRICTED_NETWORKS),
                 buildPackageInfo(MOCK_PACKAGE1, MOCK_UID11),
                 buildPackageInfo(MOCK_PACKAGE2, MOCK_UID12),
-                buildPackageInfo(SYSTEM_PACKAGE2, VPN_UID)))
-                .when(mPackageManager).getInstalledPackagesAsUser(eq(GET_PERMISSIONS), anyInt());
-        buildAndMockPackageInfoWithPermissions(MOCK_PACKAGE1, MOCK_UID11);
-        startMonitoring();
+                buildPackageInfo(SYSTEM_PACKAGE2, VPN_UID));
+        initialize();
+        onUserAddedWithInstalledPackageList(MOCK_USER1, pkgs);
         // Every app on user 0 except MOCK_UID12 is subject to the VPN.
         final Set<UidRange> vpnRange1 = Set.of(
                 new UidRange(0, MOCK_UID12 - 1),
@@ -981,15 +971,13 @@ public class PermissionMonitorTest {
 
     private void doTestUidFilteringDuringPackageInstallAndUninstall(@Nullable String ifName) throws
             Exception {
-        doReturn(List.of(
+        final List<PackageInfo> pkgs = List.of(
                 buildPackageInfo(SYSTEM_PACKAGE1, SYSTEM_APP_UID11, CHANGE_NETWORK_STATE,
                         NETWORK_STACK, CONNECTIVITY_USE_RESTRICTED_NETWORKS),
-                buildPackageInfo(SYSTEM_PACKAGE2, VPN_UID)))
-                .when(mPackageManager).getInstalledPackagesAsUser(eq(GET_PERMISSIONS), anyInt());
-        buildAndMockPackageInfoWithPermissions(MOCK_PACKAGE1, MOCK_UID11);
-        doReturn(List.of(MOCK_USER1, MOCK_USER2)).when(mUserManager).getUserHandles(eq(true));
-
-        startMonitoring();
+                buildPackageInfo(SYSTEM_PACKAGE2, VPN_UID));
+        initialize();
+        onUserAddedWithInstalledPackageList(MOCK_USER1, pkgs);
+        onUserAddedWithInstalledPackageList(MOCK_USER2, pkgs);
         final Set<UidRange> vpnRange = Set.of(UidRange.createForUser(MOCK_USER1),
                 UidRange.createForUser(MOCK_USER2));
         mPermissionMonitor.onVpnUidRangesAdded(ifName, vpnRange, VPN_UID);
@@ -1020,14 +1008,14 @@ public class PermissionMonitorTest {
     @Test
     @EnableCompatChanges(RESTRICT_LOCAL_NETWORK)
     public void testLockdownUidFilteringWithLockdownEnableDisable() {
-        doReturn(List.of(
+        final List<PackageInfo> pkgs = List.of(
                 buildPackageInfo(SYSTEM_PACKAGE1, SYSTEM_APP_UID11, CHANGE_NETWORK_STATE,
                         CONNECTIVITY_USE_RESTRICTED_NETWORKS),
                 buildPackageInfo(MOCK_PACKAGE1, MOCK_UID11),
                 buildPackageInfo(MOCK_PACKAGE2, MOCK_UID12),
-                buildPackageInfo(SYSTEM_PACKAGE2, VPN_UID)))
-                .when(mPackageManager).getInstalledPackagesAsUser(eq(GET_PERMISSIONS), anyInt());
-        startMonitoring();
+                buildPackageInfo(SYSTEM_PACKAGE2, VPN_UID));
+        initialize();
+        onUserAddedWithInstalledPackageList(MOCK_USER1, pkgs);
         // Every app on user 0 except MOCK_UID12 is subject to the VPN.
         final UidRange[] lockdownRange = {
                 new UidRange(0, MOCK_UID12 - 1),
@@ -1052,13 +1040,13 @@ public class PermissionMonitorTest {
     @Test
     @EnableCompatChanges(RESTRICT_LOCAL_NETWORK)
     public void testLockdownUidFilteringWithLockdownEnableDisableWithMultiAdd() {
-        doReturn(List.of(
+        final List<PackageInfo> pkgs = List.of(
                 buildPackageInfo(SYSTEM_PACKAGE1, SYSTEM_APP_UID11, CHANGE_NETWORK_STATE,
                         CONNECTIVITY_USE_RESTRICTED_NETWORKS),
                 buildPackageInfo(MOCK_PACKAGE1, MOCK_UID11),
-                buildPackageInfo(SYSTEM_PACKAGE2, VPN_UID)))
-                .when(mPackageManager).getInstalledPackagesAsUser(eq(GET_PERMISSIONS), anyInt());
-        startMonitoring();
+                buildPackageInfo(SYSTEM_PACKAGE2, VPN_UID));
+        initialize();
+        onUserAddedWithInstalledPackageList(MOCK_USER1, pkgs);
         // MOCK_UID11 is subject to the VPN.
         final UidRange range = new UidRange(MOCK_UID11, MOCK_UID11);
         final UidRange[] lockdownRange = {range};
@@ -1094,13 +1082,14 @@ public class PermissionMonitorTest {
     @Test
     @EnableCompatChanges(RESTRICT_LOCAL_NETWORK)
     public void testLockdownUidFilteringWithLockdownEnableDisableWithMultiAddAndOverlap() {
-        doReturn(List.of(buildPackageInfo(SYSTEM_PACKAGE1, SYSTEM_APP_UID11, CHANGE_NETWORK_STATE,
+        final List<PackageInfo> pkgs = List.of(
+                buildPackageInfo(SYSTEM_PACKAGE1, SYSTEM_APP_UID11, CHANGE_NETWORK_STATE,
                         CONNECTIVITY_USE_RESTRICTED_NETWORKS),
                 buildPackageInfo(MOCK_PACKAGE1, MOCK_UID13),
                 buildPackageInfo(MOCK_PACKAGE2, MOCK_UID14),
-                buildPackageInfo(SYSTEM_PACKAGE2, VPN_UID)))
-                .when(mPackageManager).getInstalledPackagesAsUser(eq(GET_PERMISSIONS), anyInt());
-        startMonitoring();
+                buildPackageInfo(SYSTEM_PACKAGE2, VPN_UID));
+        initialize();
+        onUserAddedWithInstalledPackageList(MOCK_USER1, pkgs);
         // MOCK_UID13 is subject to the VPN.
         final UidRange range1 = new UidRange(MOCK_UID13, MOCK_UID13);
         final UidRange[] lockdownRange1 = {range1};
@@ -1155,13 +1144,13 @@ public class PermissionMonitorTest {
     @Test
     @EnableCompatChanges(RESTRICT_LOCAL_NETWORK)
     public void testLockdownUidFilteringWithLockdownEnableDisableWithDuplicates() {
-        doReturn(List.of(
+        final List<PackageInfo> pkgs = List.of(
                 buildPackageInfo(SYSTEM_PACKAGE1, SYSTEM_APP_UID11, CHANGE_NETWORK_STATE,
                         CONNECTIVITY_USE_RESTRICTED_NETWORKS),
                 buildPackageInfo(MOCK_PACKAGE1, MOCK_UID11),
-                buildPackageInfo(SYSTEM_PACKAGE2, VPN_UID)))
-                .when(mPackageManager).getInstalledPackagesAsUser(eq(GET_PERMISSIONS), anyInt());
-        startMonitoring();
+                buildPackageInfo(SYSTEM_PACKAGE2, VPN_UID));
+        initialize();
+        onUserAddedWithInstalledPackageList(MOCK_USER1, pkgs);
         // MOCK_UID11 is subject to the VPN.
         final UidRange range = new UidRange(MOCK_UID11, MOCK_UID11);
         final UidRange[] lockdownRangeDuplicates = {range, range};
@@ -1190,14 +1179,14 @@ public class PermissionMonitorTest {
     @Test
     @EnableCompatChanges(RESTRICT_LOCAL_NETWORK)
     public void testLockdownUidFilteringWithInstallAndUnInstall() {
-        doReturn(List.of(
+        final List<PackageInfo> pkgs = List.of(
                 buildPackageInfo(SYSTEM_PACKAGE1, SYSTEM_APP_UID11, CHANGE_NETWORK_STATE,
                         NETWORK_STACK, CONNECTIVITY_USE_RESTRICTED_NETWORKS),
-                buildPackageInfo(SYSTEM_PACKAGE2, VPN_UID)))
-                .when(mPackageManager).getInstalledPackagesAsUser(eq(GET_PERMISSIONS), anyInt());
-        doReturn(List.of(MOCK_USER1, MOCK_USER2)).when(mUserManager).getUserHandles(eq(true));
+                buildPackageInfo(SYSTEM_PACKAGE2, VPN_UID));
 
-        startMonitoring();
+        initialize();
+        onUserAddedWithInstalledPackageList(MOCK_USER1, pkgs);
+        onUserAddedWithInstalledPackageList(MOCK_USER2, pkgs);
         final UidRange[] lockdownRange = {
                 UidRange.createForUser(MOCK_USER1),
                 UidRange.createForUser(MOCK_USER2)
@@ -1281,6 +1270,7 @@ public class PermissionMonitorTest {
     @Test
     @EnableCompatChanges(RESTRICT_LOCAL_NETWORK)
     public void testPackageInstall() throws Exception {
+        onUserAddedWithInstalledPackageList(MOCK_USER1, List.of());
         addPackage(MOCK_PACKAGE1, MOCK_UID11, INTERNET, UPDATE_DEVICE_STATS);
         mBpfMapMonitor.expectTrafficPerm(PERMISSION_TRAFFIC_ALL, MOCK_APPID1);
 
@@ -1308,6 +1298,7 @@ public class PermissionMonitorTest {
     @Test
     @EnableCompatChanges(RESTRICT_LOCAL_NETWORK)
     public void testPackageInstallSharedUid() throws Exception {
+        onUserAddedWithInstalledPackageList(MOCK_USER1, List.of());
         addPackage(MOCK_PACKAGE1, MOCK_UID11, INTERNET, UPDATE_DEVICE_STATS);
         mBpfMapMonitor.expectTrafficPerm(PERMISSION_TRAFFIC_ALL, MOCK_APPID1);
 
@@ -1320,6 +1311,7 @@ public class PermissionMonitorTest {
     @Test
     @EnableCompatChanges(RESTRICT_LOCAL_NETWORK)
     public void testPackageUninstallBasic() throws Exception {
+        onUserAddedWithInstalledPackageList(MOCK_USER1, List.of());
         addPackage(MOCK_PACKAGE1, MOCK_UID11, INTERNET, UPDATE_DEVICE_STATS);
         mBpfMapMonitor.expectTrafficPerm(PERMISSION_TRAFFIC_ALL, MOCK_APPID1);
 
@@ -1347,6 +1339,7 @@ public class PermissionMonitorTest {
     @Test
     @EnableCompatChanges(RESTRICT_LOCAL_NETWORK)
     public void testPackageRemoveThenAdd() throws Exception {
+        onUserAddedWithInstalledPackageList(MOCK_USER1, List.of());
         addPackage(MOCK_PACKAGE1, MOCK_UID11, INTERNET, UPDATE_DEVICE_STATS);
         mBpfMapMonitor.expectTrafficPerm(PERMISSION_TRAFFIC_ALL, MOCK_APPID1);
 
@@ -1383,6 +1376,7 @@ public class PermissionMonitorTest {
     @Test
     @EnableCompatChanges(RESTRICT_LOCAL_NETWORK)
     public void testPackageUpdate() throws Exception {
+        onUserAddedWithInstalledPackageList(MOCK_USER1, List.of());
         addPackage(MOCK_PACKAGE1, MOCK_UID11);
         mBpfMapMonitor.expectTrafficPerm(PERMISSION_NONE, MOCK_APPID1);
 
@@ -1393,6 +1387,7 @@ public class PermissionMonitorTest {
     @Test
     @EnableCompatChanges(RESTRICT_LOCAL_NETWORK)
     public void testPackageUninstallWithMultiplePackages() throws Exception {
+        onUserAddedWithInstalledPackageList(MOCK_USER1, List.of());
         addPackage(MOCK_PACKAGE1, MOCK_UID11, INTERNET, UPDATE_DEVICE_STATS);
         mBpfMapMonitor.expectTrafficPerm(PERMISSION_TRAFFIC_ALL, MOCK_APPID1);
 
@@ -1430,7 +1425,8 @@ public class PermissionMonitorTest {
         when(mSystemConfigManager.getSystemPermissionUids(eq(UPDATE_DEVICE_STATS)))
                 .thenReturn(new int[]{ MOCK_UID12 });
 
-        startMonitoring();
+        initialize();
+        onUserAddedWithInstalledPackageList(MOCK_USER1, List.of());
         mBpfMapMonitor.expectTrafficPerm(PERMISSION_INTERNET, MOCK_APPID1);
         mBpfMapMonitor.expectTrafficPerm(PERMISSION_TRAFFIC_ALL, MOCK_APPID2);
     }
@@ -1444,7 +1440,8 @@ public class PermissionMonitorTest {
     @Test
     @EnableCompatChanges(RESTRICT_LOCAL_NETWORK)
     public void testUidPermissionWhenPackageAddedRemoved() throws Exception {
-        startMonitoring();
+        initialize();
+        onUserAddedWithInstalledPackageList(MOCK_USER1, List.of());
 
         // Add/Remove package and verify uid permissions.
         addPackage(MOCK_PACKAGE1, MOCK_UID11, INTERNET, UPDATE_DEVICE_STATS);
@@ -1470,7 +1467,7 @@ public class PermissionMonitorTest {
     @Test
     @EnableCompatChanges(RESTRICT_LOCAL_NETWORK)
     public void testUidsAllowedOnRestrictedNetworksChanged() throws Exception {
-        startMonitoring();
+        initialize();
         final ContentObserver contentObserver = expectRegisterContentObserver(
                 Settings.Global.getUriFor(UIDS_ALLOWED_ON_RESTRICTED_NETWORKS));
 
@@ -1503,7 +1500,7 @@ public class PermissionMonitorTest {
     @Test
     @EnableCompatChanges(RESTRICT_LOCAL_NETWORK)
     public void testUidsAllowedOnRestrictedNetworksChangedWithSharedUid() throws Exception {
-        startMonitoring();
+        initialize();
         final ContentObserver contentObserver = expectRegisterContentObserver(
                 Settings.Global.getUriFor(UIDS_ALLOWED_ON_RESTRICTED_NETWORKS));
 
@@ -1537,7 +1534,7 @@ public class PermissionMonitorTest {
     @Test
     @EnableCompatChanges(RESTRICT_LOCAL_NETWORK)
     public void testUidsAllowedOnRestrictedNetworksChangedWithMultipleUsers() throws Exception {
-        startMonitoring();
+        initialize();
         final ContentObserver contentObserver = expectRegisterContentObserver(
                 Settings.Global.getUriFor(UIDS_ALLOWED_ON_RESTRICTED_NETWORKS));
 
@@ -1556,9 +1553,7 @@ public class PermissionMonitorTest {
         // Add user MOCK_USER2.
         final List<PackageInfo> pkgs = List.of(buildPackageInfo(MOCK_PACKAGE1, MOCK_UID21));
         buildAndMockPackageInfoWithPermissions(MOCK_PACKAGE2, MOCK_UID22);
-        doReturn(pkgs).when(mPackageManager)
-                .getInstalledPackagesAsUser(eq(GET_PERMISSIONS), eq(MOCK_USER_ID2));
-        onUserAdded(MOCK_USER2);
+        onUserAddedWithInstalledPackageList(MOCK_USER2, pkgs);
         // MOCK_APPID1 in MOCK_USER1 should have SYSTEM permission but in MOCK_USER2 should have no
         // permissions. And MOCK_APPID2 has no permissions in either users.
         mNetdMonitor.expectNetworkPerm(PERMISSION_SYSTEM, new UserHandle[]{MOCK_USER1},
@@ -1594,11 +1589,11 @@ public class PermissionMonitorTest {
     public void testOnExternalApplicationsAvailable() throws Exception {
         // Initial the permission state. MOCK_PACKAGE1 and MOCK_PACKAGE2 are installed on external
         // and have different uids. There has no permission for both uids.
-        doReturn(List.of(
+        final List<PackageInfo> pkgs = List.of(
                 buildPackageInfo(MOCK_PACKAGE1, MOCK_UID11),
-                buildPackageInfo(MOCK_PACKAGE2, MOCK_UID12)))
-                .when(mPackageManager).getInstalledPackagesAsUser(eq(GET_PERMISSIONS), anyInt());
-        startMonitoring();
+                buildPackageInfo(MOCK_PACKAGE2, MOCK_UID12));
+        initialize();
+        onUserAddedWithInstalledPackageList(MOCK_USER1, pkgs);
         mNetdMonitor.expectNoNetworkPerm(new UserHandle[]{MOCK_USER1}, MOCK_APPID1, MOCK_APPID2);
         mBpfMapMonitor.expectTrafficPerm(PERMISSION_NONE, MOCK_APPID1, MOCK_APPID2);
 
@@ -1618,9 +1613,10 @@ public class PermissionMonitorTest {
 
     @Test
     @EnableCompatChanges(RESTRICT_LOCAL_NETWORK)
-    public void testOnExternalApplicationsAvailable_AppsNotRegisteredOnStartMonitoring()
+    public void testOnExternalApplicationsAvailable_AppsNotRegisteredOnInitialize()
             throws Exception {
-        startMonitoring();
+        initialize();
+        onUserAddedWithInstalledPackageList(MOCK_USER1, List.of());
 
         // Initial the permission state. MOCK_PACKAGE1 and MOCK_PACKAGE2 are installed on external
         // and have different uids. There has no permission for both uids.
@@ -1645,11 +1641,11 @@ public class PermissionMonitorTest {
             throws Exception {
         // Initial the permission state. MOCK_PACKAGE1 and MOCK_PACKAGE2 are installed on external
         // storage and shared on MOCK_UID11. There has no permission for MOCK_UID11.
-        doReturn(List.of(
+        final List<PackageInfo> pkgs = List.of(
                 buildPackageInfo(MOCK_PACKAGE1, MOCK_UID11),
-                buildPackageInfo(MOCK_PACKAGE2, MOCK_UID11)))
-                .when(mPackageManager).getInstalledPackagesAsUser(eq(GET_PERMISSIONS), anyInt());
-        startMonitoring();
+                buildPackageInfo(MOCK_PACKAGE2, MOCK_UID11));
+        initialize();
+        onUserAddedWithInstalledPackageList(MOCK_USER1, pkgs);
         mNetdMonitor.expectNoNetworkPerm(new UserHandle[]{MOCK_USER1}, MOCK_APPID1);
         mBpfMapMonitor.expectTrafficPerm(PERMISSION_NONE, MOCK_APPID1);
 
@@ -1669,11 +1665,11 @@ public class PermissionMonitorTest {
         // Initial the permission state. MOCK_PACKAGE1 is installed on external storage and
         // MOCK_PACKAGE2 is installed on device. These two packages are shared on MOCK_UID11.
         // MOCK_UID11 has NETWORK and INTERNET permissions.
-        doReturn(List.of(
+        final List<PackageInfo> pkgs = List.of(
                 buildPackageInfo(MOCK_PACKAGE1, MOCK_UID11),
-                buildPackageInfo(MOCK_PACKAGE2, MOCK_UID11, CHANGE_NETWORK_STATE, INTERNET)))
-                .when(mPackageManager).getInstalledPackagesAsUser(eq(GET_PERMISSIONS), anyInt());
-        startMonitoring();
+                buildPackageInfo(MOCK_PACKAGE2, MOCK_UID11, CHANGE_NETWORK_STATE, INTERNET));
+        initialize();
+        onUserAddedWithInstalledPackageList(MOCK_USER1, pkgs);
         mNetdMonitor.expectNetworkPerm(PERMISSION_NETWORK, new UserHandle[]{MOCK_USER1},
                 MOCK_APPID1);
         mBpfMapMonitor.expectTrafficPerm(PERMISSION_INTERNET, MOCK_APPID1);
@@ -1734,7 +1730,25 @@ public class PermissionMonitorTest {
                 mProcessShim.toSdkSandboxUid(MOCK_UID11)));
     }
 
-    private void prepareMultiUserPackages() {
+    private void addUserAndVerifyAppIdsPermissions(UserHandle user, List<PackageInfo> pkgs,
+            int appId1Perm, int appId2Perm, int appId3Perm) {
+        onUserAddedWithInstalledPackageList(user, pkgs);
+        mBpfMapMonitor.expectTrafficPerm(appId1Perm, MOCK_APPID1);
+        mBpfMapMonitor.expectTrafficPerm(appId2Perm, MOCK_APPID2);
+        mBpfMapMonitor.expectTrafficPerm(appId3Perm, MOCK_APPID3);
+    }
+
+    private void removeUserAndVerifyAppIdsPermissions(UserHandle user, int appId1Perm,
+            int appId2Perm, int appId3Perm) {
+        onUserRemoved(user);
+        mBpfMapMonitor.expectTrafficPerm(appId1Perm, MOCK_APPID1);
+        mBpfMapMonitor.expectTrafficPerm(appId2Perm, MOCK_APPID2);
+        mBpfMapMonitor.expectTrafficPerm(appId3Perm, MOCK_APPID3);
+    }
+
+    @Test
+    @EnableCompatChanges(RESTRICT_LOCAL_NETWORK)
+    public void testAppIdsTrafficPermission_UserAddedRemoved() {
         // MOCK_USER1 has installed 3 packages
         // mockApp1 has no permission and share MOCK_APPID1.
         // mockApp2 has INTERNET permission and share MOCK_APPID2.
@@ -1756,45 +1770,16 @@ public class PermissionMonitorTest {
         final List<PackageInfo> pkgs3 = List.of(
                 buildPackageInfo("mockApp6", MOCK_UID32, UPDATE_DEVICE_STATS));
 
-        doReturn(pkgs1).when(mPackageManager).getInstalledPackagesAsUser(eq(GET_PERMISSIONS),
-                eq(MOCK_USER_ID1));
-        doReturn(pkgs2).when(mPackageManager).getInstalledPackagesAsUser(eq(GET_PERMISSIONS),
-                eq(MOCK_USER_ID2));
-        doReturn(pkgs3).when(mPackageManager).getInstalledPackagesAsUser(eq(GET_PERMISSIONS),
-                eq(MOCK_USER_ID3));
-    }
-
-    private void addUserAndVerifyAppIdsPermissions(UserHandle user, int appId1Perm,
-            int appId2Perm, int appId3Perm) {
-        onUserAdded(user);
-        mBpfMapMonitor.expectTrafficPerm(appId1Perm, MOCK_APPID1);
-        mBpfMapMonitor.expectTrafficPerm(appId2Perm, MOCK_APPID2);
-        mBpfMapMonitor.expectTrafficPerm(appId3Perm, MOCK_APPID3);
-    }
-
-    private void removeUserAndVerifyAppIdsPermissions(UserHandle user, int appId1Perm,
-            int appId2Perm, int appId3Perm) {
-        onUserRemoved(user);
-        mBpfMapMonitor.expectTrafficPerm(appId1Perm, MOCK_APPID1);
-        mBpfMapMonitor.expectTrafficPerm(appId2Perm, MOCK_APPID2);
-        mBpfMapMonitor.expectTrafficPerm(appId3Perm, MOCK_APPID3);
-    }
-
-    @Test
-    @EnableCompatChanges(RESTRICT_LOCAL_NETWORK)
-    public void testAppIdsTrafficPermission_UserAddedRemoved() {
-        prepareMultiUserPackages();
-
         // Add MOCK_USER1 and verify the permissions with each appIds.
-        addUserAndVerifyAppIdsPermissions(MOCK_USER1, PERMISSION_NONE, PERMISSION_INTERNET,
+        addUserAndVerifyAppIdsPermissions(MOCK_USER1, pkgs1, PERMISSION_NONE, PERMISSION_INTERNET,
                 PERMISSION_UPDATE_DEVICE_STATS);
 
         // Add MOCK_USER2 and verify the permissions upgrade on MOCK_APPID1 & MOCK_APPID3.
-        addUserAndVerifyAppIdsPermissions(MOCK_USER2, PERMISSION_UPDATE_DEVICE_STATS,
+        addUserAndVerifyAppIdsPermissions(MOCK_USER2, pkgs2, PERMISSION_UPDATE_DEVICE_STATS,
                 PERMISSION_INTERNET, PERMISSION_TRAFFIC_ALL);
 
         // Add MOCK_USER3 and verify the permissions upgrade on MOCK_APPID2.
-        addUserAndVerifyAppIdsPermissions(MOCK_USER3, PERMISSION_UPDATE_DEVICE_STATS,
+        addUserAndVerifyAppIdsPermissions(MOCK_USER3, pkgs3, PERMISSION_UPDATE_DEVICE_STATS,
                 PERMISSION_TRAFFIC_ALL, PERMISSION_TRAFFIC_ALL);
 
         // Remove MOCK_USER2 and verify the permissions downgrade on MOCK_APPID1 & MOCK_APPID3.
@@ -1806,7 +1791,7 @@ public class PermissionMonitorTest {
                 PERMISSION_UPDATE_DEVICE_STATS, PERMISSION_UNINSTALLED);
 
         // Add MOCK_USER2 back and verify the permissions upgrade on MOCK_APPID1 & MOCK_APPID3.
-        addUserAndVerifyAppIdsPermissions(MOCK_USER2, PERMISSION_UPDATE_DEVICE_STATS,
+        addUserAndVerifyAppIdsPermissions(MOCK_USER2, pkgs2, PERMISSION_UPDATE_DEVICE_STATS,
                 PERMISSION_UPDATE_DEVICE_STATS, PERMISSION_INTERNET);
 
         // Remove MOCK_USER3 and verify the permissions downgrade on MOCK_APPID2.
@@ -1818,8 +1803,8 @@ public class PermissionMonitorTest {
     @EnableCompatChanges(RESTRICT_LOCAL_NETWORK)
     public void testAppIdsTrafficPermission_Multiuser_PackageAdded() throws Exception {
         // Add two users with empty package list.
-        onUserAdded(MOCK_USER1);
-        onUserAdded(MOCK_USER2);
+        onUserAddedWithInstalledPackageList(MOCK_USER1, List.of());
+        onUserAddedWithInstalledPackageList(MOCK_USER2, List.of());
 
         final int[] netdPermissions = {PERMISSION_NONE, PERMISSION_INTERNET,
                 PERMISSION_UPDATE_DEVICE_STATS, PERMISSION_TRAFFIC_ALL};
@@ -1889,8 +1874,8 @@ public class PermissionMonitorTest {
     @EnableCompatChanges(RESTRICT_LOCAL_NETWORK)
     public void testAppIdsTrafficPermission_Multiuser_PackageRemoved() throws Exception {
         // Add two users with empty package list.
-        onUserAdded(MOCK_USER1);
-        onUserAdded(MOCK_USER2);
+        onUserAddedWithInstalledPackageList(MOCK_USER1, List.of());
+        onUserAddedWithInstalledPackageList(MOCK_USER2, List.of());
 
         int appId = MOCK_APPID1;
         // Verify that the permission combination is expected when same appId package is removed on

From e0e89ef66fe78ff815340542950e06acf6fcdc67 Mon Sep 17 00:00:00 2001
From: Chuwei He <chuweih@google.com>
Date: Mon, 24 Mar 2025 16:49:13 +0900
Subject: [PATCH 155/377] Add EthernetConfiguration class

This patch adds EthernetConfiguration class which represents a
static configuration and network capabilities of a configured ethernet
network interface.
EthernetConfiguration is used ONLY internally to store and track
ethernet configurations, and serves different functionality as
EthernetNetworkUpdateRequest.

Bug: 397536853
Test: atest ConnectivityCoverageTests
Flag: EXEMPT mainline
Change-Id: Ib175347096db25b9f2180a2e526746f1f3cf6ceb
---
 .../android/net/EthernetConfiguration.java    | 134 +++++++++++++
 .../net/EthernetConfigurationTest.java        | 177 ++++++++++++++++++
 2 files changed, 311 insertions(+)
 create mode 100644 framework-t/src/android/net/EthernetConfiguration.java
 create mode 100644 tests/unit/java/android/net/EthernetConfigurationTest.java

diff --git a/framework-t/src/android/net/EthernetConfiguration.java b/framework-t/src/android/net/EthernetConfiguration.java
new file mode 100644
index 0000000000..a736bfc506
--- /dev/null
+++ b/framework-t/src/android/net/EthernetConfiguration.java
@@ -0,0 +1,134 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.net;
+
+import android.annotation.NonNull;
+import android.annotation.Nullable;
+import android.os.Parcel;
+import android.os.Parcelable;
+
+import java.util.Objects;
+
+/**
+ * This class represents the static IP configuration data such as IP configuration (static IPv4
+ * address, IPv4 gateway, DNS servers, etc.) and network capabilities for a configured ethernet
+ * network interface.
+ *
+ * - Intended Usage and Scope:
+ *   This class implements android.os.Parcelable and resides in the framework JAR. This is
+ *   necessary for being used as an AIDL object to share code with EthernetPortInfo and
+ *   EthernetNetworkUpdateRequest.
+ *
+ * - Future Evolution:
+ *   This class is meant to progressively replace EthernetNetworkUpdateRequest in EthernetManager's
+ *   {@code @SystemApi} and be exposed through {@code @SystemApi} getters as well.
+ *
+ * @hide
+ */
+public class EthernetConfiguration implements Parcelable {
+    /**
+     * Static IP configuration data (static IPv4 address, IPv4 gateway, DNS servers, etc.)
+     */
+    private final IpConfiguration mIpConfiguration;
+
+    /**
+     * This is only for the requestable bits of NetworkCapabilities that an external caller can
+     * pass through a EthernetNetworkUpdateRequest.
+     */
+    private final NetworkCapabilities mNetworkCapabilities;
+
+    public EthernetConfiguration(@NonNull IpConfiguration ipConfiguration,
+            @NonNull NetworkCapabilities capabilities) {
+        Objects.requireNonNull(ipConfiguration);
+        Objects.requireNonNull(capabilities);
+        mIpConfiguration = ipConfiguration;
+        mNetworkCapabilities = capabilities;
+    }
+
+    /**
+     * Get the IpConfiguration object associated with this EthernetConfiguration.
+     */
+    @NonNull
+    public IpConfiguration getIpConfiguration() {
+        return new IpConfiguration(mIpConfiguration);
+    }
+
+    /**
+     * Get the NetworkCapabilities object associated with this EthernetConfiguration.
+     */
+    @NonNull
+    public NetworkCapabilities getNetworkCapabilities() {
+        return new NetworkCapabilities(mNetworkCapabilities);
+    }
+
+    @Override
+    public String toString() {
+        return "IP configurations: " + mIpConfiguration.toString()
+                + "Network capabilities: " + mNetworkCapabilities.toString();
+    }
+
+    @Override
+    public boolean equals(@Nullable Object o) {
+        if (o == this) {
+            return true;
+        }
+
+        if (!(o instanceof EthernetConfiguration)) {
+            return false;
+        }
+
+        final EthernetConfiguration other = (EthernetConfiguration) o;
+        return Objects.equals(this.mIpConfiguration, other.mIpConfiguration)
+                && Objects.equals(this.mNetworkCapabilities, other.mNetworkCapabilities);
+    }
+
+    @Override
+    public int hashCode() {
+        return Objects.hash(mIpConfiguration, mNetworkCapabilities);
+    }
+
+    /** Implement the Parcelable interface */
+    @Override
+    public void writeToParcel(Parcel dest, int flags) {
+        dest.writeParcelable(mIpConfiguration, flags);
+        dest.writeParcelable(mNetworkCapabilities, flags);
+    }
+
+    /** Implement the Parcelable interface */
+    public static final @NonNull Creator<EthernetConfiguration> CREATOR =
+            new Creator<EthernetConfiguration>() {
+                @Override
+                public EthernetConfiguration createFromParcel(Parcel in) {
+                    final IpConfiguration config = in.readParcelable(
+                            IpConfiguration.class.getClassLoader());
+                    final NetworkCapabilities capabilities = in.readParcelable(
+                            NetworkCapabilities.class.getClassLoader());
+                    return new EthernetConfiguration(config, capabilities);
+                }
+
+                @Override
+                public EthernetConfiguration[] newArray(int size) {
+                    return new EthernetConfiguration[size];
+                }
+            };
+
+    /** Implement the Parcelable interface */
+    @Override
+    public int describeContents() {
+        return 0;
+    }
+}
diff --git a/tests/unit/java/android/net/EthernetConfigurationTest.java b/tests/unit/java/android/net/EthernetConfigurationTest.java
new file mode 100644
index 0000000000..30c0d7c5ed
--- /dev/null
+++ b/tests/unit/java/android/net/EthernetConfigurationTest.java
@@ -0,0 +1,177 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.net;
+
+import static com.android.testutils.ParcelUtils.assertParcelingIsLossless;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotEquals;
+import static org.junit.Assert.assertThrows;
+import static org.junit.Assert.assertTrue;
+
+import android.os.Build;
+
+import androidx.test.filters.SmallTest;
+
+import com.android.modules.utils.build.SdkLevel;
+import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo;
+import com.android.testutils.DevSdkIgnoreRunner;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import java.net.InetAddress;
+import java.util.ArrayList;
+
+@SmallTest
+@IgnoreUpTo(Build.VERSION_CODES.S_V2)
+@RunWith(DevSdkIgnoreRunner.class)
+public class EthernetConfigurationTest {
+    // Setup 2 different IP configurations for building different ethernet configurations.
+    private IpConfiguration mIpConfiguration1;
+    private IpConfiguration mIpConfiguration2;
+    private NetworkCapabilities mNetworkCapabilities;
+
+    @Before
+    public void setUp() {
+        LinkAddress linkAddr = new LinkAddress("192.168.1.100/25");
+        InetAddress gateway = InetAddresses.parseNumericAddress("192.168.1.1");
+        InetAddress dns1 = InetAddresses.parseNumericAddress("8.8.8.8");
+        InetAddress dns2 = InetAddresses.parseNumericAddress("8.8.4.4");
+        ArrayList<InetAddress> dnsServers = new ArrayList<>();
+        dnsServers.add(dns1);
+        dnsServers.add(dns2);
+        StaticIpConfiguration staticIpConfig = new StaticIpConfiguration.Builder()
+                .setIpAddress(linkAddr)
+                .setGateway(gateway)
+                .setDnsServers(dnsServers)
+                .build();
+        ProxyInfo proxy1 = ProxyInfo.buildDirectProxy("test1", 8888);
+        ProxyInfo proxy2 = ProxyInfo.buildDirectProxy("test2", 8888);
+
+        mIpConfiguration1 = new IpConfiguration.Builder()
+                .setStaticIpConfiguration(staticIpConfig)
+                .setHttpProxy(proxy1)
+                .build();
+        mIpConfiguration2 = new IpConfiguration.Builder()
+                .setStaticIpConfiguration(staticIpConfig)
+                .setHttpProxy(proxy2)
+                .build();
+
+        mNetworkCapabilities = new NetworkCapabilities.Builder()
+                .addTransportType(NetworkCapabilities.TRANSPORT_ETHERNET)
+                .build();
+    }
+
+    private void assertIpConfigurationEqual(IpConfiguration source, IpConfiguration target) {
+        assertEquals(source.getIpAssignment(), target.getIpAssignment());
+        assertEquals(source.getProxySettings(), target.getProxySettings());
+        assertEquals(source.getHttpProxy(), target.getHttpProxy());
+        assertEquals(source.getStaticIpConfiguration(), target.getStaticIpConfiguration());
+    }
+
+    private void assertNetworkCapabilitiesEqual(
+            NetworkCapabilities source, NetworkCapabilities target) {
+        assertTrue(source.equalsNetCapabilities(target));
+    }
+
+    @Test
+    public void testConstructor() {
+        EthernetConfiguration config =
+                new EthernetConfiguration(mIpConfiguration1, mNetworkCapabilities);
+        assertIpConfigurationEqual(config.getIpConfiguration(), mIpConfiguration1);
+        assertNetworkCapabilitiesEqual(config.getNetworkCapabilities(), mNetworkCapabilities);
+    }
+
+    @Test
+    public void testConstructorWithNullIpConfig() {
+        assertThrows(NullPointerException.class,
+                () -> new EthernetConfiguration(null, mNetworkCapabilities));
+    }
+
+    @Test
+    public void testConstructorWithNulNetCapabilities() {
+        assertThrows(NullPointerException.class,
+                () -> new EthernetConfiguration(mIpConfiguration1, null));
+    }
+
+    @Test
+    public void testHashCodeConsistency() {
+        EthernetConfiguration config =
+                new EthernetConfiguration(mIpConfiguration1, mNetworkCapabilities);
+        int hash1 = config.hashCode();
+        int hash2 = config.hashCode();
+        assertEquals(hash1, hash2);
+    }
+
+    @Test
+    public void testHashCodeOfDifferentConfig() {
+        EthernetConfiguration config1 =
+                new EthernetConfiguration(mIpConfiguration1, mNetworkCapabilities);
+        EthernetConfiguration config2 =
+                new EthernetConfiguration(mIpConfiguration2, mNetworkCapabilities);
+        int hash1 = config1.hashCode();
+        int hash2 = config2.hashCode();
+        assertNotEquals(hash1, hash2);
+    }
+
+    @Test
+    public void testHashCodeOfTheSameConfig() {
+        EthernetConfiguration config1 =
+                new EthernetConfiguration(mIpConfiguration1, mNetworkCapabilities);
+        EthernetConfiguration config2 =
+                new EthernetConfiguration(mIpConfiguration1, mNetworkCapabilities);
+        int hash1 = config1.hashCode();
+        int hash2 = config2.hashCode();
+        assertEquals(hash1, hash2);
+    }
+
+    @Test
+    public void testToString() {
+        EthernetConfiguration config =
+                new EthernetConfiguration(mIpConfiguration1, mNetworkCapabilities);
+        String expect;
+        // After version V, NOT_BANDWIDTH_CONSTRAINED is added to network capabiltiies by default
+        // while devices before V do not have this default capability.
+        if (SdkLevel.isAtLeastV()) {
+            expect = "IP configurations: IP assignment: STATIC\n"
+                    + "Static configuration: IP address 192.168.1.100/25 Gateway 192.168.1.1 "
+                    + " DNS servers: [ 8.8.8.8 8.8.4.4 ] Domains \n"
+                    + "Proxy settings: PAC\n"
+                    + "HTTP proxy: [test1] 8888\n"
+                    + "Network capabilities: [ Transports: ETHERNET Capabilities: NOT_RESTRICTED"
+                    + "&TRUSTED&NOT_VPN&NOT_BANDWIDTH_CONSTRAINED UnderlyingNetworks: Null]";
+        } else {
+            expect = "IP configurations: IP assignment: STATIC\n"
+                    + "Static configuration: IP address 192.168.1.100/25 Gateway 192.168.1.1 "
+                    + " DNS servers: [ 8.8.8.8 8.8.4.4 ] Domains \n"
+                    + "Proxy settings: PAC\n"
+                    + "HTTP proxy: [test1] 8888\n"
+                    + "Network capabilities: [ Transports: ETHERNET Capabilities: NOT_RESTRICTED"
+                    + "&TRUSTED&NOT_VPN UnderlyingNetworks: Null]";
+        }
+        assertEquals(config.toString(), expect);
+    }
+
+    @Test
+    public void testParcel() {
+        EthernetConfiguration config =
+                new EthernetConfiguration(mIpConfiguration1, mNetworkCapabilities);
+        assertParcelingIsLossless(config);
+    }
+}

From 5d3dc48289e39ed39401f5bdc67dffda9deba370 Mon Sep 17 00:00:00 2001
From: Yuyang Huang <yuyanghuang@google.com>
Date: Thu, 24 Apr 2025 16:34:20 +0900
Subject: [PATCH 156/377] Completely disable flaky APF multidevice CTS class

Due to ongoing issues discovered in the APF multidevice CTS, it is safer
to disable the entire test suites rather than individual test cases.
This change removes the ApfV4Test and ApfV6Test classes.

Bug: 406570694
Test: TH
Flag: EXEMPT bugfix
Change-Id: I0f176e2a075fb33625fcc824418484df10137ccc
---
 tests/cts/multidevices/Android.bp   | 4 ++--
 tests/cts/multidevices/run_tests.py | 4 +---
 2 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/tests/cts/multidevices/Android.bp b/tests/cts/multidevices/Android.bp
index 00fb93409c..bf73848b93 100644
--- a/tests/cts/multidevices/Android.bp
+++ b/tests/cts/multidevices/Android.bp
@@ -21,8 +21,8 @@ python_test_host {
     name: "CtsConnectivityMultiDevicesTestCases",
     main: "run_tests.py",
     srcs: [
-        "apfv4_test.py",
-        "apfv6_test.py",
+        // "apfv4_test.py",
+        // "apfv6_test.py",
         "connectivity_multi_devices_test.py",
         "run_tests.py",
     ],
diff --git a/tests/cts/multidevices/run_tests.py b/tests/cts/multidevices/run_tests.py
index a0d0bec587..1ac43b9ab9 100644
--- a/tests/cts/multidevices/run_tests.py
+++ b/tests/cts/multidevices/run_tests.py
@@ -15,8 +15,6 @@
 """Main entrypoint for all of test cases."""
 
 import sys
-from apfv4_test import ApfV4Test
-from apfv6_test import ApfV6Test
 from connectivity_multi_devices_test import ConnectivityMultiDevicesTest
 from mobly import suite_runner
 
@@ -36,4 +34,4 @@ if __name__ == "__main__":
     index = sys.argv.index("--")
     sys.argv = sys.argv[:1] + sys.argv[index + 1 :]
   # TODO: make the tests can be executed without manually list classes.
-  suite_runner.run_suite([ConnectivityMultiDevicesTest, ApfV4Test, ApfV6Test], sys.argv)
+  suite_runner.run_suite([ConnectivityMultiDevicesTest], sys.argv)

From 1ec83693418d4c37711de8937e8b7b6db9dd167c Mon Sep 17 00:00:00 2001
From: Sandro Montanari <sandrom@google.com>
Date: Thu, 24 Apr 2025 02:57:41 -0700
Subject: [PATCH 157/377] Replace log lists with same version and later
 timestamp

Fixes: 409236434
Test: atest NetworkSecurityUnitTests
Flag: com.android.net.ct.flags.certificate_transparency_service
Change-Id: I350211ee4886a8ba678fc64067cd134f8783e220
---
 .../server/net/ct/CompatibilityVersion.java   | 96 +++++++++++++------
 .../net/ct/CompatibilityVersionTest.java      | 66 +++++++++----
 2 files changed, 116 insertions(+), 46 deletions(-)

diff --git a/networksecurity/service/src/com/android/server/net/ct/CompatibilityVersion.java b/networksecurity/service/src/com/android/server/net/ct/CompatibilityVersion.java
index 0a91963ce4..201d6ad1a0 100644
--- a/networksecurity/service/src/com/android/server/net/ct/CompatibilityVersion.java
+++ b/networksecurity/service/src/com/android/server/net/ct/CompatibilityVersion.java
@@ -32,6 +32,7 @@ import org.json.JSONObject;
 
 import java.io.ByteArrayInputStream;
 import java.io.File;
+import java.io.FileInputStream;
 import java.io.IOException;
 import java.io.InputStream;
 import java.nio.file.Files;
@@ -55,8 +56,7 @@ class CompatibilityVersion {
     private final File mVersionDirectory;
     private final File mCurrentLogsDirSymlink;
 
-    CompatibilityVersion(
-            String compatVersion, String metadataUrl, String contentUrl) {
+    CompatibilityVersion(String compatVersion, String metadataUrl, String contentUrl) {
         mCompatVersion = compatVersion;
         mMetadataUrl = metadataUrl;
         mContentUrl = contentUrl;
@@ -79,22 +79,74 @@ class CompatibilityVersion {
      */
     LogListUpdateStatus install(InputStream newContent, LogListUpdateStatus.Builder statusBuilder)
             throws IOException {
-        String content = new String(newContent.readAllBytes(), UTF_8);
+        byte[] contentBytes = newContent.readAllBytes();
+        File logsDir = null;
+        long timestamp;
         try {
-            JSONObject contentJson = new JSONObject(content);
-            return install(
-                    new ByteArrayInputStream(content.getBytes()),
-                    contentJson.getString("version"),
-                    statusBuilder.setLogListTimestamp(contentJson.getLong("log_list_timestamp")));
+            JSONObject contentJson = new JSONObject(new String(contentBytes, UTF_8));
+            logsDir =
+                    new File(mVersionDirectory, LOGS_DIR_PREFIX + contentJson.getString("version"));
+            timestamp = contentJson.getLong("log_list_timestamp");
         } catch (JSONException e) {
             Log.e(TAG, "invalid log list format", e);
-
             return statusBuilder.setState(CTLogListUpdateState.LOG_LIST_INVALID).build();
         }
+
+        if (!shouldInstall(logsDir, timestamp)) {
+            Log.i(TAG, logsDir + " already exists, skipping install.");
+            deleteOldLogDirectories();
+            return statusBuilder
+                    .setLogListTimestamp(timestamp)
+                    .setState(CTLogListUpdateState.VERSION_ALREADY_EXISTS)
+                    .build();
+        }
+
+        return install(
+                new ByteArrayInputStream(contentBytes),
+                logsDir,
+                statusBuilder.setLogListTimestamp(timestamp));
+    }
+
+    boolean shouldInstall(File logsDir, long newTimestamp) throws IOException {
+        // This new version was not seen before, proceed with installation.
+        if (!logsDir.exists()) {
+            return true;
+        }
+
+        // If the symlink has not been updated then the previous installation failed and
+        // this is a re-attempt. Clean-up leftover files and try again.
+        if (!logsDir.getCanonicalPath().equals(mCurrentLogsDirSymlink.getCanonicalPath())) {
+            Log.i(TAG, logsDir + " installation failed, reattempt.");
+            DirectoryUtils.removeDir(logsDir);
+            return true;
+        }
+
+        long existingTimestamp;
+        try (InputStream logListFile =
+                new FileInputStream(new File(logsDir, LOGS_LIST_FILE_NAME))) {
+            existingTimestamp =
+                    new JSONObject(new String(logListFile.readAllBytes(), UTF_8))
+                            .getLong("log_list_timestamp");
+        } catch (JSONException e) {
+            Log.w(TAG, "The existing log list is not a valid JSON file", e);
+            DirectoryUtils.removeDir(logsDir);
+            return true;
+        }
+        // If the previous installation was successful but the new log list has a later timestamp it
+        // means it's a bug fix for a previously broken version.
+        if (existingTimestamp < newTimestamp) {
+            Log.i(TAG, "The new log list has a later timestamp.");
+            DirectoryUtils.removeDir(logsDir);
+            return true;
+        }
+
+        // In all other cases, the update died between steps 5 and 6 and so we cannot delete the
+        // directory since it is in use.
+        return false;
     }
 
     LogListUpdateStatus install(
-            InputStream newContent, String version, LogListUpdateStatus.Builder statusBuilder)
+            InputStream newContent, File newLogsDir, LogListUpdateStatus.Builder statusBuilder)
             throws IOException {
         // To support atomically replacing the old configuration directory with the new
         // there's a bunch of steps. We create a new directory with the logs and then do
@@ -103,32 +155,18 @@ class CompatibilityVersion {
         DirectoryUtils.makeDir(sRootDirectory);
         DirectoryUtils.makeDir(mVersionDirectory);
 
-        File newLogsDir = new File(mVersionDirectory, LOGS_DIR_PREFIX + version);
-        // 2. Handle the corner case where the new directory already exists.
-        if (newLogsDir.exists()) {
-            // If the symlink has already been updated then the update died between steps 6
-            // and 7 and so we cannot delete the directory since it is in use.
-            if (newLogsDir.getCanonicalPath().equals(mCurrentLogsDirSymlink.getCanonicalPath())) {
-                Log.i(TAG, newLogsDir + " already exists, skipping install.");
-                deleteOldLogDirectories();
-                return statusBuilder.setState(CTLogListUpdateState.VERSION_ALREADY_EXISTS).build();
-            }
-            // If the symlink has not been updated then the previous installation failed and
-            // this is a re-attempt. Clean-up leftover files and try again.
-            DirectoryUtils.removeDir(newLogsDir);
-        }
         try {
-            // 3. Create a new logs-<new_version>/ directory to store the new list.
+            // 2. Create a new logs-<new_version>/ directory to store the new list.
             DirectoryUtils.makeDir(newLogsDir);
 
-            // 4. Move the log list json file in logs-<new_version>/ .
+            // 3. Move the log list json file in logs-<new_version>/ .
             File logListFile = new File(newLogsDir, LOGS_LIST_FILE_NAME);
             if (Files.copy(newContent, logListFile.toPath()) == 0) {
                 throw new IOException("The log list appears empty");
             }
             DirectoryUtils.setWorldReadable(logListFile);
 
-            // 5. Create temp symlink. We rename to the target symlink for an atomic update.
+            // 4. Create temp symlink. We rename to the target symlink for an atomic update.
             File tempSymlink = new File(mVersionDirectory, "new_symlink");
             try {
                 Os.symlink(newLogsDir.getCanonicalPath(), tempSymlink.getCanonicalPath());
@@ -136,13 +174,13 @@ class CompatibilityVersion {
                 throw new IOException("Failed to create symlink", e);
             }
 
-            // 6. Update the symlink target, this is the actual update step.
+            // 5. Update the symlink target, this is the actual update step.
             tempSymlink.renameTo(mCurrentLogsDirSymlink.getAbsoluteFile());
         } catch (IOException | RuntimeException e) {
             DirectoryUtils.removeDir(newLogsDir);
             throw e;
         }
-        // 7. Cleanup
+        // 6. Cleanup
         Log.i(TAG, "New logs installed at " + newLogsDir);
         deleteOldLogDirectories();
         return statusBuilder.setState(CTLogListUpdateState.SUCCESS).build();
diff --git a/networksecurity/tests/unit/src/com/android/server/net/ct/CompatibilityVersionTest.java b/networksecurity/tests/unit/src/com/android/server/net/ct/CompatibilityVersionTest.java
index 0d15183140..7964350fa3 100644
--- a/networksecurity/tests/unit/src/com/android/server/net/ct/CompatibilityVersionTest.java
+++ b/networksecurity/tests/unit/src/com/android/server/net/ct/CompatibilityVersionTest.java
@@ -120,7 +120,7 @@ public class CompatibilityVersionTest {
 
         try (InputStream inputStream = asStream(logList)) {
             assertThat(mCompatVersion.install(inputStream, LogListUpdateStatus.builder()))
-                    .isEqualTo(getSuccessfulUpdateStatus());
+                    .isEqualTo(getSuccessfulUpdateStatus(LOG_LIST_TIMESTAMP));
         }
 
         File logListFile = mCompatVersion.getLogsFile();
@@ -147,9 +147,9 @@ public class CompatibilityVersionTest {
 
     @Test
     public void testCompatibilityVersion_deleteSuccessfully() throws Exception {
-        try (InputStream inputStream = asStream(makeLogList(/* version= */ "123"))) {
+        try (InputStream inputStream = asStream(makeLogList(/* version= */ "123", "any_content"))) {
             assertThat(mCompatVersion.install(inputStream, LogListUpdateStatus.builder()))
-                    .isEqualTo(getSuccessfulUpdateStatus());
+                    .isEqualTo(getSuccessfulUpdateStatus(LOG_LIST_TIMESTAMP));
         }
 
         mCompatVersion.delete();
@@ -182,27 +182,35 @@ public class CompatibilityVersionTest {
         JSONObject newLogList = makeLogList(existingVersion, "i_am_the_real_content");
         try (InputStream inputStream = asStream(newLogList)) {
             assertThat(mCompatVersion.install(inputStream, LogListUpdateStatus.builder()))
-                    .isEqualTo(getSuccessfulUpdateStatus());
+                    .isEqualTo(getSuccessfulUpdateStatus(LOG_LIST_TIMESTAMP));
         }
 
         assertThat(readAsString(logsListFile)).isEqualTo(newLogList.toString());
     }
 
     @Test
-    public void testCompatibilityVersion_versionAlreadyExists_installFails() throws Exception {
+    public void testCompatibilityVersion_versionAlreadyExists_earlierTimestamp_installFails()
+            throws Exception {
         String existingVersion = "666";
-        JSONObject existingLogList = makeLogList(existingVersion, "i_was_installed_successfully");
+        long existingTimestamp = 123456;
+        JSONObject existingLogList =
+                makeLogList(existingVersion, "i_was_installed_successfully", existingTimestamp);
         try (InputStream inputStream = asStream(existingLogList)) {
             assertThat(mCompatVersion.install(inputStream, LogListUpdateStatus.builder()))
-                    .isEqualTo(getSuccessfulUpdateStatus());
+                    .isEqualTo(getSuccessfulUpdateStatus(existingTimestamp));
         }
 
-        try (InputStream inputStream = asStream(makeLogList(existingVersion, "i_am_ignored"))) {
+        try (InputStream inputStream =
+                asStream(
+                        makeLogList(
+                                existingVersion,
+                                "i_am_same_version_but_older",
+                                existingTimestamp - 1))) {
             assertThat(mCompatVersion.install(inputStream, LogListUpdateStatus.builder()))
                     .isEqualTo(
                             LogListUpdateStatus.builder()
                                     .setState(VERSION_ALREADY_EXISTS)
-                                    .setLogListTimestamp(LOG_LIST_TIMESTAMP)
+                                    .setLogListTimestamp(existingTimestamp - 1)
                                     .build());
         }
 
@@ -210,24 +218,48 @@ public class CompatibilityVersionTest {
                 .isEqualTo(existingLogList.toString());
     }
 
+    @Test
+    public void testCompatibilityVersion_versionAlreadyExists_laterTimestamp_installSucceeds()
+            throws Exception {
+        String existingVersion = "666";
+        long existingTimestamp = 123456L;
+        JSONObject existingLogList =
+                makeLogList(existingVersion, "i_was_installed_successfully", existingTimestamp);
+        try (InputStream inputStream = asStream(existingLogList)) {
+            assertThat(mCompatVersion.install(inputStream, LogListUpdateStatus.builder()))
+                    .isEqualTo(getSuccessfulUpdateStatus(existingTimestamp));
+        }
+
+        JSONObject newLogList =
+                makeLogList(existingVersion, "i_am_same_version_but_newer", existingTimestamp + 1);
+        try (InputStream inputStream = asStream(newLogList)) {
+            assertThat(mCompatVersion.install(inputStream, LogListUpdateStatus.builder()))
+                    .isEqualTo(getSuccessfulUpdateStatus(existingTimestamp + 1));
+        }
+
+        assertThat(readAsString(mCompatVersion.getLogsFile())).isEqualTo(newLogList.toString());
+    }
+
     private static InputStream asStream(JSONObject logList) throws IOException {
         return new ByteArrayInputStream(logList.toString().getBytes());
     }
 
-    private static JSONObject makeLogList(String version) throws JSONException {
+    private static JSONObject makeLogList(String version, String content) throws JSONException {
+        return makeLogList(version, content, LOG_LIST_TIMESTAMP);
+    }
+
+    private static JSONObject makeLogList(String version, String content, long timestamp)
+            throws JSONException {
         return new JSONObject()
                 .put("version", version)
-                .put("log_list_timestamp", LOG_LIST_TIMESTAMP);
+                .put("log_list_timestamp", timestamp)
+                .put("content", content);
     }
 
-    private static JSONObject makeLogList(String version, String content) throws JSONException {
-        return makeLogList(version).put("content", content);
-    }
-
-    private static LogListUpdateStatus getSuccessfulUpdateStatus() {
+    private static LogListUpdateStatus getSuccessfulUpdateStatus(long timestamp) {
         return LogListUpdateStatus.builder()
                 .setState(SUCCESS)
-                .setLogListTimestamp(LOG_LIST_TIMESTAMP)
+                .setLogListTimestamp(timestamp)
                 .build();
     }
 

From 9bca06aa43fdeb7bbfeeb40d1f2daf772358a143 Mon Sep 17 00:00:00 2001
From: Yuyang Huang <yuyanghuang@google.com>
Date: Thu, 24 Apr 2025 03:02:15 -0700
Subject: [PATCH 158/377] Revert "Completely disable flaky APF multidevice CTS
 class"

This reverts commit 5d3dc48289e39ed39401f5bdc67dffda9deba370.

Reason for revert: target for 25Q4

Bug: 406570694
Change-Id: I124d7bcb2a09cab2d825042814adb262fd2e50cf
---
 tests/cts/multidevices/Android.bp   | 4 ++--
 tests/cts/multidevices/run_tests.py | 4 +++-
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/tests/cts/multidevices/Android.bp b/tests/cts/multidevices/Android.bp
index bf73848b93..00fb93409c 100644
--- a/tests/cts/multidevices/Android.bp
+++ b/tests/cts/multidevices/Android.bp
@@ -21,8 +21,8 @@ python_test_host {
     name: "CtsConnectivityMultiDevicesTestCases",
     main: "run_tests.py",
     srcs: [
-        // "apfv4_test.py",
-        // "apfv6_test.py",
+        "apfv4_test.py",
+        "apfv6_test.py",
         "connectivity_multi_devices_test.py",
         "run_tests.py",
     ],
diff --git a/tests/cts/multidevices/run_tests.py b/tests/cts/multidevices/run_tests.py
index 1ac43b9ab9..a0d0bec587 100644
--- a/tests/cts/multidevices/run_tests.py
+++ b/tests/cts/multidevices/run_tests.py
@@ -15,6 +15,8 @@
 """Main entrypoint for all of test cases."""
 
 import sys
+from apfv4_test import ApfV4Test
+from apfv6_test import ApfV6Test
 from connectivity_multi_devices_test import ConnectivityMultiDevicesTest
 from mobly import suite_runner
 
@@ -34,4 +36,4 @@ if __name__ == "__main__":
     index = sys.argv.index("--")
     sys.argv = sys.argv[:1] + sys.argv[index + 1 :]
   # TODO: make the tests can be executed without manually list classes.
-  suite_runner.run_suite([ConnectivityMultiDevicesTest], sys.argv)
+  suite_runner.run_suite([ConnectivityMultiDevicesTest, ApfV4Test, ApfV6Test], sys.argv)

From fbe94c3b0047376517f085c1c91a221180cc1853 Mon Sep 17 00:00:00 2001
From: Junyu Lai <junyulai@google.com>
Date: Thu, 24 Apr 2025 13:58:08 +0800
Subject: [PATCH 159/377] Maintain a set self-certified apps in
 SatelliteAccessController

This is needed for tracking the applications which opted-in to
use the constrained data satellite network as its default by
adding the following property to the <application> tag of its
manifest:
  <property
   android:name="android.telephony.PROPERTY_SATELLITE_DATA_OPTIMIZED"
   android:value="<package name>" />

Flag: EXEMPT flagged with a kill switch
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.connectivity.SatelliteAccessControllerTest \
      --update-device
Bug: 410731080

Change-Id: I00c0ce5e0d7aac1192272e79a19fbab4e3a5e6f1
---
 .../android/server/ConnectivityService.java   |   9 +
 .../connectivity/ConnectivityFlags.java       |   3 +
 .../SatelliteAccessController.java            | 170 ++++++++++++++----
 .../SatelliteAccessControllerTest.kt          | 168 +++++++++++++++--
 4 files changed, 304 insertions(+), 46 deletions(-)

diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index f1b701f25e..f691b04606 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -7735,6 +7735,9 @@ public class ConnectivityService extends IConnectivityManager.Stub
         final List<PackageInfo> apps = mContext.getPackageManager()
                 .getInstalledPackagesAsUser(GET_PERMISSIONS, user.getIdentifier());
         mPermissionMonitor.onUserAddedWithInstalledPackageList(user, apps);
+        if (mSatelliteAccessController != null) {
+            mSatelliteAccessController.onUserAddedWithInstalledPackageList(user, apps);
+        }
     }
 
     @Override
@@ -7757,12 +7760,18 @@ public class ConnectivityService extends IConnectivityManager.Stub
     public void onPackageAdded(@NonNull final String packageName, final int uid) {
         handlePackageChanged(packageName);
         mPermissionMonitor.onPackageAdded(packageName, uid);
+        if (mSatelliteAccessController != null) {
+            mSatelliteAccessController.onPackageAdded(packageName, uid);
+        }
     }
 
     @Override
     public void onPackageRemoved(@NonNull final String packageName, final int uid) {
         handlePackageChanged(packageName);
         mPermissionMonitor.onPackageRemoved(packageName, uid);
+        if (mSatelliteAccessController != null) {
+            mSatelliteAccessController.onPackageRemoved(packageName, uid);
+        }
     }
 
     @Override
diff --git a/service/src/com/android/server/connectivity/ConnectivityFlags.java b/service/src/com/android/server/connectivity/ConnectivityFlags.java
index fd24951049..1655328816 100644
--- a/service/src/com/android/server/connectivity/ConnectivityFlags.java
+++ b/service/src/com/android/server/connectivity/ConnectivityFlags.java
@@ -67,6 +67,9 @@ public final class ConnectivityFlags {
 
     public static final String CLOSE_QUIC_CONNECTION = "close_quic_connection";
 
+    public static final String CONSTRAINED_DATA_SATELLITE_OPTIN =
+            "constrained_data_satellite_optin";
+
     private boolean mNoRematchAllRequestsOnRegister;
 
     /**
diff --git a/service/src/com/android/server/connectivity/SatelliteAccessController.java b/service/src/com/android/server/connectivity/SatelliteAccessController.java
index 65993909a1..5e6d5cc603 100644
--- a/service/src/com/android/server/connectivity/SatelliteAccessController.java
+++ b/service/src/com/android/server/connectivity/SatelliteAccessController.java
@@ -16,22 +16,27 @@
 
 package com.android.server.connectivity;
 
+import static android.os.Process.INVALID_UID;
+
+import static com.android.server.connectivity.ConnectivityFlags.CONSTRAINED_DATA_SATELLITE_OPTIN;
+
 import android.Manifest;
 import android.annotation.NonNull;
 import android.app.role.OnRoleHoldersChangedListener;
 import android.app.role.RoleManager;
 import android.content.Context;
 import android.content.pm.ApplicationInfo;
+import android.content.pm.PackageInfo;
 import android.content.pm.PackageManager;
 import android.os.Handler;
-import android.os.Process;
 import android.os.UserHandle;
-import android.os.UserManager;
+import android.text.TextUtils;
 import android.util.ArraySet;
 import android.util.Log;
 import android.util.SparseArray;
 
 import com.android.internal.annotations.VisibleForTesting;
+import com.android.net.module.util.DeviceConfigUtils;
 
 import java.util.List;
 import java.util.Set;
@@ -45,17 +50,32 @@ import java.util.function.Consumer;
  */
 public class SatelliteAccessController {
     private static final String TAG = SatelliteAccessController.class.getSimpleName();
+    // Shamelessly copied from telephony/satellite/SatelliteManager.java.
+    @VisibleForTesting
+    public static final String PROPERTY_SATELLITE_DATA_OPTIMIZED =
+            "android.telephony.PROPERTY_SATELLITE_DATA_OPTIMIZED";
+    // This value is taken from android.os.UserHandle#PER_USER_RANGE.
+    @VisibleForTesting
+    public static final int PER_USER_RANGE = 100000;
     private final Context mContext;
     private final Dependencies mDeps;
     private final DefaultMessageRoleListener mDefaultMessageRoleListener;
     private final Consumer<Set<Integer>> mCallback;
     private final Handler mConnectivityServiceHandler;
+    private final PackageManager mPackageManager;
+    private final boolean mSupportConstrainedDataSatelliteOptIn;
 
     // At this sparseArray, Key is userId and values are uids of SMS apps that are allowed
     // to use satellite network as fallback.
     private final SparseArray<Set<Integer>> mAllUsersSatelliteNetworkFallbackUidCache =
             new SparseArray<>();
 
+    // Set of UIDs that have declared the
+    // {@code android.telephony.PROPERTY_SATELLITE_DATA_OPTIMIZED} property
+    // with a value of package name in their manifest file. This variable will only be
+    // accessed on the handler thread.
+    private final Set<Integer> mSatelliteDataOptimizedUids = new ArraySet<>();
+
     /**
      *  Monitor {@link android.app.role.OnRoleHoldersChangedListener#onRoleHoldersChanged(String,
      *  UserHandle)},
@@ -104,6 +124,12 @@ public class SatelliteAccessController {
                 @NonNull OnRoleHoldersChangedListener listener, UserHandle user) {
             mRoleManager.addOnRoleHoldersChangedListenerAsUser(executor, listener, user);
         }
+
+        /** Return whether constrained data satellite opt-in is supported. */
+        public boolean supportConstrainedDataSatelliteOptIn(Context context) {
+            return DeviceConfigUtils.isTetheringFeatureNotChickenedOut(context,
+                    CONSTRAINED_DATA_SATELLITE_OPTIN);
+        }
     }
 
     @VisibleForTesting
@@ -115,6 +141,8 @@ public class SatelliteAccessController {
         mDefaultMessageRoleListener = new DefaultMessageRoleListener();
         mCallback = callback;
         mConnectivityServiceHandler = connectivityServiceInternalHandler;
+        mPackageManager = mContext.getPackageManager();
+        mSupportConstrainedDataSatelliteOptIn = mDeps.supportConstrainedDataSatelliteOptIn(c);
     }
 
     private Set<Integer> updateSatelliteNetworkFallbackUidListCache(List<String> packageNames,
@@ -129,7 +157,7 @@ public class SatelliteAccessController {
                 // cache list.
                 if (isSatellitePermissionEnabled(pm, packageName)) {
                     int uid = getUidForPackage(pm, packageName);
-                    if (uid != Process.INVALID_UID) {
+                    if (uid != INVALID_UID) {
                         fallbackUids.add(uid);
                     }
                 }
@@ -150,7 +178,7 @@ public class SatelliteAccessController {
 
     private int getUidForPackage(PackageManager packageManager, String pkgName) {
         if (pkgName == null) {
-            return Process.INVALID_UID;
+            return INVALID_UID;
         }
         try {
             ApplicationInfo applicationInfo = packageManager.getApplicationInfo(pkgName, 0);
@@ -158,13 +186,13 @@ public class SatelliteAccessController {
         } catch (PackageManager.NameNotFoundException exception) {
             Log.e(TAG, "Unable to find uid for package: " + pkgName);
         }
-        return Process.INVALID_UID;
+        return INVALID_UID;
     }
 
     // on Role sms change triggered by OnRoleHoldersChangedListener()
     private void onRoleSmsChanged(@NonNull UserHandle userHandle) {
         int userId = userHandle.getIdentifier();
-        if (userId == Process.INVALID_UID) {
+        if (userId == INVALID_UID) {
             Log.wtf(TAG, "Invalid User Id");
             return;
         }
@@ -209,34 +237,10 @@ public class SatelliteAccessController {
     }
 
     public void start() {
-        mConnectivityServiceHandler.post(this::updateAllUserRoleSmsUids);
-
         // register sms OnRoleHoldersChangedListener
         mDefaultMessageRoleListener.register();
     }
 
-    private void updateAllUserRoleSmsUids() {
-        UserManager userManager = mContext.getSystemService(UserManager.class);
-        // get existing user handles of available users
-        List<UserHandle> existingUsers = userManager.getUserHandles(true /*excludeDying*/);
-
-        // Iterate through the user handles and obtain their uids with role sms and satellite
-        // communication permission
-        Log.i(TAG, "existing users: " + existingUsers);
-        for (UserHandle userHandle : existingUsers) {
-            onRoleSmsChanged(userHandle);
-        }
-    }
-
-    /**
-     * Called when a user is removed. See {link #ACTION_USER_REMOVED}.
-     *
-     * @param userHandle The userHandle of the removed user. See {@link #EXTRA_USER_HANDLE}.
-     */
-    public void onUserRemoved(@NonNull UserHandle userHandle) {
-        updateSatelliteFallbackUidListOnUserRemoval(userHandle.getIdentifier());
-    }
-
     private void updateSatelliteFallbackUidListOnUserRemoval(int userIdRemoved) {
         Log.i(TAG, "user id removed:" + userIdRemoved);
         if (mAllUsersSatelliteNetworkFallbackUidCache.contains(userIdRemoved)) {
@@ -244,4 +248,110 @@ public class SatelliteAccessController {
             reportSatelliteNetworkFallbackUids();
         }
     }
+
+    /**
+     * Called when a user is added. See {link #ACTION_USER_ADDED}.
+     *
+     * Note that this method will also be called at start up once on the handler thread
+     * to iterate through all existing users.
+     *
+     * @param userHandle The userHandle of the added user. See {@link #EXTRA_USER_HANDLE}.
+     * @param apps The list of packages which is installed on the user.
+     */
+    public void onUserAddedWithInstalledPackageList(@NonNull UserHandle userHandle,
+            @NonNull List<PackageInfo> apps) {
+        // Obtain uids with role sms and satellite communication permission for the added user.
+        onRoleSmsChanged(userHandle);
+
+        if (!mSupportConstrainedDataSatelliteOptIn) return;
+
+        final Set<Integer> satelliteDataOptimizedAppsForUser =
+                getSatelliteDataOptimizedAppsForUser(apps);
+        Log.i(TAG, "Add SatelliteDataOptimizedApps + for user " + userHandle + ": "
+                + satelliteDataOptimizedAppsForUser);
+        mSatelliteDataOptimizedUids.addAll(satelliteDataOptimizedAppsForUser);
+    }
+
+    /**
+     * Called when a user is removed. See {link #ACTION_USER_REMOVED}.
+     *
+     * @param userHandle The integer userHandle of the removed user. See {@link #EXTRA_USER_HANDLE}.
+     */
+    public void onUserRemoved(@NonNull UserHandle userHandle) {
+        updateSatelliteFallbackUidListOnUserRemoval(userHandle.getIdentifier());
+        if (mSupportConstrainedDataSatelliteOptIn) {
+            removeSatelliteDataOptimizedAppsForUser(userHandle.getIdentifier());
+        }
+    }
+
+    /**
+     * Called when a package is added.
+     *
+     * @param packageName The name of the new package.
+     * @param uid The uid of the new package.
+     */
+    public void onPackageAdded(@NonNull final String packageName, final int uid) {
+        if (mSupportConstrainedDataSatelliteOptIn && isSatelliteDataOptimizedApp(packageName)) {
+            mSatelliteDataOptimizedUids.add(uid);
+        }
+    }
+
+    /**
+     * Called when a package is removed.
+     *
+     * @param packageName The name of the removed package or null.
+     * @param uid containing the integer uid previously assigned to the package.
+     */
+    public void onPackageRemoved(@NonNull final String packageName, final int uid) {
+        if (!mSupportConstrainedDataSatelliteOptIn) return;
+
+        // Scan for all apps sharing the same uid.
+        final String [] pkgs = mPackageManager.getPackagesForUid(uid);
+        if (pkgs != null) {
+            for (String pkg : pkgs) {
+                if (!pkg.equals(packageName) && isSatelliteDataOptimizedApp(pkg)) {
+                    return; // Early return if another satellite-optimized app shares the UID
+                }
+            }
+        }
+        // If the loop completes without returning, it means no other
+        // satellite-optimized app shares the UID.
+        mSatelliteDataOptimizedUids.remove(uid);
+    }
+
+    /** Checks if the given UID is in the set of satellite data optimized UIDs. */
+    @VisibleForTesting
+    public boolean isSatelliteDataOptimizedUid(int uid) {
+        return mSatelliteDataOptimizedUids.contains(uid);
+    }
+
+    /** Gets the number of satellite data optimized UIDs being tracked. */
+    @VisibleForTesting
+    public int getSatelliteDataOptimizedUidCount() {
+        return mSatelliteDataOptimizedUids.size();
+    }
+
+    @NonNull
+    private Set<Integer> getSatelliteDataOptimizedAppsForUser(@NonNull List<PackageInfo> apps) {
+        final ArraySet<Integer> uids = new ArraySet<>();
+        for (PackageInfo app : apps) {
+            if (null == app.applicationInfo || app.applicationInfo.uid < 0) continue;
+            if (isSatelliteDataOptimizedApp(app.packageName)) uids.add(app.applicationInfo.uid);
+        }
+        return uids;
+    }
+
+    private boolean isSatelliteDataOptimizedApp(@NonNull String packageName) {
+        try {
+            final PackageManager.Property property = mPackageManager
+                    .getProperty(PROPERTY_SATELLITE_DATA_OPTIMIZED, packageName);
+            return property.isString() && TextUtils.equals(property.getString(), packageName);
+        } catch (PackageManager.NameNotFoundException e) {
+            return false;
+        }
+    }
+
+    private void removeSatelliteDataOptimizedAppsForUser(int userIdToRemove) {
+        mSatelliteDataOptimizedUids.removeIf(uid -> uid / PER_USER_RANGE == userIdToRemove);
+    }
 }
diff --git a/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt b/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt
index f5d1ddddb9..578b880346 100644
--- a/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt
+++ b/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt
@@ -20,6 +20,7 @@ import android.app.role.OnRoleHoldersChangedListener
 import android.app.role.RoleManager
 import android.content.Context
 import android.content.pm.ApplicationInfo
+import android.content.pm.PackageInfo
 import android.content.pm.PackageManager
 import android.os.Build
 import android.os.Handler
@@ -27,12 +28,21 @@ import android.os.Looper
 import android.os.UserHandle
 import android.os.UserManager
 import android.util.ArraySet
+import com.android.server.connectivity.ConnectivityFlags.CONSTRAINED_DATA_SATELLITE_OPTIN
+import com.android.server.connectivity.SatelliteAccessController.PER_USER_RANGE
+import com.android.server.connectivity.SatelliteAccessController.PROPERTY_SATELLITE_DATA_OPTIMIZED
 import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
 import com.android.testutils.DevSdkIgnoreRunner
+import com.android.testutils.com.android.testutils.SetFeatureFlagsRule
+import com.android.testutils.com.android.testutils.SetFeatureFlagsRule.FeatureFlag
 import java.util.concurrent.CompletableFuture
 import java.util.concurrent.Executor
 import java.util.function.Consumer
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
 import org.junit.Before
+import org.junit.Rule
 import org.junit.Test
 import org.junit.runner.RunWith
 import org.mockito.ArgumentCaptor
@@ -42,9 +52,9 @@ import org.mockito.ArgumentMatchers.eq
 import org.mockito.Mockito.doReturn
 import org.mockito.Mockito.mock
 import org.mockito.Mockito.never
-import org.mockito.Mockito.timeout
 import org.mockito.Mockito.times
 import org.mockito.Mockito.verify
+import org.mockito.Mockito.`when`
 
 private const val PRIMARY_USER = 0
 private const val SECONDARY_USER = 10
@@ -69,22 +79,38 @@ private val PRIMARY_USER_SMS_APP_UID2 = UserHandle.getUid(PRIMARY_USER, SMS_APP_
 private val SECONDARY_USER_SMS_APP_UID1 = UserHandle.getUid(SECONDARY_USER, SMS_APP_ID1)
 private val SECONDARY_USER_SMS_APP_UID2 = UserHandle.getUid(SECONDARY_USER, SMS_APP_ID2)
 
+private const val TEST_PACKAGE1 = "com.android.package1"
+private const val TEST_PACKAGE2 = "com.android.package2"
+private const val TEST_UID1 = 2001
+private const val TEST_UID2 = 2002 + SECONDARY_USER * PER_USER_RANGE // Under 2nd user.
+
 @RunWith(DevSdkIgnoreRunner::class)
 @IgnoreUpTo(Build.VERSION_CODES.TIRAMISU)
 class SatelliteAccessControllerTest {
     private val context = mock(Context::class.java)
     private val primaryUserContext = mock(Context::class.java)
     private val secondaryUserContext = mock(Context::class.java)
+    private val packageManager = mock(PackageManager::class.java)
     private val mPackageManagerPrimaryUser = mock(PackageManager::class.java)
     private val mPackageManagerSecondaryUser = mock(PackageManager::class.java)
     private val mDeps = mock(SatelliteAccessController.Dependencies::class.java)
     private val mCallback = mock(Consumer::class.java) as Consumer<Set<Int>>
     private val userManager = mock(UserManager::class.java)
     private val mHandler = Handler(Looper.getMainLooper())
-    private var mSatelliteAccessController =
-        SatelliteAccessController(context, mDeps, mCallback, mHandler)
+    private lateinit var mSatelliteAccessController: SatelliteAccessController
     private lateinit var mRoleHolderChangedListener: OnRoleHoldersChangedListener
 
+    private val featureFlags = HashSet<String>()
+
+    // This will set feature flags from @FeatureFlag annotations
+    // into the map before setUp() runs.
+    @get:Rule
+    val setFeatureFlagsRule = SetFeatureFlagsRule(
+            { name, enabled ->
+                if (enabled == true) featureFlags.add(name) else featureFlags.remove(name) },
+            { name -> featureFlags.contains(name) }
+    )
+
     private fun <T> mockService(name: String, clazz: Class<T>, service: T) {
         doReturn(name).`when`(context).getSystemServiceName(clazz)
         doReturn(service).`when`(context).getSystemService(name)
@@ -99,6 +125,10 @@ class SatelliteAccessControllerTest {
     fun setup() {
         doReturn(emptyList<UserHandle>()).`when`(userManager).getUserHandles(true)
         mockService(Context.USER_SERVICE, UserManager::class.java, userManager)
+        doReturn(packageManager).`when`(context).packageManager
+        doReturn(featureFlags.contains(CONSTRAINED_DATA_SATELLITE_OPTIN))
+                .`when`(mDeps).supportConstrainedDataSatelliteOptIn(any())
+        mSatelliteAccessController = SatelliteAccessController(context, mDeps, mCallback, mHandler)
 
         doReturn(primaryUserContext).`when`(context).createContextAsUser(PRIMARY_USER_HANDLE, 0)
         doReturn(mPackageManagerPrimaryUser).`when`(primaryUserContext).packageManager
@@ -298,19 +328,6 @@ class SatelliteAccessControllerTest {
         return future.get()
     }
 
-    @Test
-    fun testOnStartUpCallbackSatelliteFallbackUidWithExistingUsers() {
-        doReturn(
-            listOf(PRIMARY_USER_HANDLE)
-        ).`when`(userManager).getUserHandles(true)
-        doReturn(listOf(SMS_APP1))
-            .`when`(mDeps).getRoleHoldersAsUser(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
-        // At start up, SatelliteAccessController must call CS callback with existing users'
-        // default messaging apps uids.
-        startSatelliteAccessController()
-        verify(mCallback, timeout(500)).accept(setOf(PRIMARY_USER_SMS_APP_UID1))
-    }
-
     private fun startSatelliteAccessController() {
         mSatelliteAccessController.start()
         // Get registered listener using captor
@@ -322,4 +339,123 @@ class SatelliteAccessControllerTest {
         )
         mRoleHolderChangedListener = listenerCaptor.value
     }
+
+    private fun makePackageInfo(packageName: String, uid: Int) = PackageInfo().apply {
+        this.packageName = packageName
+        applicationInfo = ApplicationInfo().apply { this.uid = uid }
+    }
+
+    private fun mockGetPackagesForUid(uid: Int, pkgs: Array<String>?) {
+        `when`(packageManager.getPackagesForUid(uid)).thenReturn(pkgs)
+    }
+
+    private fun mockIsSatelliteDataOptimizedApp(packageName: String, isOptimized: Boolean) {
+        val property = mock(PackageManager.Property::class.java)
+        `when`(property.isString).thenReturn(isOptimized)
+        if (isOptimized) {
+            `when`(property.string).thenReturn(packageName)
+        }
+        `when`(packageManager.getProperty(
+                eq(PROPERTY_SATELLITE_DATA_OPTIMIZED),
+                eq(packageName)
+        )).thenReturn(property)
+    }
+
+    @FeatureFlag(name = CONSTRAINED_DATA_SATELLITE_OPTIN)
+    @Test
+    fun testSatelliteOptimizedUids_onPackageAdded() {
+        mockIsSatelliteDataOptimizedApp(TEST_PACKAGE1, true)
+        mSatelliteAccessController.onPackageAdded(TEST_PACKAGE1, TEST_UID1)
+        assertTrue(mSatelliteAccessController.isSatelliteDataOptimizedUid(TEST_UID1))
+        assertEquals(mSatelliteAccessController.satelliteDataOptimizedUidCount, 1)
+    }
+
+    @FeatureFlag(name = CONSTRAINED_DATA_SATELLITE_OPTIN)
+    @Test
+    fun testSatelliteOptimizedUids_onPackageAdded_ignoresIfNotSatelliteOptimized() {
+        mockIsSatelliteDataOptimizedApp(TEST_PACKAGE1, false)
+        mSatelliteAccessController.onPackageAdded(TEST_PACKAGE1, TEST_UID1)
+        assertFalse(mSatelliteAccessController.isSatelliteDataOptimizedUid(TEST_UID1))
+        assertEquals(mSatelliteAccessController.satelliteDataOptimizedUidCount, 0)
+    }
+
+    @FeatureFlag(name = CONSTRAINED_DATA_SATELLITE_OPTIN)
+    @Test
+    fun testSatelliteOptimizedUids_onPackageRemoved_noOtherShareUid() {
+        mockIsSatelliteDataOptimizedApp(TEST_PACKAGE1, true)
+        mockGetPackagesForUid(TEST_UID1, arrayOf(TEST_PACKAGE1))
+
+        mSatelliteAccessController.onPackageAdded(TEST_PACKAGE1, TEST_UID1)
+        assertTrue(mSatelliteAccessController.isSatelliteDataOptimizedUid(TEST_UID1))
+        assertEquals(mSatelliteAccessController.satelliteDataOptimizedUidCount, 1)
+        mSatelliteAccessController.onPackageRemoved(TEST_PACKAGE1, TEST_UID1)
+        assertFalse(mSatelliteAccessController.isSatelliteDataOptimizedUid(TEST_UID1))
+        assertEquals(mSatelliteAccessController.satelliteDataOptimizedUidCount, 0)
+    }
+
+    @FeatureFlag(name = CONSTRAINED_DATA_SATELLITE_OPTIN)
+    @Test
+    fun testSatelliteOptimizedUids_onPackageRemoved_otherShareUid() {
+        mockIsSatelliteDataOptimizedApp(TEST_PACKAGE1, true)
+        mockIsSatelliteDataOptimizedApp(TEST_PACKAGE2, true)
+        mockGetPackagesForUid(TEST_UID1, arrayOf(TEST_PACKAGE1, TEST_PACKAGE2))
+
+        // Verify uid is not removed if there is still another package shares the same uid.
+        mSatelliteAccessController.onPackageAdded(TEST_PACKAGE1, TEST_UID1)
+        assertTrue(mSatelliteAccessController.isSatelliteDataOptimizedUid(TEST_UID1))
+        assertEquals(mSatelliteAccessController.satelliteDataOptimizedUidCount, 1)
+        mSatelliteAccessController.onPackageRemoved(TEST_PACKAGE1, TEST_UID1)
+        assertTrue(mSatelliteAccessController.isSatelliteDataOptimizedUid(TEST_UID1))
+        assertEquals(mSatelliteAccessController.satelliteDataOptimizedUidCount, 1)
+
+        // Verify uid is removed if there is no other package with shared uid.
+        mockGetPackagesForUid(TEST_UID1, null)
+        mSatelliteAccessController.onPackageRemoved(TEST_PACKAGE2, TEST_UID1)
+        assertFalse(mSatelliteAccessController.isSatelliteDataOptimizedUid(TEST_UID1))
+        assertEquals(mSatelliteAccessController.satelliteDataOptimizedUidCount, 0)
+    }
+
+    @FeatureFlag(name = CONSTRAINED_DATA_SATELLITE_OPTIN)
+    @Test
+    fun testSatelliteOptimizedUids_onUserAddedRemoved() {
+        mockIsSatelliteDataOptimizedApp(TEST_PACKAGE1, true)
+        mockIsSatelliteDataOptimizedApp(TEST_PACKAGE2, true)
+        val packageInfo1 = makePackageInfo(TEST_PACKAGE1, TEST_UID1)
+        val packageInfo2 = makePackageInfo(TEST_PACKAGE2, TEST_UID2)
+
+        mSatelliteAccessController
+                .onUserAddedWithInstalledPackageList(PRIMARY_USER_HANDLE, listOf(packageInfo1))
+        mSatelliteAccessController
+                .onUserAddedWithInstalledPackageList(SECONDARY_USER_HANDLE, listOf(packageInfo2))
+        assertTrue(mSatelliteAccessController.isSatelliteDataOptimizedUid(TEST_UID1))
+        assertTrue(mSatelliteAccessController.isSatelliteDataOptimizedUid(TEST_UID2))
+
+        mSatelliteAccessController.onUserRemoved(SECONDARY_USER_HANDLE)
+        // Verify that the app associated with the non-removed user is not removed.
+        assertTrue(mSatelliteAccessController.isSatelliteDataOptimizedUid(TEST_UID1))
+        // Verify that the app associated with the removed user is removed.
+        assertFalse(mSatelliteAccessController.isSatelliteDataOptimizedUid(TEST_UID2))
+
+        mSatelliteAccessController.onUserRemoved(PRIMARY_USER_HANDLE)
+        // Verify everything is removed.
+        assertEquals(mSatelliteAccessController.satelliteDataOptimizedUidCount, 0)
+    }
+
+    @FeatureFlag(name = CONSTRAINED_DATA_SATELLITE_OPTIN, enabled = false)
+    @Test
+    fun testSatelliteOptimizedUids_featureDisabled() {
+        mockIsSatelliteDataOptimizedApp(TEST_PACKAGE1, true)
+        val packageInfo1 = makePackageInfo(TEST_PACKAGE1, TEST_UID1)
+
+        // Verify nothing changes and nothing crashes.
+        mSatelliteAccessController
+                .onUserAddedWithInstalledPackageList(PRIMARY_USER_HANDLE, listOf(packageInfo1))
+        assertEquals(mSatelliteAccessController.satelliteDataOptimizedUidCount, 0)
+        mSatelliteAccessController.onPackageAdded(TEST_PACKAGE1, TEST_UID1)
+        assertEquals(mSatelliteAccessController.satelliteDataOptimizedUidCount, 0)
+        mSatelliteAccessController.onPackageRemoved(TEST_PACKAGE1, TEST_UID1)
+        assertEquals(mSatelliteAccessController.satelliteDataOptimizedUidCount, 0)
+        mSatelliteAccessController.onUserRemoved(PRIMARY_USER_HANDLE)
+        assertEquals(mSatelliteAccessController.satelliteDataOptimizedUidCount, 0)
+    }
 }

From b4f1e46e6d37cb8fc4384eb37a85998f0fb11724 Mon Sep 17 00:00:00 2001
From: Quang Anh Luong <qal@google.com>
Date: Fri, 18 Apr 2025 09:54:16 +0900
Subject: [PATCH 160/377] Refactor CarrierConfigRule carrier privilege

Addressing leftover comments in ag/33040619 regarding carrier privilege
acquisition in CarrierConfigRule with the following changes:
1) Refactored CarrierPrivilegeCallback to match records using a lambda.
2) Added various helper methods to handle calls with permissions.
3) Moved wait for carrier privlege to overrideConfigAndWait.
4) Fixed acquireCarrierPrivilege to append to current cert strings
   instead of overwriting them.
5) Fixed dropCarrierPrivilege to remove from current cert strings
   instead of cleaning up all configs.

Flag: EXEMPT test only change

Bug: 409710349
Test: atest TetheringManagerTest
Change-Id: I1165d95775e809f1aa8905af029fb13df0d3a1a8
---
 .../android/testutils/CarrierConfigRule.kt    | 240 ++++++++++--------
 1 file changed, 132 insertions(+), 108 deletions(-)

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/CarrierConfigRule.kt b/staticlibs/testutils/devicetests/com/android/testutils/CarrierConfigRule.kt
index bfa4019bd2..0dc2b42437 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/CarrierConfigRule.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/CarrierConfigRule.kt
@@ -62,13 +62,25 @@ class CarrierConfigRule : TestRule {
     private val context by lazy { InstrumentationRegistry.getInstrumentation().context }
     private val uiAutomation by lazy { InstrumentationRegistry.getInstrumentation().uiAutomation }
     private val ccm by lazy { context.getSystemService(CarrierConfigManager::class.java) }
+    private val tm by lazy { context.getSystemService(TelephonyManager::class.java) }
+    private val certHash by lazy {
+        val signatures = context.packageManager.getPackageInfo(
+            context.opPackageName,
+            PackageManager.GET_SIGNATURES
+        ).signatures
+
+        val digest = MessageDigest.getInstance("SHA-256")
+        val result = signatures?.get(0)?.toByteArray()?.let {
+            bytesToHexString(digest.digest(it))
+        }
+
+        if (result == null) Log.e(TAG, "Can't get cert!")
+        result
+    }
 
     // Map of (subId) -> (original values of overridden settings)
     private val originalConfigs = mutableMapOf<Int, PersistableBundle>()
 
-    // Map of (subId) -> (original values of carrier privilege)
-    private val originalCarrierPrivileges = mutableMapOf<Int, Boolean>()
-
     // Map of (subId) -> (original values of carrier service package)
     private val originalCarrierServicePackages = mutableMapOf<Int, String?>()
 
@@ -106,14 +118,30 @@ class CarrierConfigRule : TestRule {
     }
 
     private fun overrideConfigAndWait(subId: Int, config: PersistableBundle) {
-        val changeReceiver = ConfigChangeReceiver(subId)
-        context.registerReceiver(changeReceiver, IntentFilter(ACTION_CARRIER_CONFIG_CHANGED))
-        ccm.overrideConfig(subId, config)
-        assertTrue(
-            changeReceiver.cv.block(CARRIER_CONFIG_CHANGE_TIMEOUT_MS),
-            "Timed out waiting for config change for subId $subId"
-        )
-        context.unregisterReceiver(changeReceiver)
+        runAsShell(MODIFY_PHONE_STATE) {
+            val changeReceiver = ConfigChangeReceiver(subId)
+            context.registerReceiver(changeReceiver, IntentFilter(ACTION_CARRIER_CONFIG_CHANGED))
+            ccm.overrideConfig(subId, config)
+            assertTrue(
+                changeReceiver.cv.block(CARRIER_CONFIG_CHANGE_TIMEOUT_MS),
+                "Timed out waiting for config change for subId $subId"
+            )
+            context.unregisterReceiver(changeReceiver)
+        }
+
+        // Carrier privilege status may not be reset yet even after receiving
+        // ACTION_CARRIER_CONFIG_CHANGED, so make sure to also wait for
+        // CarrierPrivilegesCallback before proceeding.
+        if (SdkLevel.isAtLeastT()) {
+            config.getStringArray(
+                CarrierConfigManager.KEY_CARRIER_CERTIFICATE_STRING_ARRAY
+            )?.let {
+                eventuallyExpectCarrierPrivilegesChangedOnSubId(
+                    subId,
+                    it.contains(certHash)
+                )
+            }
+        }
     }
 
     /**
@@ -133,15 +161,12 @@ class CarrierConfigRule : TestRule {
         }
         originalConfig.putAll(previousValues)
 
-        runAsShell(MODIFY_PHONE_STATE) {
-            overrideConfigAndWait(subId, config)
-        }
+        overrideConfigAndWait(subId, config)
     }
 
     /**
      * Converts a byte array into a String of hexadecimal characters.
      *
-     * @param bytes an array of bytes
      * @return hex string representation of bytes array
      */
     private fun bytesToHexString(bytes: ByteArray?): String? {
@@ -167,50 +192,34 @@ class CarrierConfigRule : TestRule {
             )
         }
 
-        fun getCertHash(): String {
-            val pkgInfo = context.packageManager.getPackageInfo(
-                context.opPackageName,
-                PackageManager.GET_SIGNATURES
+        val hasPrivilege = getCarrierPrivilegesOnSubId(subId).uids.contains(Process.myUid())
+        if (hasPrivilege == hold) {
+            Log.w(
+                TAG,
+                "Package ${context.opPackageName} is already ${if (hold) "" else "not "}privileged"
             )
-            val digest = MessageDigest.getInstance("SHA-256")
-            val certHash = digest.digest(pkgInfo.signatures!![0]!!.toByteArray())
-            return bytesToHexString(certHash)!!
+            return
         }
 
-        val tm = context.getSystemService(TelephonyManager::class.java)!!
+        val currentCertStrings = runAsShell(READ_PHONE_STATE) {
+            ccm.getConfigForSubIdCompat(
+                subId,
+                setOf(CarrierConfigManager.KEY_CARRIER_CERTIFICATE_STRING_ARRAY)
+            )
+        }.getStringArray(CarrierConfigManager.KEY_CARRIER_CERTIFICATE_STRING_ARRAY) ?: arrayOf()
 
-        val cpb = PrivilegeWaiterCallback()
-        tryTest {
-            val slotIndex = SubscriptionManager.getSlotIndex(subId)!!
-            runAsShell(READ_PRIVILEGED_PHONE_STATE) {
-                tm.registerCarrierPrivilegesCallback(slotIndex, { it.run() }, cpb)
-            }
-            val currentPrivilege = cpb.expectCarrierPrivilegesChanged()
-            if (currentPrivilege == hold) {
-                if (hold) {
-                    Log.w(TAG, "Package ${context.opPackageName} already is privileged")
-                } else {
-                    Log.w(TAG, "Package ${context.opPackageName} already isn't privileged")
-                }
-                return@tryTest
-            }
-            if (!originalCarrierPrivileges.contains(subId)) {
-                originalCarrierPrivileges.put(subId, currentPrivilege)
-            }
-            if (hold) {
-                addConfigOverrides(subId, PersistableBundle().also {
-                    it.putStringArray(CarrierConfigManager.KEY_CARRIER_CERTIFICATE_STRING_ARRAY,
-                        arrayOf(getCertHash()))
-                })
-            } else {
-                cleanUpNow()
-            }
-            cpb.eventuallyExpectCarrierPrivilegesChanged(hold)
-        } cleanup {
-            runAsShell(READ_PRIVILEGED_PHONE_STATE) {
-                tm.unregisterCarrierPrivilegesCallback(cpb)
-            }
+        val hashes = if (hold) {
+            currentCertStrings + certHash
+        } else {
+            currentCertStrings.subtract(setOf(certHash)).toTypedArray()
         }
+
+        addConfigOverrides(subId, PersistableBundle().apply {
+            putStringArray(
+                CarrierConfigManager.KEY_CARRIER_CERTIFICATE_STRING_ARRAY,
+                hashes
+            )
+        })
     }
 
     /**
@@ -249,15 +258,10 @@ class CarrierConfigRule : TestRule {
             )
         }
 
-        val tm = context.getSystemService(TelephonyManager::class.java)!!
-
         val cv = ConditionVariable()
         val cpb = CarrierServiceChangedWaiterCallback(cv)
         tryTest {
-            val slotIndex = SubscriptionManager.getSlotIndex(subId)!!
-            runAsShell(READ_PRIVILEGED_PHONE_STATE) {
-                tm.registerCarrierPrivilegesCallback(slotIndex, { it.run() }, cpb)
-            }
+            tm.registerCarrierPrivilegesCallbackWithPermission(subId, cpb)
             // Wait for the callback to be registered
             assertTrue(cv.block(CARRIER_CONFIG_CHANGE_TIMEOUT_MS),
                 "Can't register CarrierPrivilegesCallback")
@@ -283,31 +287,77 @@ class CarrierConfigRule : TestRule {
             assertTrue(cv.block(CARRIER_CONFIG_CHANGE_TIMEOUT_MS),
                 "Can't modify carrier service package")
         } cleanup {
-            runAsShell(READ_PRIVILEGED_PHONE_STATE) {
-                tm.unregisterCarrierPrivilegesCallback(cpb)
-            }
+            tm.unregisterCarrierPrivilegesCallbackWithPermission(cpb)
         }
     }
 
-    private class PrivilegeWaiterCallback() :
-        CarrierPrivilegesCallback {
-        private val history = ArrayTrackRecord<Boolean>().ReadHead()
-        override fun onCarrierPrivilegesChanged(p: MutableSet<String>, uids: MutableSet<Int>) {
-            history.add(uids.contains(Process.myUid()))
+    private fun TelephonyManager.registerCarrierPrivilegesCallbackWithPermission(
+        subId: Int,
+        cpb: CarrierPrivilegesCallback
+    ) =
+        runAsShell(READ_PRIVILEGED_PHONE_STATE) {
+            registerCarrierPrivilegesCallback(
+                SubscriptionManager.getSlotIndex(subId)!!,
+                { it.run() },
+                cpb
+            )
         }
 
-        fun expectCarrierPrivilegesChanged(): Boolean {
-            val result = history.poll(CARRIER_CONFIG_CHANGE_TIMEOUT_MS)
+    private fun TelephonyManager.unregisterCarrierPrivilegesCallbackWithPermission(
+        cpb: CarrierPrivilegesCallback
+    ) =
+        runAsShell(READ_PRIVILEGED_PHONE_STATE) {
+            unregisterCarrierPrivilegesCallback(cpb)
+        }
+
+    private class PrivilegeWaiterCallback() : CarrierPrivilegesCallback {
+        data class CarrierPrivileges(val packages: Set<String>, val uids: Set<Int>)
+        private val history = ArrayTrackRecord<CarrierPrivileges>().ReadHead()
+
+        override fun onCarrierPrivilegesChanged(p: MutableSet<String>, uids: MutableSet<Int>) {
+            history.add(CarrierPrivileges(p, uids))
+        }
+
+        fun expectCarrierPrivilegesChanged(): CarrierPrivileges {
+            return eventuallyExpectCarrierPrivilegesChanged { true }
+        }
+
+        fun eventuallyExpectCarrierPrivilegesChanged(
+            predicate: (CarrierPrivileges) -> Boolean
+        ): CarrierPrivileges {
+            val result = history.poll(
+                CARRIER_CONFIG_CHANGE_TIMEOUT_MS,
+                predicate
+            )
             assertNotNull(result, "onCarrierPrivilegesChanged not received!")
             return result
         }
+    }
 
-        fun eventuallyExpectCarrierPrivilegesChanged(privileged: Boolean) {
-            val result = history.poll(
-                CARRIER_CONFIG_CHANGE_TIMEOUT_MS,
-                { it == privileged }
-            )
-            assertNotNull(result, "Carrier privilege did not change to $privileged!")
+    private fun getCarrierPrivilegesOnSubId(
+        subId: Int
+    ): PrivilegeWaiterCallback.CarrierPrivileges {
+        val cpb = PrivilegeWaiterCallback()
+        return tryTest {
+            tm.registerCarrierPrivilegesCallbackWithPermission(subId, cpb)
+            cpb.expectCarrierPrivilegesChanged()
+        } cleanup {
+            tm.unregisterCarrierPrivilegesCallbackWithPermission(cpb)
+        }
+    }
+
+    private fun eventuallyExpectCarrierPrivilegesChangedOnSubId(
+        subId: Int,
+        expectedPrivilege: Boolean
+    ): PrivilegeWaiterCallback.CarrierPrivileges {
+        val cpb = PrivilegeWaiterCallback()
+        return tryTest {
+            tm.registerCarrierPrivilegesCallbackWithPermission(subId, cpb)
+            cpb.eventuallyExpectCarrierPrivilegesChanged {
+                it.uids.contains(Process.myUid()) == expectedPrivilege
+            }
+        } cleanup {
+            tm.unregisterCarrierPrivilegesCallbackWithPermission(cpb)
         }
     }
 
@@ -328,40 +378,14 @@ class CarrierConfigRule : TestRule {
      * test case unless cleaning up earlier is required.
      */
     fun cleanUpNow() {
-        runAsShell(MODIFY_PHONE_STATE) {
-            originalConfigs.forEach { (subId, config) ->
-                try {
-                    // Do not use null as the config to reset, as it would reset configs that may
-                    // have been set by target preparers such as
-                    // ConnectivityTestTargetPreparer / CarrierConfigSetupTest.
-                    overrideConfigAndWait(subId, config)
-                } catch (e: Throwable) {
-                    Log.e(TAG, "Error resetting carrier config for subId $subId")
-                }
+        originalConfigs.forEach { (subId, config) ->
+            try {
+                overrideConfigAndWait(subId, config)
+            } catch (e: Throwable) {
+                Log.e(TAG, "Error resetting carrier config for subId $subId: $e", e)
             }
-            originalConfigs.clear()
         }
-
-        // Carrier privilege status may not be reset yet even after receiving
-        // ACTION_CARRIER_CONFIG_CHANGED, so make sure to also wait for
-        // CarrierPrivilegesCallback before proceeding.
-        val tm = context.getSystemService(TelephonyManager::class.java)!!
-        originalCarrierPrivileges.forEach { (subId, privileged) ->
-            val cpb = PrivilegeWaiterCallback()
-            tryTest {
-                val slotIndex = SubscriptionManager.getSlotIndex(subId)!!
-                runAsShell(READ_PRIVILEGED_PHONE_STATE) {
-                    tm.registerCarrierPrivilegesCallback(slotIndex, { it.run() }, cpb)
-                }
-                cpb.eventuallyExpectCarrierPrivilegesChanged(privileged)
-            } cleanup {
-                runAsShell(READ_PRIVILEGED_PHONE_STATE) {
-                    tm.unregisterCarrierPrivilegesCallback(cpb)
-                }
-            }
-            originalCarrierPrivileges.clear()
-        }
-
+        originalConfigs.clear()
         originalCarrierServicePackages.forEach { (subId, pkg) ->
             setCarrierServicePackageOverride(subId, pkg)
         }

From d92d013872969c620ae9ae5865bf835d5b8e0c4f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Sat, 26 Apr 2025 04:02:48 -0700
Subject: [PATCH 161/377] BpfClassic: fix Gemini's complaints
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

'The comment "if NOT in range [lo, hi], jump over the reject statement" is a bit confusingly phrased for a macro named REJECT_IF_NOT_IN_RANGE'

'A minor stylistic point: offsetof(iphdr, field) and offsetof(ipv6hdr, field) are used. If iphdr and ipv6hdr are not typedefs for struct iphdr and struct ipv6hdr respectively (which is common in standard kernel or system headers), it should strictly be offsetof(struct iphdr, field). However, this often works due to compiler leniency or specific project typedefs. The field_sizeof macro correctly uses struct iphdr. Consistency here would be ideal (e.g., using struct iphdr in offsetof as well).'

Test: TreeHugger
Flag: EXEMPT style
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ia42ac8361fef754a8a66a8a91ee52adcf34c9eb5
---
 bpf/headers/include/bpf/BpfClassic.h | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/bpf/headers/include/bpf/BpfClassic.h b/bpf/headers/include/bpf/BpfClassic.h
index 26d8ad5dff..0bfe77baee 100644
--- a/bpf/headers/include/bpf/BpfClassic.h
+++ b/bpf/headers/include/bpf/BpfClassic.h
@@ -48,7 +48,7 @@
 	BPF_JUMP(BPF_JMP | BPF_JGT | BPF_K, (v), 0, 1), \
 	BPF_REJECT
 
-// *THREE* instructions: compare and if *NOT* in range [lo, hi], jump over the reject statement
+// *THREE* instructions: compare and if *IN* range [lo, hi] jump over the reject statement
 #define BPF3_REJECT_IF_NOT_IN_RANGE(lo, hi) \
 	BPF_JUMP(BPF_JMP | BPF_JGE | BPF_K, (lo), 0, 1), \
 	BPF_JUMP(BPF_JMP | BPF_JGT | BPF_K, (hi), 0, 1), \
@@ -97,42 +97,42 @@
 #define BPF_LOAD_IPV4_U8(field) \
 	BPF_LOAD_NET_RELATIVE_U8(({ \
 	  _Static_assert(field_sizeof(struct iphdr, field) == 1, "field of wrong size"); \
-	  offsetof(iphdr, field); \
+	  offsetof(struct iphdr, field); \
 	}))
 
 // Big/Network Endian 16-bit load from IPv4 header field.
 #define BPF_LOAD_IPV4_BE16(field) \
 	BPF_LOAD_NET_RELATIVE_BE16(({ \
 	  _Static_assert(field_sizeof(struct iphdr, field) == 2, "field of wrong size"); \
-	  offsetof(iphdr, field); \
+	  offsetof(struct iphdr, field); \
 	}))
 
 // Big/Network Endian 32-bit load from IPv4 header field.
 #define BPF_LOAD_IPV4_BE32(field) \
 	BPF_LOAD_NET_RELATIVE_BE32(({ \
 	  _Static_assert(field_sizeof(struct iphdr, field) == 4, "field of wrong size"); \
-	  offsetof(iphdr, field); \
+	  offsetof(struct iphdr, field); \
 	}))
 
 // 8-bit load from IPv6 header field.
 #define BPF_LOAD_IPV6_U8(field) \
 	BPF_LOAD_NET_RELATIVE_U8(({ \
 	  _Static_assert(field_sizeof(struct ipv6hdr, field) == 1, "field of wrong size"); \
-	  offsetof(ipv6hdr, field); \
+	  offsetof(struct ipv6hdr, field); \
 	}))
 
 // Big/Network Endian 16-bit load from IPv6 header field.
 #define BPF_LOAD_IPV6_BE16(field) \
 	BPF_LOAD_NET_RELATIVE_BE16(({ \
 	  _Static_assert(field_sizeof(struct ipv6hdr, field) == 2, "field of wrong size"); \
-	  offsetof(ipv6hdr, field); \
+	  offsetof(struct ipv6hdr, field); \
 	}))
 
 // Big/Network Endian 32-bit load from IPv6 header field.
 #define BPF_LOAD_IPV6_BE32(field) \
 	BPF_LOAD_NET_RELATIVE_BE32(({ \
 	  _Static_assert(field_sizeof(struct ipv6hdr, field) == 4, "field of wrong size"); \
-	  offsetof(ipv6hdr, field); \
+	  offsetof(struct ipv6hdr, field); \
 	}))
 
 // Load the length of the IPv4 header into X index register.

From 76a60c165462c5ccad972db98279e62b61640eab Mon Sep 17 00:00:00 2001
From: Chalard Jean <jchalard@google.com>
Date: Thu, 24 Apr 2025 13:48:46 +0900
Subject: [PATCH 162/377] File the per-app request for opted-in
 satellite-optimized apps

Test: ConnectivityCoverageTest
Bug: 410731080
Flag: EXEMPT controlled in counter-part change ag/33220291
Change-Id: I0307f697a441c2810cafd4643d381e66a0ac9243
---
 .../android/server/ConnectivityService.java   |  53 ++-
 .../SatelliteAccessController.java            |  10 +-
 .../com/android/testutils/HandlerUtilsTest.kt | 110 ++++--
 .../com/android/testutils/HandlerUtils.kt     |  26 +-
 .../ConnectivityServiceIntegrationTest.kt     |   3 +-
 .../server/ConnectivityServiceTest.java       |   4 +-
 .../SatelliteAccessControllerTest.kt          | 105 +++---
 .../connectivityservice/CSPreferenceTest.kt   | 333 ++++++++++++++++++
 .../CSSatelliteNetworkTest.kt                 |  30 +-
 .../server/connectivityservice/base/CSTest.kt |   7 +-
 10 files changed, 534 insertions(+), 147 deletions(-)
 create mode 100644 tests/unit/java/com/android/server/connectivityservice/CSPreferenceTest.kt

diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index 70f1570bfc..269d7489be 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -1656,7 +1656,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
         @Nullable
         public SatelliteAccessController makeSatelliteAccessController(
                 @NonNull final Context context,
-                Consumer<Set<Integer>> updateSatelliteNetworkFallbackUidCallback,
+                BiConsumer<Set<Integer>, Set<Integer>> updateSatelliteNetworkFallbackUidCallback,
                 @NonNull final Handler connectivityServiceInternalHandler) {
             return new SatelliteAccessController(context, updateSatelliteNetworkFallbackUidCallback,
                     connectivityServiceInternalHandler);
@@ -2261,15 +2261,21 @@ public class ConnectivityService extends IConnectivityManager.Stub
     }
 
     /**
-     * Called when satellite network fallback uids at {@link SatelliteAccessController}
+     * Called when satellite network fallback uids from the {@link SatelliteAccessController}
      * cache was updated based on {@link
-     * android.app.role.OnRoleHoldersChangedListener#onRoleHoldersChanged(String, UserHandle)},
-     * to create multilayer request with preference order
-     * {@link #PREFERENCE_ORDER_SATELLITE_FALLBACK} there on.
-     *
+     * android.app.role.OnRoleHoldersChangedListener#onRoleHoldersChanged(String, UserHandle)}
+     * and self-certified applications, to create multilayer request with preference order
+     * {@link #PREFERENCE_ORDER_SATELLITE_FALLBACK}.
      */
-    private void updateSatelliteNetworkPreferenceUids(Set<Integer> satelliteNetworkFallbackUids) {
-        handleSetSatelliteNetworkPreference(satelliteNetworkFallbackUids);
+    private void updateSatelliteNetworkPreferenceUids(
+            @NonNull final Set<Integer> messagingRoleUids,
+            @NonNull final Set<Integer> optinUids
+    ) {
+        if (CollectionUtils.containsAny(messagingRoleUids, optinUids)) {
+            throw new IllegalArgumentException("There can be no overlap between the "
+                    + "messagingRoleUids and the optinUids for satellite");
+        }
+        handleSetSatelliteNetworkPreference(messagingRoleUids, optinUids);
     }
 
     private void handleAlwaysOnNetworkRequest(
@@ -14442,17 +14448,32 @@ public class ConnectivityService extends IConnectivityManager.Stub
     }
 
     ArraySet<NetworkRequestInfo> createMultiLayerNrisFromSatelliteNetworkFallbackUids(
-            @NonNull final Set<Integer> uids) {
-        // request: Satellite internet, satellite network could be restricted or constrained
-        final NetworkCapabilities cap = new NetworkCapabilities.Builder()
+            @NonNull final Set<Integer> messagingRoleUids,
+            @NonNull final Set<Integer> optinUids
+    ) {
+        // The messaging role UIDs should use any Internet-providing satellite network as
+        // a fallback, even if it is restricted.
+        final NetworkCapabilities messagingCap = new NetworkCapabilities.Builder()
                 .addCapability(NET_CAPABILITY_INTERNET)
                 .addCapability(NET_CAPABILITY_NOT_VCN_MANAGED)
                 .removeCapability(NET_CAPABILITY_NOT_RESTRICTED)
                 .removeCapability(NET_CAPABILITY_NOT_BANDWIDTH_CONSTRAINED)
                 .addTransportType(NetworkCapabilities.TRANSPORT_SATELLITE)
                 .build();
-        return createNrisForFallbackDefault(uids, cap,
-                PREFERENCE_ORDER_SATELLITE_FALLBACK);
+        final ArraySet<NetworkRequestInfo> requests = createNrisForFallbackDefault(
+                messagingRoleUids, messagingCap, PREFERENCE_ORDER_SATELLITE_FALLBACK);
+
+        // The apps that have opt-in should use any Internet-providing satellite network
+        // as a fallback, but not if it is restricted.
+        final NetworkCapabilities optinCap = new NetworkCapabilities.Builder()
+                .addCapability(NET_CAPABILITY_INTERNET)
+                .addCapability(NET_CAPABILITY_NOT_VCN_MANAGED)
+                .removeCapability(NET_CAPABILITY_NOT_BANDWIDTH_CONSTRAINED)
+                .addTransportType(NetworkCapabilities.TRANSPORT_SATELLITE)
+                .build();
+        requests.addAll(createNrisForFallbackDefault(
+                optinUids, optinCap, PREFERENCE_ORDER_SATELLITE_FALLBACK));
+        return requests;
     }
 
     private void handleMobileDataPreferredUidsChanged() {
@@ -14465,10 +14486,12 @@ public class ConnectivityService extends IConnectivityManager.Stub
     }
 
     private void handleSetSatelliteNetworkPreference(
-            @NonNull final Set<Integer> satelliteNetworkPreferredUids) {
+            @NonNull final Set<Integer> messagingRoleUids,
+            @NonNull final Set<Integer> optinUids
+    ) {
         removeDefaultNetworkRequestsForPreference(PREFERENCE_ORDER_SATELLITE_FALLBACK);
         addPerAppDefaultNetworkRequests(
-                createMultiLayerNrisFromSatelliteNetworkFallbackUids(satelliteNetworkPreferredUids)
+                createMultiLayerNrisFromSatelliteNetworkFallbackUids(messagingRoleUids, optinUids)
         );
         // Finally, rematch.
         rematchAllNetworksAndRequests();
diff --git a/service/src/com/android/server/connectivity/SatelliteAccessController.java b/service/src/com/android/server/connectivity/SatelliteAccessController.java
index 5e6d5cc603..b1a104cee1 100644
--- a/service/src/com/android/server/connectivity/SatelliteAccessController.java
+++ b/service/src/com/android/server/connectivity/SatelliteAccessController.java
@@ -41,7 +41,7 @@ import com.android.net.module.util.DeviceConfigUtils;
 import java.util.List;
 import java.util.Set;
 import java.util.concurrent.Executor;
-import java.util.function.Consumer;
+import java.util.function.BiConsumer;
 
 /**
  * Tracks the uid of all the default messaging application which are role_sms role and
@@ -60,7 +60,7 @@ public class SatelliteAccessController {
     private final Context mContext;
     private final Dependencies mDeps;
     private final DefaultMessageRoleListener mDefaultMessageRoleListener;
-    private final Consumer<Set<Integer>> mCallback;
+    private final BiConsumer<Set<Integer>, Set<Integer>> mCallback;
     private final Handler mConnectivityServiceHandler;
     private final PackageManager mPackageManager;
     private final boolean mSupportConstrainedDataSatelliteOptIn;
@@ -102,7 +102,7 @@ public class SatelliteAccessController {
     }
 
     public SatelliteAccessController(@NonNull final Context c,
-            Consumer<Set<Integer>> callback,
+            BiConsumer<Set<Integer>, Set<Integer>> callback,
             @NonNull final Handler connectivityServiceInternalHandler) {
         this(c, new Dependencies(c), callback, connectivityServiceInternalHandler);
     }
@@ -134,7 +134,7 @@ public class SatelliteAccessController {
 
     @VisibleForTesting
     SatelliteAccessController(@NonNull final Context c, @NonNull final Dependencies deps,
-            Consumer<Set<Integer>> callback,
+            BiConsumer<Set<Integer>, Set<Integer>> callback,
             @NonNull final Handler connectivityServiceInternalHandler) {
         mContext = c;
         mDeps = deps;
@@ -233,7 +233,7 @@ public class SatelliteAccessController {
                 + mergedSatelliteNetworkFallbackUidCache);
 
         // trigger multiple layer request for satellite network fallback of multi user uids
-        mCallback.accept(mergedSatelliteNetworkFallbackUidCache);
+        mCallback.accept(mergedSatelliteNetworkFallbackUidCache, Set.of());
     }
 
     public void start() {
diff --git a/staticlibs/tests/unit/src/com/android/testutils/HandlerUtilsTest.kt b/staticlibs/tests/unit/src/com/android/testutils/HandlerUtilsTest.kt
index 440b836cc9..b08d785a3c 100644
--- a/staticlibs/tests/unit/src/com/android/testutils/HandlerUtilsTest.kt
+++ b/staticlibs/tests/unit/src/com/android/testutils/HandlerUtilsTest.kt
@@ -19,46 +19,51 @@ package com.android.testutils
 import android.os.Handler
 import android.os.HandlerThread
 import com.android.testutils.FunctionalUtils.ThrowingSupplier
+import kotlin.random.Random
 import kotlin.test.assertEquals
 import kotlin.test.assertFailsWith
 import kotlin.test.assertNull
 import org.junit.Test
 import org.junit.runner.RunWith
-import org.junit.runners.JUnit4
 
 private const val ATTEMPTS = 50 // Causes testWaitForIdle to take about 150ms on aosp_crosshatch-eng
 private const val TIMEOUT_MS = 1000
 
-@RunWith(JUnit4::class)
+@DevSdkIgnoreRunner.MonitorThreadLeak
+@RunWith(DevSdkIgnoreRunner::class)
 class HandlerUtilsTest {
     @Test
     fun testWaitForIdle() {
         val handlerThread = HandlerThread("testHandler").apply { start() }
-
-        // Tests that waitForIdle can be called many times without ill impact if the service is
-        // already idle.
-        repeat(ATTEMPTS) {
-            handlerThread.waitForIdle(TIMEOUT_MS)
-        }
-
-        // Tests that calling waitForIdle waits for messages to be processed. Use both an
-        // inline runnable that's instantiated at each loop run and a runnable that's instantiated
-        // once for all.
-        val tempRunnable = object : Runnable {
-            // Use StringBuilder preferentially to StringBuffer because StringBuilder is NOT
-            // thread-safe. It's part of the point that both runnables run on the same thread
-            // so if anything is wrong in that space it's better to opportunistically use a class
-            // where things might go wrong, even if there is no guarantee of failure.
-            var memory = StringBuilder()
-            override fun run() {
-                memory.append("b")
+        tryTest {
+            // Tests that waitForIdle can be called many times without ill impact if the service is
+            // already idle.
+            repeat(ATTEMPTS) {
+                handlerThread.waitForIdle(TIMEOUT_MS)
             }
-        }
-        repeat(ATTEMPTS) { i ->
-            handlerThread.threadHandler.post { tempRunnable.memory.append("a"); }
-            handlerThread.threadHandler.post(tempRunnable)
-            handlerThread.waitForIdle(TIMEOUT_MS)
-            assertEquals(tempRunnable.memory.toString(), "ab".repeat(i + 1))
+
+            // Tests that calling waitForIdle waits for messages to be processed. Use both an
+            // inline runnable that's instantiated at each loop run and a runnable that's
+            // instantiated once for all.
+            val tempRunnable = object : Runnable {
+                // Use StringBuilder preferentially to StringBuffer because StringBuilder is NOT
+                // thread-safe. It's part of the point that both runnables run on the same thread
+                // so if anything is wrong in that space it's better to opportunistically use a
+                // class where things might go wrong, even if there is no guarantee of failure.
+                var memory = StringBuilder()
+                override fun run() {
+                    memory.append("b")
+                }
+            }
+            repeat(ATTEMPTS) { i ->
+                handlerThread.threadHandler.post { tempRunnable.memory.append("a"); }
+                handlerThread.threadHandler.post(tempRunnable)
+                handlerThread.waitForIdle(TIMEOUT_MS)
+                assertEquals(tempRunnable.memory.toString(), "ab".repeat(i + 1))
+            }
+        } cleanup {
+            handlerThread.quitSafely()
+            handlerThread.join()
         }
     }
 
@@ -67,22 +72,49 @@ class HandlerUtilsTest {
     @Test
     fun testVisibleOnHandlerThread() {
         val handlerThread = HandlerThread("testHandler").apply { start() }
-        val handler = Handler(handlerThread.looper)
+        tryTest {
+            val handler = Handler(handlerThread.looper)
 
-        repeat(ATTEMPTS) { attempt ->
-            var x = -10
-            var y = -11
-            y = visibleOnHandlerThread(handler, ThrowingSupplier<Int> { x = attempt; attempt })
-            assertEquals(attempt, x)
-            assertEquals(attempt, y)
-            handler.post { assertEquals(attempt, x) }
+            repeat(ATTEMPTS) { attempt ->
+                var x = -10
+                var y = -11
+                y = visibleOnHandlerThread(handler, ThrowingSupplier<Int> { x = attempt; attempt })
+                assertEquals(attempt, x)
+                assertEquals(attempt, y)
+                handler.post { assertEquals(attempt, x) }
+            }
+
+            assertFailsWith<IllegalArgumentException> {
+                visibleOnHandlerThread(handler) { throw IllegalArgumentException() }
+            }
+
+            // Null values may be returned by the supplier
+            assertNull(visibleOnHandlerThread(handler, ThrowingSupplier<Nothing?> { null }))
+        } cleanup {
+            handlerThread.quitSafely()
+            handlerThread.join()
         }
+    }
 
-        assertFailsWith<IllegalArgumentException> {
-            visibleOnHandlerThread(handler) { throw IllegalArgumentException() }
+    @Test
+    fun testPostAndWait() {
+        val handlerThread = HandlerThread("testHandler").apply { start() }
+        tryTest {
+            val handler = Handler(handlerThread.looper)
+
+            assertFailsWith<RuntimeException> {
+                handler.postAndWait { throw RuntimeException() }
+            }
+
+            val result1 = Random.nextInt()
+            val result = handler.postAndWait {
+                assertEquals(handlerThread, Thread.currentThread())
+                result1
+            }
+            assertEquals(result, result1)
+        } cleanup {
+            handlerThread.quitSafely()
+            handlerThread.join()
         }
-
-        // Null values may be returned by the supplier
-        assertNull(visibleOnHandlerThread(handler, ThrowingSupplier<Nothing?> { null }))
     }
 }
diff --git a/staticlibs/testutils/devicetests/com/android/testutils/HandlerUtils.kt b/staticlibs/testutils/devicetests/com/android/testutils/HandlerUtils.kt
index f00ca116c7..9b6101756c 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/HandlerUtils.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/HandlerUtils.kt
@@ -21,7 +21,6 @@ package com.android.testutils
 import android.os.ConditionVariable
 import android.os.Handler
 import android.os.HandlerThread
-import android.util.Log
 import com.android.testutils.FunctionalUtils.ThrowingRunnable
 import com.android.testutils.FunctionalUtils.ThrowingSupplier
 import java.lang.Exception
@@ -64,15 +63,27 @@ fun waitForIdleSerialExecutor(executor: Executor, timeoutMs: Long) {
  * To achieve this, this method runs the passed block on the handler and blocks this thread
  * until it's executed, so keep in mind this method will block, (including, if the handler isn't
  * running, blocking forever).
+ *
+ * This method is not guaranteed to run the passed supplier on the handler thread.
  */
-fun <T> visibleOnHandlerThread(handler: Handler, supplier: ThrowingSupplier<T>): T {
+fun <T> visibleOnHandlerThread(handler: Handler, supplier: ThrowingSupplier<T>): T =
+    handler.postAndWait(supplier::get)
+
+/** Overload of visibleOnHandlerThread but executes a block of code that does not return a value. */
+inline fun visibleOnHandlerThread(handler: Handler, r: ThrowingRunnable) {
+    visibleOnHandlerThread(handler, ThrowingSupplier { r.run() })
+}
+
+/**
+ * Run a block on a handler and wait for the result.
+ */
+inline fun <T> Handler.postAndWait(crossinline what: () -> T): T {
     val cv = ConditionVariable()
     var rv: Result<T> = Result.failure(RuntimeException("Not run"))
-    handler.post {
+    post {
         try {
-            rv = Result.success(supplier.get())
+            rv = Result.success(what())
         } catch (exception: Exception) {
-            Log.e(TAG, "visibleOnHandlerThread caught exception", exception)
             rv = Result.failure(exception)
         }
         cv.open()
@@ -83,8 +94,3 @@ fun <T> visibleOnHandlerThread(handler: Handler, supplier: ThrowingSupplier<T>):
     cv.block()
     return rv.getOrThrow()
 }
-
-/** Overload of visibleOnHandlerThread but executes a block of code that does not return a value. */
-inline fun visibleOnHandlerThread(handler: Handler, r: ThrowingRunnable){
-    visibleOnHandlerThread(handler, ThrowingSupplier<Unit> { r.run() })
-}
diff --git a/tests/integration/src/com/android/server/net/integrationtests/ConnectivityServiceIntegrationTest.kt b/tests/integration/src/com/android/server/net/integrationtests/ConnectivityServiceIntegrationTest.kt
index de392156ee..5357cf559e 100644
--- a/tests/integration/src/com/android/server/net/integrationtests/ConnectivityServiceIntegrationTest.kt
+++ b/tests/integration/src/com/android/server/net/integrationtests/ConnectivityServiceIntegrationTest.kt
@@ -72,7 +72,6 @@ import com.android.testutils.TestableNetworkCallback
 import com.android.testutils.runAsShell
 import com.android.testutils.tryTest
 import java.util.function.BiConsumer
-import java.util.function.Consumer
 import kotlin.test.assertEquals
 import kotlin.test.assertNotNull
 import kotlin.test.assertTrue
@@ -303,7 +302,7 @@ class ConnectivityServiceIntegrationTest {
 
         override fun makeSatelliteAccessController(
             context: Context,
-            updateSatellitePreferredUid: Consumer<MutableSet<Int>>?,
+            updateSatellitePreferredUid: BiConsumer<Set<Int>, Set<Int>>,
             connectivityServiceInternalHandler: Handler
         ): SatelliteAccessController? = mock(
             SatelliteAccessController::class.java
diff --git a/tests/unit/java/com/android/server/ConnectivityServiceTest.java b/tests/unit/java/com/android/server/ConnectivityServiceTest.java
index 63d014aad9..7108d2dcf2 100755
--- a/tests/unit/java/com/android/server/ConnectivityServiceTest.java
+++ b/tests/unit/java/com/android/server/ConnectivityServiceTest.java
@@ -690,7 +690,7 @@ public class ConnectivityServiceTest {
         // Map of permission name -> PermissionManager.Permission_{GRANTED|DENIED} constant
         // For permissions granted across the board, the key is only the permission name.
         // For permissions only granted to a combination of uid/pid, the key
-        // is "<permission name>,<pid>,<uid>". PID+UID permissons have priority over generic ones.
+        // is "<permission name>,<pid>,<uid>". PID+UID permissions have priority over generic ones.
         private final HashMap<String, Integer> mMockedPermissions = new HashMap<>();
 
         private void mockStringResource(int resId) {
@@ -2090,7 +2090,7 @@ public class ConnectivityServiceTest {
         @Override
         public SatelliteAccessController makeSatelliteAccessController(
                 @NonNull final Context context,
-                Consumer<Set<Integer>> updateSatelliteNetworkFallbackUidCallback,
+                BiConsumer<Set<Integer>, Set<Integer>> updateSatelliteNetworkFallbackUidCallback,
                 @NonNull final Handler connectivityServiceInternalHandler) {
             return mSatelliteAccessController;
         }
diff --git a/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt b/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt
index 578b880346..0191b3dad9 100644
--- a/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt
+++ b/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt
@@ -16,6 +16,7 @@
 package com.android.server.connectivity
 
 import android.Manifest
+import android.annotation.SuppressLint
 import android.app.role.OnRoleHoldersChangedListener
 import android.app.role.RoleManager
 import android.content.Context
@@ -27,7 +28,6 @@ import android.os.Handler
 import android.os.Looper
 import android.os.UserHandle
 import android.os.UserManager
-import android.util.ArraySet
 import com.android.server.connectivity.ConnectivityFlags.CONSTRAINED_DATA_SATELLITE_OPTIN
 import com.android.server.connectivity.SatelliteAccessController.PER_USER_RANGE
 import com.android.server.connectivity.SatelliteAccessController.PROPERTY_SATELLITE_DATA_OPTIMIZED
@@ -37,7 +37,7 @@ import com.android.testutils.com.android.testutils.SetFeatureFlagsRule
 import com.android.testutils.com.android.testutils.SetFeatureFlagsRule.FeatureFlag
 import java.util.concurrent.CompletableFuture
 import java.util.concurrent.Executor
-import java.util.function.Consumer
+import java.util.function.BiConsumer
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertFalse
 import org.junit.Assert.assertTrue
@@ -69,21 +69,14 @@ private const val SMS_APP2 = "sms_app_2"
 private const val SMS_APP_ID1 = 100
 private const val SMS_APP_ID2 = 101
 
-// UID for app1 and app2 on primary user
-// These app could become default sms app for user1
-private val PRIMARY_USER_SMS_APP_UID1 = UserHandle.getUid(PRIMARY_USER, SMS_APP_ID1)
-private val PRIMARY_USER_SMS_APP_UID2 = UserHandle.getUid(PRIMARY_USER, SMS_APP_ID2)
-
-// UID for app1 and app2 on secondary user
-// These app could become default sms app for user2
-private val SECONDARY_USER_SMS_APP_UID1 = UserHandle.getUid(SECONDARY_USER, SMS_APP_ID1)
-private val SECONDARY_USER_SMS_APP_UID2 = UserHandle.getUid(SECONDARY_USER, SMS_APP_ID2)
+private fun Int.toUid(userId: Int) = UserHandle.getUid(userId, this)
 
 private const val TEST_PACKAGE1 = "com.android.package1"
 private const val TEST_PACKAGE2 = "com.android.package2"
 private const val TEST_UID1 = 2001
 private const val TEST_UID2 = 2002 + SECONDARY_USER * PER_USER_RANGE // Under 2nd user.
 
+@SuppressLint("VisibleForTests", "MissingPermission")
 @RunWith(DevSdkIgnoreRunner::class)
 @IgnoreUpTo(Build.VERSION_CODES.TIRAMISU)
 class SatelliteAccessControllerTest {
@@ -94,7 +87,7 @@ class SatelliteAccessControllerTest {
     private val mPackageManagerPrimaryUser = mock(PackageManager::class.java)
     private val mPackageManagerSecondaryUser = mock(PackageManager::class.java)
     private val mDeps = mock(SatelliteAccessController.Dependencies::class.java)
-    private val mCallback = mock(Consumer::class.java) as Consumer<Set<Int>>
+    private val mCallback = mock(BiConsumer::class.java) as BiConsumer<Set<Int>, Set<Int>>
     private val userManager = mock(UserManager::class.java)
     private val mHandler = Handler(Looper.getMainLooper())
     private lateinit var mSatelliteAccessController: SatelliteAccessController
@@ -121,7 +114,6 @@ class SatelliteAccessControllerTest {
     }
 
     @Before
-    @Throws(PackageManager.NameNotFoundException::class)
     fun setup() {
         doReturn(emptyList<UserHandle>()).`when`(userManager).getUserHandles(true)
         mockService(Context.USER_SERVICE, UserManager::class.java, userManager)
@@ -145,33 +137,21 @@ class SatelliteAccessControllerTest {
                 .checkPermission(Manifest.permission.SATELLITE_COMMUNICATION, app)
         }
 
-        // Initialise message application primary user package1
-        val applicationInfo1 = ApplicationInfo()
-        applicationInfo1.uid = PRIMARY_USER_SMS_APP_UID1
-        doReturn(applicationInfo1)
-            .`when`(mPackageManagerPrimaryUser)
-            .getApplicationInfo(eq(SMS_APP1), anyInt())
-
-        // Initialise message application primary user package2
-        val applicationInfo2 = ApplicationInfo()
-        applicationInfo2.uid = PRIMARY_USER_SMS_APP_UID2
-        doReturn(applicationInfo2)
-            .`when`(mPackageManagerPrimaryUser)
-            .getApplicationInfo(eq(SMS_APP2), anyInt())
-
-        // Initialise message application secondary user package1
-        val applicationInfo3 = ApplicationInfo()
-        applicationInfo3.uid = SECONDARY_USER_SMS_APP_UID1
-        doReturn(applicationInfo3)
-            .`when`(mPackageManagerSecondaryUser)
-            .getApplicationInfo(eq(SMS_APP1), anyInt())
-
-        // Initialise message application secondary user package2
-        val applicationInfo4 = ApplicationInfo()
-        applicationInfo4.uid = SECONDARY_USER_SMS_APP_UID2
-        doReturn(applicationInfo4)
-            .`when`(mPackageManagerSecondaryUser)
-            .getApplicationInfo(eq(SMS_APP2), anyInt())
+        for ((appName, appId) in listOf(
+            SMS_APP1 to SMS_APP_ID1,
+            SMS_APP2 to SMS_APP_ID2
+        )) {
+            val primaryUid = appId.toUid(PRIMARY_USER)
+            val primaryAppInfo = ApplicationInfo().apply { uid = primaryUid }
+            doReturn(primaryAppInfo)
+                    .`when`(mPackageManagerPrimaryUser)
+                    .getApplicationInfo(eq(appName), anyInt())
+            val secondaryUid = appId.toUid(SECONDARY_USER)
+            val secondaryAppInfo = ApplicationInfo().apply { uid = secondaryUid }
+            doReturn(secondaryAppInfo)
+                    .`when`(mPackageManagerSecondaryUser)
+                    .getApplicationInfo(eq(appName), anyInt())
+        }
     }
 
     @Test
@@ -182,13 +162,13 @@ class SatelliteAccessControllerTest {
             PRIMARY_USER_HANDLE
         )
         mRoleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
-        verify(mCallback, never()).accept(any())
+        verify(mCallback, never()).accept(any(), any())
 
         // check DEFAULT_MESSAGING_APP1 is available as satellite network fallback uid
         doReturn(listOf(SMS_APP1))
             .`when`(mDeps).getRoleHoldersAsUser(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
         mRoleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
-        verify(mCallback).accept(setOf(PRIMARY_USER_SMS_APP_UID1))
+        verify(mCallback).accept(setOf(SMS_APP_ID1.toUid(PRIMARY_USER)), emptySet())
 
         // check SMS_APP2 is available as satellite network Fallback uid
         doReturn(listOf(SMS_APP2)).`when`(mDeps).getRoleHoldersAsUser(
@@ -196,7 +176,7 @@ class SatelliteAccessControllerTest {
             PRIMARY_USER_HANDLE
         )
         mRoleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
-        verify(mCallback).accept(setOf(PRIMARY_USER_SMS_APP_UID2))
+        verify(mCallback).accept(setOf(SMS_APP_ID2.toUid(PRIMARY_USER)), emptySet())
 
         // check no uid is available as satellite network fallback uid
         doReturn(listOf<String>()).`when`(mDeps).getRoleHoldersAsUser(
@@ -204,7 +184,7 @@ class SatelliteAccessControllerTest {
             PRIMARY_USER_HANDLE
         )
         mRoleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
-        verify(mCallback).accept(ArraySet())
+        verify(mCallback).accept(emptySet(), emptySet())
     }
 
     @Test
@@ -215,9 +195,9 @@ class SatelliteAccessControllerTest {
             PRIMARY_USER_HANDLE
         )
         mRoleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
-        verify(mCallback, never()).accept(any())
+        verify(mCallback, never()).accept(any(), any())
 
-        // check DEFAULT_MESSAGING_APP1 is not available as satellite network fallback uid
+        // Check DEFAULT_MESSAGING_APP1 is not available as satellite network fallback uid
         // since satellite communication permission not available.
         doReturn(PackageManager.PERMISSION_DENIED)
             .`when`(mPackageManagerPrimaryUser)
@@ -225,7 +205,7 @@ class SatelliteAccessControllerTest {
         doReturn(listOf(SMS_APP1))
             .`when`(mDeps).getRoleHoldersAsUser(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
         mRoleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
-        verify(mCallback, never()).accept(any())
+        verify(mCallback, never()).accept(any(), any())
     }
 
     @Test
@@ -237,7 +217,7 @@ class SatelliteAccessControllerTest {
             RoleManager.ROLE_BROWSER,
             PRIMARY_USER_HANDLE
         )
-        verify(mCallback, never()).accept(any())
+        verify(mCallback, never()).accept(any(), any())
     }
 
     @Test
@@ -248,13 +228,13 @@ class SatelliteAccessControllerTest {
             PRIMARY_USER_HANDLE
         )
         mRoleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
-        verify(mCallback, never()).accept(any())
+        verify(mCallback, never()).accept(any(), any())
 
         // check SMS_APP1 is available as satellite network fallback uid at primary user
         doReturn(listOf(SMS_APP1))
             .`when`(mDeps).getRoleHoldersAsUser(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
         mRoleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
-        verify(mCallback).accept(setOf(PRIMARY_USER_SMS_APP_UID1))
+        verify(mCallback).accept(setOf(SMS_APP_ID1.toUid(PRIMARY_USER)), emptySet())
 
         // check SMS_APP2 is available as satellite network fallback uid at primary user
         doReturn(listOf(SMS_APP2)).`when`(mDeps).getRoleHoldersAsUser(
@@ -262,7 +242,7 @@ class SatelliteAccessControllerTest {
             PRIMARY_USER_HANDLE
         )
         mRoleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
-        verify(mCallback).accept(setOf(PRIMARY_USER_SMS_APP_UID2))
+        verify(mCallback).accept(setOf(SMS_APP_ID2.toUid(PRIMARY_USER)), emptySet())
 
         // check SMS_APP1 is available as satellite network fallback uid at secondary user
         doReturn(listOf(SMS_APP1)).`when`(mDeps).getRoleHoldersAsUser(
@@ -270,7 +250,10 @@ class SatelliteAccessControllerTest {
             SECONDARY_USER_HANDLE
         )
         mRoleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, SECONDARY_USER_HANDLE)
-        verify(mCallback).accept(setOf(PRIMARY_USER_SMS_APP_UID2, SECONDARY_USER_SMS_APP_UID1))
+        verify(mCallback).accept(
+            setOf(SMS_APP_ID2.toUid(PRIMARY_USER), SMS_APP_ID1.toUid(SECONDARY_USER)),
+            emptySet()
+        )
 
         // check no uid is available as satellite network fallback uid at primary user
         doReturn(listOf<String>()).`when`(mDeps).getRoleHoldersAsUser(
@@ -281,13 +264,13 @@ class SatelliteAccessControllerTest {
             RoleManager.ROLE_SMS,
             PRIMARY_USER_HANDLE
         )
-        verify(mCallback).accept(setOf(SECONDARY_USER_SMS_APP_UID1))
+        verify(mCallback).accept(setOf(SMS_APP_ID1.toUid(SECONDARY_USER)), emptySet())
 
         // check SMS_APP2 is available as satellite network fallback uid at secondary user
         doReturn(listOf(SMS_APP2))
             .`when`(mDeps).getRoleHoldersAsUser(RoleManager.ROLE_SMS, SECONDARY_USER_HANDLE)
         mRoleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, SECONDARY_USER_HANDLE)
-        verify(mCallback).accept(setOf(SECONDARY_USER_SMS_APP_UID2))
+        verify(mCallback).accept(setOf(SMS_APP_ID2.toUid(SECONDARY_USER)), emptySet())
 
         // check no uid is available as satellite network fallback uid at secondary user
         doReturn(listOf<String>()).`when`(mDeps).getRoleHoldersAsUser(
@@ -295,7 +278,7 @@ class SatelliteAccessControllerTest {
             SECONDARY_USER_HANDLE
         )
         mRoleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, SECONDARY_USER_HANDLE)
-        verify(mCallback).accept(ArraySet())
+        verify(mCallback).accept(emptySet(), emptySet())
     }
 
     @Test
@@ -307,7 +290,7 @@ class SatelliteAccessControllerTest {
             PRIMARY_USER_HANDLE
         )
         mRoleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
-        verify(mCallback).accept(setOf(PRIMARY_USER_SMS_APP_UID2))
+        verify(mCallback).accept(setOf(SMS_APP_ID2.toUid(PRIMARY_USER)), emptySet())
 
         // check SMS_APP1 is available as satellite network fallback uid at secondary user
         doReturn(listOf(SMS_APP1)).`when`(mDeps).getRoleHoldersAsUser(
@@ -315,11 +298,17 @@ class SatelliteAccessControllerTest {
             SECONDARY_USER_HANDLE
         )
         mRoleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, SECONDARY_USER_HANDLE)
-        verify(mCallback).accept(setOf(PRIMARY_USER_SMS_APP_UID2, SECONDARY_USER_SMS_APP_UID1))
+        verify(mCallback).accept(
+            setOf(SMS_APP_ID2.toUid(PRIMARY_USER), SMS_APP_ID1.toUid(SECONDARY_USER)),
+            emptySet()
+        )
         processOnHandlerThread {
             mSatelliteAccessController.onUserRemoved(SECONDARY_USER_HANDLE)
         }
-        verify(mCallback, times(2)).accept(setOf(PRIMARY_USER_SMS_APP_UID2))
+        verify(mCallback, times(2)).accept(
+            setOf(SMS_APP_ID2.toUid(PRIMARY_USER)),
+            emptySet()
+        )
     }
 
     private fun <T : Any> processOnHandlerThread(function: () -> T): T {
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSPreferenceTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSPreferenceTest.kt
new file mode 100644
index 0000000000..97aa41c767
--- /dev/null
+++ b/tests/unit/java/com/android/server/connectivityservice/CSPreferenceTest.kt
@@ -0,0 +1,333 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.server
+
+import android.Manifest.permission.NETWORK_SETTINGS
+import android.annotation.SuppressLint
+import android.net.ConnectivityManager
+import android.net.ConnectivityManager.NetworkCallback
+import android.net.NetworkCapabilities.NET_CAPABILITY_INTERNET
+import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_BANDWIDTH_CONSTRAINED
+import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_RESTRICTED
+import android.net.NetworkCapabilities.TRANSPORT_SATELLITE
+import android.net.NetworkCapabilities.TRANSPORT_WIFI
+import android.net.NetworkProvider
+import android.net.NetworkScore
+import android.os.Build
+import android.os.Handler
+import android.os.Looper
+import androidx.test.filters.SmallTest
+import com.android.testutils.DevSdkIgnoreRule
+import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
+import com.android.testutils.DevSdkIgnoreRunner
+import com.android.testutils.RecorderCallback.CallbackEntry.Lost
+import com.android.testutils.TestableNetworkCallback
+import com.android.testutils.TestableNetworkOfferCallback
+import com.android.testutils.TestableNetworkOfferCallback.CallbackEntry.OnNetworkNeeded
+import com.android.testutils.TestableNetworkOfferCallback.CallbackEntry.OnNetworkUnneeded
+import com.android.testutils.postAndWait
+import com.android.testutils.runAsShell
+import org.junit.Rule
+import org.junit.Test
+import org.junit.runner.RunWith
+
+const val UID1 = 184
+const val UID2 = 10184
+const val UID3 = 10193
+const val SMSUID = 124
+
+private const val DEFAULT_TIMEOUT_MS = 5000L
+private const val DEFAULT_NO_CALLBACK_TIMEOUT_MS = 200L
+
+private fun satelliteNc(restricted: Boolean) = nc(
+    TRANSPORT_SATELLITE,
+    NET_CAPABILITY_INTERNET,
+).apply {
+    removeCapability(NET_CAPABILITY_NOT_BANDWIDTH_CONSTRAINED)
+    if (restricted) removeCapability(NET_CAPABILITY_NOT_RESTRICTED)
+}
+
+@SuppressLint("VisibleForTests", "MissingPermission")
+@DevSdkIgnoreRunner.MonitorThreadLeak
+@RunWith(DevSdkIgnoreRunner::class)
+@SmallTest
+@IgnoreUpTo(Build.VERSION_CODES.R)
+class CSPreferenceTest : CSTest() {
+    @get:Rule
+    val ignoreRule = DevSdkIgnoreRule()
+
+    val handler = Handler(Looper.getMainLooper())
+
+    private fun ConnectivityManager.registerDefaultNetworkCallbackForUid(
+        uid: Int,
+        cb: NetworkCallback
+    ) = runAsShell(NETWORK_SETTINGS) {
+        registerDefaultNetworkCallbackForUid(uid, cb, handler)
+    }
+
+    private fun defaultCallbacksForUids(vararg uids: Int) = uids.map { uid ->
+        val cb = TestableNetworkCallback()
+        cm.registerDefaultNetworkCallbackForUid(uid, cb)
+        uid to cb
+    }.toMap()
+
+    private fun <K, V> Map<K, V>.eachValue(what: (V) -> Unit) = forEach { what(it.value) }
+
+    private fun updateSatellitePreference(roleUids: Set<Int>, optinUids: Set<Int>) =
+        csHandler.postAndWait {
+            deps.satelliteNetworkFallbackUidUpdate.accept(roleUids, optinUids)
+        }
+
+    fun doTestSatellitePreference_PreferenceInstalledFirst(satelliteRestricted: Boolean) {
+        // Connect some wifi agent and file callbacks.
+        val wifiAgent = Agent(nc(TRANSPORT_WIFI, NET_CAPABILITY_INTERNET))
+        wifiAgent.connect()
+
+        val callbacks = defaultCallbacksForUids(UID1, UID2, UID3, SMSUID)
+        callbacks.eachValue { it.expectAvailableCallbacks(wifiAgent.network, validated = false) }
+
+        // Now file the preference and make sure no callbacks are sent.
+        updateSatellitePreference(setOf(SMSUID), setOf(UID1, UID2))
+        callbacks.eachValue { it.assertNoCallback() }
+
+        // Connect the satellite agent. Because there is a default network, no callbacks are
+        // sent yet.
+        val satelliteAgent = Agent(
+            nc = satelliteNc(satelliteRestricted),
+            score = keepConnectedScore()
+        )
+        satelliteAgent.connect()
+        callbacks.eachValue { it.assertNoCallback() }
+
+        // Disconnect wifi. The two opted-in UIDs fall back to satellite iff unrestricted. The SMS
+        // UID falls back to the satellite in any case.
+        wifiAgent.disconnect()
+        callbacks.eachValue { it.expect<Lost>(wifiAgent.network) }
+        if (satelliteRestricted) {
+            callbacks[UID1]!!.assertNoCallback()
+            callbacks[UID2]!!.assertNoCallback()
+        } else {
+            callbacks[UID1]!!.expectAvailableCallbacks(satelliteAgent.network, validated = false)
+            callbacks[UID2]!!.expectAvailableCallbacks(satelliteAgent.network, validated = false)
+        }
+        callbacks[UID3]!!.assertNoCallback()
+        callbacks[SMSUID]!!.expectAvailableCallbacks(satelliteAgent.network, validated = false)
+
+        // Disconnect satellite
+        satelliteAgent.disconnect()
+        if (satelliteRestricted) {
+            callbacks[UID1]!!.assertNoCallback()
+            callbacks[UID2]!!.assertNoCallback()
+        } else {
+            callbacks[UID1]!!.expect<Lost>(satelliteAgent.network)
+            callbacks[UID2]!!.expect<Lost>(satelliteAgent.network)
+        }
+        callbacks[UID3]!!.assertNoCallback()
+        callbacks[SMSUID]!!.expect<Lost>(satelliteAgent.network)
+
+        callbacks.eachValue { cm.unregisterNetworkCallback(it) }
+    }
+
+    @Test @IgnoreUpTo(Build.VERSION_CODES.VANILLA_ICE_CREAM)
+    fun testOptInSatellitePreference_PreferenceInstalledFirst_UnrestrictedSatellite() =
+        doTestSatellitePreference_PreferenceInstalledFirst(satelliteRestricted = false)
+    @Test @IgnoreUpTo(Build.VERSION_CODES.VANILLA_ICE_CREAM)
+    fun testOptInSatellitePreference_PreferenceInstalledFirst_RestrictedSatellite() =
+        doTestSatellitePreference_PreferenceInstalledFirst(satelliteRestricted = true)
+
+    fun doTestSatellitePreference_NetworkConnectedFirst(satelliteRestricted: Boolean) {
+        // Connect some wifi agent and a satellite agent.
+        val wifiAgent = Agent(nc(TRANSPORT_WIFI, NET_CAPABILITY_INTERNET))
+        wifiAgent.connect()
+
+        val firstSatelliteAgent = Agent(
+            nc = satelliteNc(satelliteRestricted),
+            score = keepConnectedScore()
+        )
+        firstSatelliteAgent.connect()
+
+        // File callbacks. They all have wifi as their default network.
+        val callbacks = defaultCallbacksForUids(UID1, UID2, UID3, SMSUID)
+        callbacks.eachValue { it.expectAvailableCallbacks(wifiAgent.network, validated = false) }
+
+        // Now file the preference and make sure no callbacks are sent because there
+        // is a wifi agent.
+        updateSatellitePreference(setOf(SMSUID), setOf(UID1, UID2))
+        callbacks.eachValue { it.assertNoCallback() }
+
+        // Disconnect satellite. No callbacks are sent since everyone is on wifi.
+        firstSatelliteAgent.disconnect()
+        callbacks.eachValue { it.assertNoCallback() }
+
+        // Remove all settings
+        updateSatellitePreference(emptySet(), emptySet())
+
+        // Connect a new satellite agent. No callback is sent yet, wifi is still connected
+        val satelliteAgent = Agent(
+            nc = satelliteNc(satelliteRestricted),
+            score = keepConnectedScore()
+        )
+        satelliteAgent.connect()
+        callbacks.eachValue { it.assertNoCallback() }
+
+        // Disconnect wifi, everyone loses their default network
+        wifiAgent.disconnect()
+        callbacks.eachValue { it.expect<Lost>(wifiAgent.network) }
+        callbacks.eachValue { it.assertNoCallback() }
+
+        // Install the preference again. If satellite is unrestricted, then the opted-in
+        // UIDs go on it.
+        updateSatellitePreference(setOf(SMSUID), setOf(UID1, UID2))
+        if (satelliteRestricted) {
+            callbacks[UID1]!!.assertNoCallback()
+            callbacks[UID2]!!.assertNoCallback()
+        } else {
+            callbacks[UID1]!!.expectAvailableCallbacks(satelliteAgent.network, validated = false)
+            callbacks[UID2]!!.expectAvailableCallbacks(satelliteAgent.network, validated = false)
+        }
+        callbacks[UID3]!!.assertNoCallback()
+        callbacks[SMSUID]!!.expectAvailableCallbacks(satelliteAgent.network, validated = false)
+
+        // Disconnect satellite
+        satelliteAgent.disconnect()
+        if (satelliteRestricted) {
+            callbacks[UID1]!!.assertNoCallback()
+            callbacks[UID2]!!.assertNoCallback()
+        } else {
+            callbacks[UID1]!!.expect<Lost>(satelliteAgent.network)
+            callbacks[UID2]!!.expect<Lost>(satelliteAgent.network)
+        }
+        callbacks[UID3]!!.assertNoCallback()
+        callbacks[SMSUID]!!.expect<Lost>(satelliteAgent.network)
+
+        callbacks.eachValue { cm.unregisterNetworkCallback(it) }
+    }
+
+    @Test @IgnoreUpTo(Build.VERSION_CODES.VANILLA_ICE_CREAM)
+    fun testOptInSatellitePreference_NetworkConnectedFirst_UnrestrictedSatellite() =
+        doTestSatellitePreference_NetworkConnectedFirst(satelliteRestricted = false)
+    @Test @IgnoreUpTo(Build.VERSION_CODES.VANILLA_ICE_CREAM)
+    fun testOptInSatellitePreference_NetworkConnectedFirst_RestrictedSatellite() =
+        doTestSatellitePreference_NetworkConnectedFirst(satelliteRestricted = true)
+
+    private val OnNetworkNeeded.isRestricted
+        get() = !request.hasCapability(NET_CAPABILITY_NOT_RESTRICTED)
+    private val OnNetworkUnneeded.isRestricted
+        get() = !request.hasCapability(NET_CAPABILITY_NOT_RESTRICTED)
+
+    /**
+     * This test ensures that the network offers for the satellite provider (normally telephony)
+     * are correctly updated.
+     *
+     * Generally, as long as there is a general internet-providing default network, the satellite
+     * network is not requested.
+     * When there is no general default network, satellite should be requested if and only if
+     * there are UIDs that can use it. If there is an apps with the SMS role, it will request a
+     * network without NOT_RESTRICTED capability (this app is allowed to use a restricted network).
+     * If there are any opted-in apps, they will request a network with NOT_RESTRICTED.
+     */
+    @Test @IgnoreUpTo(Build.VERSION_CODES.VANILLA_ICE_CREAM)
+    fun testSatelliteRequest() {
+        val provider = NetworkProvider(context, csHandlerThread.looper, "Test provider")
+        cm.registerNetworkProvider(provider)
+
+        val satelliteCallback = TestableNetworkOfferCallback(
+            DEFAULT_TIMEOUT_MS,
+            DEFAULT_NO_CALLBACK_TIMEOUT_MS
+        )
+        provider.registerNetworkOffer(
+            NetworkScore.Builder().build(),
+            satelliteNc(restricted = false),
+            Runnable::run,
+            satelliteCallback
+        )
+        val restrictedSatelliteCallback = TestableNetworkOfferCallback(
+            DEFAULT_TIMEOUT_MS,
+            DEFAULT_NO_CALLBACK_TIMEOUT_MS
+        )
+        provider.registerNetworkOffer(
+            NetworkScore.Builder().build(),
+            satelliteNc(restricted = true),
+            Runnable::run,
+            restrictedSatelliteCallback
+        )
+        satelliteCallback.assertNoCallback()
+
+        updateSatellitePreference(emptySet(), setOf(UID1))
+        satelliteCallback.expectCallbackThat<OnNetworkNeeded> { true }
+        satelliteCallback.assertNoCallback()
+        restrictedSatelliteCallback.assertNoCallback()
+
+        updateSatellitePreference(emptySet(), emptySet())
+        satelliteCallback.expectCallbackThat<OnNetworkUnneeded> { true }
+        satelliteCallback.assertNoCallback()
+        restrictedSatelliteCallback.assertNoCallback()
+
+        updateSatellitePreference(setOf(SMSUID), emptySet())
+        satelliteCallback.expectCallbackThat<OnNetworkNeeded> { it.isRestricted }
+        restrictedSatelliteCallback.expectCallbackThat<OnNetworkNeeded> { it.isRestricted }
+        satelliteCallback.assertNoCallback()
+        restrictedSatelliteCallback.assertNoCallback()
+
+        // TODO : the test below cannot be stabilized because the order of the callbacks
+        // (which request is needed first) is not guaranteed and actually changes across
+        // invocations, and TestableNetworkOfferCallback does not yet offer the tooling
+        // to check the track record from a mark.
+        return
+
+        updateSatellitePreference(setOf(SMSUID), setOf(UID1))
+        // TODO : ideally ConnectivityService would not send unneeded then needed. This is
+        // happening because updating the preferences removes the requests, which causes a
+        // rematch (where the requests are not registered), then adds the requests again, which
+        // causes another rematch.
+        satelliteCallback.expectCallbackThat<OnNetworkUnneeded> { it.isRestricted }
+        restrictedSatelliteCallback.expectCallbackThat<OnNetworkUnneeded> { it.isRestricted }
+        satelliteCallback.expectCallbackThat<OnNetworkNeeded> { !it.isRestricted }
+        satelliteCallback.expectCallbackThat<OnNetworkNeeded> { it.isRestricted }
+        restrictedSatelliteCallback.expectCallbackThat<OnNetworkNeeded> { it.isRestricted }
+        satelliteCallback.assertNoCallback()
+        restrictedSatelliteCallback.assertNoCallback()
+
+        updateSatellitePreference(emptySet(), setOf(UID1))
+        satelliteCallback.expectCallbackThat<OnNetworkUnneeded> { it.isRestricted }
+        satelliteCallback.expectCallbackThat<OnNetworkUnneeded> { !it.isRestricted }
+        satelliteCallback.expectCallbackThat<OnNetworkNeeded> { !it.isRestricted }
+        restrictedSatelliteCallback.expectCallbackThat<OnNetworkUnneeded> { it.isRestricted }
+        satelliteCallback.assertNoCallback()
+        restrictedSatelliteCallback.assertNoCallback()
+
+        updateSatellitePreference(setOf(SMSUID), setOf(UID1))
+        restrictedSatelliteCallback.expectCallbackThat<OnNetworkNeeded> { it.isRestricted }
+        satelliteCallback.assertNoCallback()
+        restrictedSatelliteCallback.assertNoCallback()
+
+        val wifiAgent = Agent(TRANSPORT_WIFI)
+        wifiAgent.connect()
+        satelliteCallback.expectCallbackThat<OnNetworkUnneeded> { it.isRestricted }
+        satelliteCallback.expectCallbackThat<OnNetworkUnneeded> { !it.isRestricted }
+        restrictedSatelliteCallback.expectCallbackThat<OnNetworkUnneeded> { it.isRestricted }
+        satelliteCallback.assertNoCallback()
+        restrictedSatelliteCallback.assertNoCallback()
+
+        wifiAgent.disconnect()
+        satelliteCallback.expectCallbackThat<OnNetworkNeeded> { it.isRestricted }
+        satelliteCallback.expectCallbackThat<OnNetworkNeeded> { !it.isRestricted }
+        restrictedSatelliteCallback.expectCallbackThat<OnNetworkNeeded> { it.isRestricted }
+        satelliteCallback.assertNoCallback()
+        restrictedSatelliteCallback.assertNoCallback()
+    }
+}
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSSatelliteNetworkTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSSatelliteNetworkTest.kt
index a417a3f149..94be0a8e64 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSSatelliteNetworkTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSSatelliteNetworkTest.kt
@@ -68,6 +68,7 @@ private val SECONDARY_USER_HANDLE = UserHandle(SECONDARY_USER)
 private const val TEST_PACKAGE_UID = 123
 private const val TEST_PACKAGE_UID2 = 321
 
+@SuppressLint("VisibleForTests", "MissingPermission")
 @DevSdkIgnoreRunner.MonitorThreadLeak
 @RunWith(DevSdkIgnoreRunner::class)
 @IgnoreUpTo(Build.VERSION_CODES.TIRAMISU)
@@ -82,7 +83,10 @@ class CSSatelliteNetworkTest : CSTest() {
     @Test
     fun testCreateMultiLayerNrisFromSatelliteNetworkPreferredUids() {
         // Verify that empty uid set should not create any NRI for it.
-        val nrisNoUid = service.createMultiLayerNrisFromSatelliteNetworkFallbackUids(emptySet())
+        val nrisNoUid = service.createMultiLayerNrisFromSatelliteNetworkFallbackUids(
+            emptySet(),
+            emptySet()
+        )
         Assert.assertEquals(0, nrisNoUid.size.toLong())
         val uid1 = PRIMARY_USER_HANDLE.getUid(TEST_PACKAGE_UID)
         val uid2 = PRIMARY_USER_HANDLE.getUid(TEST_PACKAGE_UID2)
@@ -103,7 +107,7 @@ class CSSatelliteNetworkTest : CSTest() {
         satelliteAgent.connect()
 
         val satelliteNetId = satelliteAgent.network.netId
-        val permission = if (restricted) {INetd.PERMISSION_SYSTEM} else {INetd.PERMISSION_NONE}
+        val permission = if (restricted) INetd.PERMISSION_SYSTEM else INetd.PERMISSION_NONE
         netdInOrder.verify(netd).networkCreate(
             nativeNetworkConfigPhysical(satelliteNetId, permission)
         )
@@ -113,7 +117,7 @@ class CSSatelliteNetworkTest : CSTest() {
         val uid3 = SECONDARY_USER_HANDLE.getUid(TEST_PACKAGE_UID)
 
         // Initial satellite network fallback uids status.
-        updateSatelliteNetworkFallbackUids(setOf())
+        updateSatelliteNetworkFallbackUids(emptySet(), emptySet())
         netdInOrder.verify(netd, never()).networkAddUidRangesParcel(any())
         netdInOrder.verify(netd, never()).networkRemoveUidRangesParcel(any())
 
@@ -125,7 +129,7 @@ class CSSatelliteNetworkTest : CSTest() {
             uidRanges1,
             PREFERENCE_ORDER_SATELLITE_FALLBACK
         )
-        updateSatelliteNetworkFallbackUids(uids)
+        updateSatelliteNetworkFallbackUids(uids, emptySet())
         netdInOrder.verify(netd).networkAddUidRangesParcel(config1)
         netdInOrder.verify(netd, never()).networkRemoveUidRangesParcel(any())
 
@@ -137,7 +141,7 @@ class CSSatelliteNetworkTest : CSTest() {
             uidRanges2,
             PREFERENCE_ORDER_SATELLITE_FALLBACK
         )
-        updateSatelliteNetworkFallbackUids(uids)
+        updateSatelliteNetworkFallbackUids(uids, emptySet())
         netdInOrder.verify(netd).networkRemoveUidRangesParcel(config1)
         netdInOrder.verify(netd).networkAddUidRangesParcel(config2)
     }
@@ -183,7 +187,7 @@ class CSSatelliteNetworkTest : CSTest() {
         }
 
         val uids = setOf(TEST_PACKAGE_UID)
-        updateSatelliteNetworkFallbackUids(uids)
+        updateSatelliteNetworkFallbackUids(uids, emptySet())
 
         if (destroyBeforeRequest) {
             verify(netd, never()).networkAddUidRangesParcel(any())
@@ -201,7 +205,7 @@ class CSSatelliteNetworkTest : CSTest() {
             satelliteAgent.unregisterAfterReplacement(timeoutMs = 5000)
         }
 
-        updateSatelliteNetworkFallbackUids(setOf())
+        updateSatelliteNetworkFallbackUids(setOf(), emptySet())
         if (destroyBeforeRequest || destroyAfterRequest) {
             // If the network is already destroyed, networkRemoveUidRangesParcel should not be
             // called.
@@ -248,7 +252,7 @@ class CSSatelliteNetworkTest : CSTest() {
             cm.registerNetworkCallback(NetworkRequest.Builder().clearCapabilities().build(), it)
         }
 
-        updateSatelliteNetworkFallbackUids(setOf(myUid))
+        updateSatelliteNetworkFallbackUids(setOf(myUid), emptySet())
         defaultCb.assertNoCallback()
 
         val satelliteAgent = createSatelliteAgent(
@@ -290,7 +294,7 @@ class CSSatelliteNetworkTest : CSTest() {
         allNetworksCb.expectAvailableCallbacks(satelliteNetwork2, validated = false)
         defaultCb.expectAvailableCallbacks(satelliteNetwork2, validated = false)
 
-        updateSatelliteNetworkFallbackUids(setOf())
+        updateSatelliteNetworkFallbackUids(emptySet(), emptySet())
 
         allNetworksCb.expect<Lost>(satelliteNetwork2)
         defaultCb.expect<Lost>(satelliteNetwork2)
@@ -298,8 +302,8 @@ class CSSatelliteNetworkTest : CSTest() {
     }
 
     private fun assertCreateMultiLayerNrisFromSatelliteNetworkPreferredUids(uids: Set<Int>) {
-        val nris: Set<ConnectivityService.NetworkRequestInfo> =
-            service.createMultiLayerNrisFromSatelliteNetworkFallbackUids(uids)
+        val nris =
+            service.createMultiLayerNrisFromSatelliteNetworkFallbackUids(uids, emptySet())
         val nri = nris.iterator().next()
         // Verify that one NRI is created with multilayer requests. Because one NRI can contain
         // multiple uid ranges, so it only need create one NRI here.
@@ -309,9 +313,9 @@ class CSSatelliteNetworkTest : CSTest() {
         assertEquals(PREFERENCE_ORDER_SATELLITE_FALLBACK, nri.mPreferenceOrder)
     }
 
-    private fun updateSatelliteNetworkFallbackUids(uids: Set<Int>) {
+    private fun updateSatelliteNetworkFallbackUids(messagingUids: Set<Int>, optinUids: Set<Int>) {
         visibleOnHandlerThread(csHandler) {
-            deps.satelliteNetworkFallbackUidUpdate!!.accept(uids)
+            deps.satelliteNetworkFallbackUidUpdate!!.accept(messagingUids, optinUids)
         }
     }
 
diff --git a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
index 6c6c6634bd..3b8b27a57d 100644
--- a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
@@ -16,6 +16,7 @@
 
 package com.android.server
 
+import android.annotation.SuppressLint
 import android.app.AlarmManager
 import android.app.AppOpsManager
 import android.bluetooth.BluetoothManager
@@ -86,7 +87,6 @@ import java.util.concurrent.Executors
 import java.util.concurrent.LinkedBlockingQueue
 import java.util.concurrent.TimeUnit
 import java.util.function.BiConsumer
-import java.util.function.Consumer
 import kotlin.annotation.AnnotationRetention.RUNTIME
 import kotlin.annotation.AnnotationTarget.FUNCTION
 import kotlin.test.assertNotNull
@@ -139,6 +139,7 @@ private fun NetworkCapabilities.getLegacyType() =
  */
 // TODO (b/272685721) : make ConnectivityServiceTest smaller and faster by moving the setup
 // parts into this class and moving the individual tests to multiple separate classes.
+@SuppressLint("VisibleForTests", "MissingPermission")
 open class CSTest {
     @get:Rule
     val testNameRule = TestName()
@@ -312,10 +313,10 @@ open class CSTest {
                 handler: Handler
         ) = if (SdkLevel.isAtLeastT()) mock<CarrierPrivilegeAuthenticator>() else null
 
-        var satelliteNetworkFallbackUidUpdate: Consumer<Set<Int>>? = null
+        var satelliteNetworkFallbackUidUpdate = BiConsumer<Set<Int>, Set<Int>> {_, _ -> }
         override fun makeSatelliteAccessController(
             context: Context,
-            updateSatelliteNetworkFallackUid: Consumer<Set<Int>>?,
+            updateSatelliteNetworkFallackUid: BiConsumer<Set<Int>, Set<Int>>,
             csHandlerThread: Handler
         ): SatelliteAccessController? {
             satelliteNetworkFallbackUidUpdate = updateSatelliteNetworkFallackUid

From 957799c6727aaebc85e8685345b2136706bfa5cb Mon Sep 17 00:00:00 2001
From: Chalard Jean <jchalard@google.com>
Date: Fri, 25 Apr 2025 14:44:35 +0900
Subject: [PATCH 163/377] Add a basic test for network preferences

Test: this
Flag: EXEMPT test-only code
Change-Id: Ibd2e5adf2a18821a05b6b3a7baa22d4d750ec14f
---
 .../connectivityservice/CSPreferenceTest.kt   | 52 +++++++++++++++++++
 1 file changed, 52 insertions(+)

diff --git a/tests/unit/java/com/android/server/connectivityservice/CSPreferenceTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSPreferenceTest.kt
index 97aa41c767..ac3c859722 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSPreferenceTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSPreferenceTest.kt
@@ -18,18 +18,25 @@ package com.android.server
 
 import android.Manifest.permission.NETWORK_SETTINGS
 import android.annotation.SuppressLint
+import android.content.pm.ApplicationInfo
 import android.net.ConnectivityManager
 import android.net.ConnectivityManager.NetworkCallback
 import android.net.NetworkCapabilities.NET_CAPABILITY_INTERNET
 import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_BANDWIDTH_CONSTRAINED
 import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_RESTRICTED
 import android.net.NetworkCapabilities.TRANSPORT_SATELLITE
+import android.net.NetworkCapabilities.TRANSPORT_TEST
 import android.net.NetworkCapabilities.TRANSPORT_WIFI
 import android.net.NetworkProvider
 import android.net.NetworkScore
+import android.net.OemNetworkPreferences
+import android.net.OemNetworkPreferences.OEM_NETWORK_PREFERENCE_TEST
 import android.os.Build
+import android.os.ConditionVariable
 import android.os.Handler
 import android.os.Looper
+import android.os.Process
+import android.os.UserHandle
 import androidx.test.filters.SmallTest
 import com.android.testutils.DevSdkIgnoreRule
 import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
@@ -44,6 +51,9 @@ import com.android.testutils.runAsShell
 import org.junit.Rule
 import org.junit.Test
 import org.junit.runner.RunWith
+import org.mockito.Mockito.any
+import org.mockito.Mockito.doAnswer
+import org.mockito.Mockito.eq
 
 const val UID1 = 184
 const val UID2 = 10184
@@ -72,6 +82,48 @@ class CSPreferenceTest : CSTest() {
 
     val handler = Handler(Looper.getMainLooper())
 
+    @Test
+    fun testBasicOemPreference() {
+        val myAppId = UserHandle.getAppId(Process.myUid())
+        doAnswer { invocation ->
+            val handle = invocation.getArgument<UserHandle>(2)
+            ApplicationInfo().apply { uid = handle.getUid(myAppId) }
+        }.`when`(packageManager).getApplicationInfoAsUser(
+            eq(context.packageName),
+            eq(0), // flags
+            any<UserHandle>()
+        )
+
+        val wifiAgent = Agent(nc(TRANSPORT_WIFI, NET_CAPABILITY_INTERNET))
+        wifiAgent.connect()
+        val testAgent = Agent(TRANSPORT_TEST)
+        testAgent.connect()
+
+        val cb = TestableNetworkCallback()
+        cm.registerDefaultNetworkCallback(cb)
+        cb.expectAvailableCallbacks(wifiAgent.network, validated = false)
+
+        val pr = OemNetworkPreferences.Builder()
+            .addNetworkPreference(context.packageName, OEM_NETWORK_PREFERENCE_TEST)
+            .build()
+        val cv = ConditionVariable()
+        cm.setOemNetworkPreference(pr, Runnable::run) { cv.open() }
+        cv.block()
+
+        cb.expectAvailableCallbacks(testAgent.network, validated = false)
+
+        cv.close()
+        cm.setOemNetworkPreference(
+            OemNetworkPreferences.Builder().build(),
+            Runnable::run
+        ) {
+            cv.open()
+        }
+        cv.block()
+
+        cb.expectAvailableCallbacks(wifiAgent.network, validated = false)
+    }
+
     private fun ConnectivityManager.registerDefaultNetworkCallbackForUid(
         uid: Int,
         cb: NetworkCallback

From a14fb7cf7977b031682a5211c80b859057c0596a Mon Sep 17 00:00:00 2001
From: Chalard Jean <jchalard@google.com>
Date: Fri, 25 Apr 2025 17:42:47 +0900
Subject: [PATCH 164/377] Add a way to poll with a position for ReadHead

It was thought originally that it would not make a lot of sense to
offer such a call, but with usage it became clear that there is a
simple, obvious and useful behavior.
In particular this is very useful to mix eventuallyExpect and
expect calls. Interestingly, before this patch, calling
callback.eventuallyExpect<...>()
callback.expect<...>()
does not actually behave like you would intuitively think, because
eventuallyExpect does not advance the read head. When this
utility was made we thought this was the better behavior, but
usage has shown that advancing is both obvious and more useful.

Astonishingly, there seem to be no caller who needs to
eventuallyExpect() and later expect(), meaning that this
behavior change is apparently fine.

Test: ConnectivityCoverageTest and treehugger
Flag: EXEMPT test-only change
Change-Id: I2078330bd913cf0f75240bf3d4852e487e3e0163
---
 .../android/net/module/util/TrackRecord.kt    | 51 ++++++++++++++++++-
 .../android/net/cts/NetworkValidationTest.kt  |  5 +-
 2 files changed, 53 insertions(+), 3 deletions(-)

diff --git a/staticlibs/testutils/hostdevice/com/android/net/module/util/TrackRecord.kt b/staticlibs/testutils/hostdevice/com/android/net/module/util/TrackRecord.kt
index 8051558f1c..541fccad1f 100644
--- a/staticlibs/testutils/hostdevice/com/android/net/module/util/TrackRecord.kt
+++ b/staticlibs/testutils/hostdevice/com/android/net/module/util/TrackRecord.kt
@@ -255,7 +255,7 @@ class ArrayTrackRecord<E> : TrackRecord<E> {
          * the last element in the queue if null is returned. This means this method will always
          * skip elements that do not match the predicate, even if it returns null.
          *
-         * This method can only be used by the thread that created this ManagedRecordingQueue.
+         * This method can only be used by the thread that created this ReadHead.
          * If used on another thread, this throws IllegalStateException.
          *
          * @param timeoutMs how long, in milliseconds, to wait at most (best effort approximation).
@@ -277,6 +277,55 @@ class ArrayTrackRecord<E> : TrackRecord<E> {
             }
         }
 
+        /**
+         * Returns the first element after the mark, optionally blocking until one is available,
+         * or null if no such element can be found within the timeout.
+         * If a predicate is given, only elements matching the predicate are returned.
+         *
+         * Upon return, the mark will be advanced up to the point of the returned element (or
+         * after the last element in the queue if not found) if and only if that element was
+         * found after the current mark. This means this method will always skip elements that
+         * do not match the predicate even if it returns null, and repeated calls with the
+         * same position will advance the mark up to the last of the found elements.
+         *
+         * This method can only be used by the thread that created this ReadHead.
+         * If used on another thread, this throws IllegalStateException.
+         *
+         * Typical usage would be to check for multiple elements in any order. For example,
+         * val mark = readHead.mark
+         * readHead.poll(timeout, mark) { it matches condition 1 }
+         * readHead.poll(timeout, mark) { it matches condition 2 }
+         * readHead.poll(timeout, mark) { it matches condition 3 }
+         * The above would check that starting at the mark, there are three events, one matching
+         * each condition, in any order. A caller could further check that there were no other
+         * event beside the 3 checked with something like
+         * assertEquals(readHead.mark - mark, 3)
+         *
+         * @param timeoutMs how long, in milliseconds, to wait at most (best effort approximation).
+         * @param pos the position in the underlying track record where to start the search.
+         * @param predicate a predicate to filter elements to be returned.
+         * @return an element matching the predicate, or null if timeout.
+         */
+        override fun poll(timeoutMs: Long, pos: Int, predicate: (E) -> Boolean): E? {
+            val stamp = slock.tryWriteLock()
+            if (0L == stamp) concurrentAccessDetected()
+            pollMark = readHead
+            try {
+                lock.withLock {
+                    val index = pollForIndexReadLocked(timeoutMs, pos, predicate)
+                    when {
+                        index < 0 -> readHead = size
+                        index > readHead -> readHead = index + 1
+                        // else do nothing, the element was found prior to the read head so
+                        // don't move the read head
+                    }
+                    return getOrNull(index)
+                }
+            } finally {
+                slock.unlockWrite(stamp)
+            }
+        }
+
         /**
          * Returns a list of events that were observed since before the last poll() operation on
          * this ReadHead.
diff --git a/tests/cts/net/src/android/net/cts/NetworkValidationTest.kt b/tests/cts/net/src/android/net/cts/NetworkValidationTest.kt
index aad072c643..4261881046 100644
--- a/tests/cts/net/src/android/net/cts/NetworkValidationTest.kt
+++ b/tests/cts/net/src/android/net/cts/NetworkValidationTest.kt
@@ -177,10 +177,11 @@ class NetworkValidationTest {
             cm.registerNetworkCallback(ethRequest, testCb)
 
             try {
-                val ncCb = testCb.eventuallyExpect<CallbackEntry.CapabilitiesChanged> {
+                val mark = testCb.mark
+                val ncCb = testCb.eventuallyExpect<CallbackEntry.CapabilitiesChanged>(from = mark) {
                     it.caps.hasCapability(NET_CAPABILITY_CAPTIVE_PORTAL)
                 }
-                testCb.eventuallyExpect<CallbackEntry.LinkPropertiesChanged> {
+                testCb.eventuallyExpect<CallbackEntry.LinkPropertiesChanged>(from = mark) {
                     it.network == ncCb.network && it.lp.captivePortalData != null
                 }.lp
             } finally {

From d52096e1bb96350131785f923f91b3c2e3bfe331 Mon Sep 17 00:00:00 2001
From: Chalard Jean <jchalard@google.com>
Date: Fri, 25 Apr 2025 17:46:40 +0900
Subject: [PATCH 165/377] Enable the last preference tests

Now that it's easy to expect events out of order, these
tests can be implemented.

Test: CSPreferenceTest
Flag: EXEMPT test-only change
Change-Id: If07fb6c11345be09c0942fd1c4371e8e22a4c6ec
---
 .../connectivityservice/CSPreferenceTest.kt   | 39 ++++++++++++-------
 1 file changed, 24 insertions(+), 15 deletions(-)

diff --git a/tests/unit/java/com/android/server/connectivityservice/CSPreferenceTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSPreferenceTest.kt
index 05588f6076..1b7b1017ab 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSPreferenceTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSPreferenceTest.kt
@@ -48,6 +48,7 @@ import com.android.testutils.TestableNetworkOfferCallback.CallbackEntry.Needed
 import com.android.testutils.TestableNetworkOfferCallback.CallbackEntry.Unneeded
 import com.android.testutils.postAndWait
 import com.android.testutils.runAsShell
+import kotlin.test.assertEquals
 import org.junit.Rule
 import org.junit.Test
 import org.junit.runner.RunWith
@@ -329,12 +330,6 @@ class CSPreferenceTest : CSTest() {
         satelliteCallback.assertNoCallback()
         restrictedSatelliteCallback.assertNoCallback()
 
-        // TODO : the test below cannot be stabilized because the order of the callbacks
-        // (which request is needed first) is not guaranteed and actually changes across
-        // invocations, and TestableNetworkOfferCallback does not yet offer the tooling
-        // to check the track record from a mark.
-        return
-
         updateSatellitePreference(setOf(SMSUID), setOf(UID1))
         // TODO : ideally ConnectivityService would not send unneeded then needed. This is
         // happening because updating the preferences removes the requests, which causes a
@@ -342,15 +337,20 @@ class CSPreferenceTest : CSTest() {
         // causes another rematch.
         satelliteCallback.expect<Unneeded> { it.isRestricted }
         restrictedSatelliteCallback.expect<Unneeded> { it.isRestricted }
-        satelliteCallback.expect<Needed> { !it.isRestricted }
-        satelliteCallback.expect<Needed> { it.isRestricted }
+
+        val mark1 = satelliteCallback.mark
+        satelliteCallback.eventuallyExpect<Needed>(from = mark1) { !it.isRestricted }
+        satelliteCallback.eventuallyExpect<Needed>(from = mark1) { it.isRestricted }
+        assertEquals(2, satelliteCallback.mark - mark1)
         restrictedSatelliteCallback.expect<Needed> { it.isRestricted }
         satelliteCallback.assertNoCallback()
         restrictedSatelliteCallback.assertNoCallback()
 
         updateSatellitePreference(emptySet(), setOf(UID1))
-        satelliteCallback.expect<Unneeded> { it.isRestricted }
-        satelliteCallback.expect<Unneeded> { !it.isRestricted }
+        val mark2 = satelliteCallback.mark
+        satelliteCallback.eventuallyExpect<Unneeded>(from = mark2) { it.isRestricted }
+        satelliteCallback.eventuallyExpect<Unneeded>(from = mark2) { !it.isRestricted }
+        assertEquals(2, satelliteCallback.mark - mark2)
         satelliteCallback.expect<Needed> { !it.isRestricted }
         restrictedSatelliteCallback.expect<Unneeded> { it.isRestricted }
         satelliteCallback.assertNoCallback()
@@ -358,20 +358,29 @@ class CSPreferenceTest : CSTest() {
 
         updateSatellitePreference(setOf(SMSUID), setOf(UID1))
         restrictedSatelliteCallback.expect<Needed> { it.isRestricted }
+        satelliteCallback.expect<Unneeded> { !it.isRestricted }
+        val mark3 = satelliteCallback.mark
+        satelliteCallback.eventuallyExpect<Needed>(from = mark3) { it.isRestricted }
+        satelliteCallback.eventuallyExpect<Needed>(from = mark3) { !it.isRestricted }
+        assertEquals(2, satelliteCallback.mark - mark3)
         satelliteCallback.assertNoCallback()
         restrictedSatelliteCallback.assertNoCallback()
 
-        val wifiAgent = Agent(TRANSPORT_WIFI)
+        val wifiAgent = Agent(nc(TRANSPORT_WIFI, NET_CAPABILITY_INTERNET))
         wifiAgent.connect()
-        satelliteCallback.expect<Unneeded> { it.isRestricted }
-        satelliteCallback.expect<Unneeded> { !it.isRestricted }
+        val mark4 = satelliteCallback.mark
+        satelliteCallback.eventuallyExpect<Unneeded>(from = mark4) { it.isRestricted }
+        satelliteCallback.eventuallyExpect<Unneeded>(from = mark4) { !it.isRestricted }
+        assertEquals(2, satelliteCallback.mark - mark4)
         restrictedSatelliteCallback.expect<Unneeded> { it.isRestricted }
         satelliteCallback.assertNoCallback()
         restrictedSatelliteCallback.assertNoCallback()
 
         wifiAgent.disconnect()
-        satelliteCallback.expect<Needed> { it.isRestricted }
-        satelliteCallback.expect<Needed> { !it.isRestricted }
+        val mark5 = satelliteCallback.mark
+        satelliteCallback.eventuallyExpect<Needed>(from = mark5) { it.isRestricted }
+        satelliteCallback.eventuallyExpect<Needed>(from = mark5) { !it.isRestricted }
+        assertEquals(2, satelliteCallback.mark - mark5)
         restrictedSatelliteCallback.expect<Needed> { it.isRestricted }
         satelliteCallback.assertNoCallback()
         restrictedSatelliteCallback.assertNoCallback()

From 5f3997b6af1efb94984d59f030a48fed4cd81c73 Mon Sep 17 00:00:00 2001
From: Chalard Jean <jchalard@google.com>
Date: Fri, 25 Apr 2025 15:41:30 +0900
Subject: [PATCH 166/377] Improve TestableNetworkOfferCallback

Update it to follow the latest conventions and add support for
eventuallyExpect.

Test: ConnectivityCoverageTest
Flag: EXEMPT test-only change
Change-Id: Iabc2fad051b874e3e18a0645361409f0427891fb
---
 .../testutils/TestableNetworkOfferCallback.kt | 70 +++++++++++++++----
 .../CSNetworkReservationTest.kt               |  4 +-
 .../connectivityservice/CSPreferenceTest.kt   | 58 +++++++--------
 3 files changed, 83 insertions(+), 49 deletions(-)

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/TestableNetworkOfferCallback.kt b/staticlibs/testutils/devicetests/com/android/testutils/TestableNetworkOfferCallback.kt
index a0078d21d7..8f9014c816 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/TestableNetworkOfferCallback.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/TestableNetworkOfferCallback.kt
@@ -23,14 +23,20 @@ import android.util.Log
 import com.android.net.module.util.ArrayTrackRecord
 import kotlin.test.fail
 
-class TestableNetworkOfferCallback(val timeoutMs: Long, private val noCallbackTimeoutMs: Long)
-            : NetworkProvider.NetworkOfferCallback {
+private const val DEFAULT_TIMEOUT = 30_000L // ms
+private const val DEFAULT_NO_CALLBACK_TIMEOUT = 200L // ms
+
+class TestableNetworkOfferCallback(
+    val timeoutMs: Long = DEFAULT_TIMEOUT,
+    private val noCallbackTimeoutMs: Long = DEFAULT_NO_CALLBACK_TIMEOUT,
+) : NetworkProvider.NetworkOfferCallback {
     private val TAG = this::class.simpleName
     val history = ArrayTrackRecord<CallbackEntry>().newReadHead()
+    val mark get() = history.mark
 
     sealed class CallbackEntry {
-        data class OnNetworkNeeded(val request: NetworkRequest) : CallbackEntry()
-        data class OnNetworkUnneeded(val request: NetworkRequest) : CallbackEntry()
+        data class Needed(val request: NetworkRequest) : CallbackEntry()
+        data class Unneeded(val request: NetworkRequest) : CallbackEntry()
     }
 
     /**
@@ -39,7 +45,7 @@ class TestableNetworkOfferCallback(val timeoutMs: Long, private val noCallbackTi
      */
     override fun onNetworkNeeded(request: NetworkRequest) {
         Log.d(TAG, "onNetworkNeeded $request")
-        history.add(CallbackEntry.OnNetworkNeeded(request))
+        history.add(CallbackEntry.Needed(request))
     }
 
     /**
@@ -47,25 +53,59 @@ class TestableNetworkOfferCallback(val timeoutMs: Long, private val noCallbackTi
      */
     override fun onNetworkUnneeded(request: NetworkRequest) {
         Log.d(TAG, "onNetworkUnneeded $request")
-        history.add(CallbackEntry.OnNetworkUnneeded(request))
+        history.add(CallbackEntry.Unneeded(request))
     }
 
+    // TODO : move to some utility, this is copied from TestableNetworkCallback
+    fun failWithErrorReason(errorMsg: String?, errorReason: String): Nothing {
+        val message = if (errorMsg != null) "$errorMsg : $errorReason" else errorReason
+        fail(message)
+    }
+
+    inline fun <reified T : CallbackEntry> expect(
+        errorMsg: String? = null,
+        predicate: (T) -> Boolean = { true }
+    ): T {
+        val nextEntry = history.poll(timeoutMs) ?: failWithErrorReason(errorMsg,
+            "Did not receive ${T::class.simpleName} after ${timeoutMs}ms")
+        if (nextEntry !is T) {
+            failWithErrorReason(
+                errorMsg,
+                "Expected callback ${T::class.simpleName}, got $nextEntry"
+            )
+        }
+        if (!predicate(nextEntry)) {
+            failWithErrorReason(errorMsg, "Callback doesn't match predicate: $nextEntry")
+        }
+        return nextEntry
+    }
+
+    // TODO : remove when there are no callers
+    @Deprecated("Use expect instead of expectCallbackThat")
     inline fun <reified T : CallbackEntry> expectCallbackThat(
         crossinline predicate: (T) -> Boolean
-    ): T {
-        val event = history.poll(timeoutMs)
-                ?: fail("Did not receive callback after ${timeoutMs}ms")
-        if (event !is T || !predicate(event)) fail("Received unexpected callback $event")
-        return event
-    }
+    ): T = expect<T>(null, predicate)
+
+    inline fun <reified T : CallbackEntry> eventuallyExpect(
+        errorMsg: String? = null,
+        from: Int = mark,
+        crossinline predicate: (T) -> Boolean = { true }
+    ) = history.poll(timeoutMs, from) { it is T && predicate(it) }.also {
+        if (null == it) {
+            failWithErrorReason(
+                errorMsg,
+                "Callback ${T::class} not received within ${timeoutMs}ms."
+            )
+        }
+    } as T
 
     fun expectOnNetworkNeeded(capabilities: NetworkCapabilities) =
-            expectCallbackThat<CallbackEntry.OnNetworkNeeded> {
+            expectCallbackThat<CallbackEntry.Needed> {
                 it.request.canBeSatisfiedBy(capabilities)
             }
 
     fun expectOnNetworkUnneeded(capabilities: NetworkCapabilities) =
-            expectCallbackThat<CallbackEntry.OnNetworkUnneeded> {
+            expectCallbackThat<CallbackEntry.Unneeded> {
                 it.request.canBeSatisfiedBy(capabilities)
             }
 
@@ -73,4 +113,4 @@ class TestableNetworkOfferCallback(val timeoutMs: Long, private val noCallbackTi
         val cb = history.poll(noCallbackTimeoutMs)
         if (null != cb) fail("Expected no callback but got $cb")
     }
-}
\ No newline at end of file
+}
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSNetworkReservationTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSNetworkReservationTest.kt
index e698930e3a..a509d1ecc8 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSNetworkReservationTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSNetworkReservationTest.kt
@@ -36,7 +36,7 @@ import com.android.testutils.RecorderCallback.CallbackEntry.Reserved
 import com.android.testutils.RecorderCallback.CallbackEntry.Unavailable
 import com.android.testutils.TestableNetworkCallback
 import com.android.testutils.TestableNetworkOfferCallback
-import com.android.testutils.TestableNetworkOfferCallback.CallbackEntry.OnNetworkNeeded
+import com.android.testutils.TestableNetworkOfferCallback.CallbackEntry.Needed
 import kotlin.test.assertEquals
 import kotlin.test.assertNull
 import org.junit.Before
@@ -134,7 +134,7 @@ class CSNetworkReservationTest : CSTest() {
 
         // validate the offer does not receive onNetworkNeeded for reservation request
         offerCb.expectNoCallbackWhere {
-            it is OnNetworkNeeded && it.request.type == NetworkRequest.Type.RESERVATION
+            it is Needed && it.request.type == NetworkRequest.Type.RESERVATION
         }
     }
 
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSPreferenceTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSPreferenceTest.kt
index ac3c859722..05588f6076 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSPreferenceTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSPreferenceTest.kt
@@ -44,8 +44,8 @@ import com.android.testutils.DevSdkIgnoreRunner
 import com.android.testutils.RecorderCallback.CallbackEntry.Lost
 import com.android.testutils.TestableNetworkCallback
 import com.android.testutils.TestableNetworkOfferCallback
-import com.android.testutils.TestableNetworkOfferCallback.CallbackEntry.OnNetworkNeeded
-import com.android.testutils.TestableNetworkOfferCallback.CallbackEntry.OnNetworkUnneeded
+import com.android.testutils.TestableNetworkOfferCallback.CallbackEntry.Needed
+import com.android.testutils.TestableNetworkOfferCallback.CallbackEntry.Unneeded
 import com.android.testutils.postAndWait
 import com.android.testutils.runAsShell
 import org.junit.Rule
@@ -276,9 +276,9 @@ class CSPreferenceTest : CSTest() {
     fun testOptInSatellitePreference_NetworkConnectedFirst_RestrictedSatellite() =
         doTestSatellitePreference_NetworkConnectedFirst(satelliteRestricted = true)
 
-    private val OnNetworkNeeded.isRestricted
+    private val Needed.isRestricted
         get() = !request.hasCapability(NET_CAPABILITY_NOT_RESTRICTED)
-    private val OnNetworkUnneeded.isRestricted
+    private val Unneeded.isRestricted
         get() = !request.hasCapability(NET_CAPABILITY_NOT_RESTRICTED)
 
     /**
@@ -297,20 +297,14 @@ class CSPreferenceTest : CSTest() {
         val provider = NetworkProvider(context, csHandlerThread.looper, "Test provider")
         cm.registerNetworkProvider(provider)
 
-        val satelliteCallback = TestableNetworkOfferCallback(
-            DEFAULT_TIMEOUT_MS,
-            DEFAULT_NO_CALLBACK_TIMEOUT_MS
-        )
+        val satelliteCallback = TestableNetworkOfferCallback()
         provider.registerNetworkOffer(
             NetworkScore.Builder().build(),
             satelliteNc(restricted = false),
             Runnable::run,
             satelliteCallback
         )
-        val restrictedSatelliteCallback = TestableNetworkOfferCallback(
-            DEFAULT_TIMEOUT_MS,
-            DEFAULT_NO_CALLBACK_TIMEOUT_MS
-        )
+        val restrictedSatelliteCallback = TestableNetworkOfferCallback()
         provider.registerNetworkOffer(
             NetworkScore.Builder().build(),
             satelliteNc(restricted = true),
@@ -320,18 +314,18 @@ class CSPreferenceTest : CSTest() {
         satelliteCallback.assertNoCallback()
 
         updateSatellitePreference(emptySet(), setOf(UID1))
-        satelliteCallback.expectCallbackThat<OnNetworkNeeded> { true }
+        satelliteCallback.expect<Needed>()
         satelliteCallback.assertNoCallback()
         restrictedSatelliteCallback.assertNoCallback()
 
         updateSatellitePreference(emptySet(), emptySet())
-        satelliteCallback.expectCallbackThat<OnNetworkUnneeded> { true }
+        satelliteCallback.expect<Unneeded>()
         satelliteCallback.assertNoCallback()
         restrictedSatelliteCallback.assertNoCallback()
 
         updateSatellitePreference(setOf(SMSUID), emptySet())
-        satelliteCallback.expectCallbackThat<OnNetworkNeeded> { it.isRestricted }
-        restrictedSatelliteCallback.expectCallbackThat<OnNetworkNeeded> { it.isRestricted }
+        satelliteCallback.expect<Needed> { it.isRestricted }
+        restrictedSatelliteCallback.expect<Needed> { it.isRestricted }
         satelliteCallback.assertNoCallback()
         restrictedSatelliteCallback.assertNoCallback()
 
@@ -346,39 +340,39 @@ class CSPreferenceTest : CSTest() {
         // happening because updating the preferences removes the requests, which causes a
         // rematch (where the requests are not registered), then adds the requests again, which
         // causes another rematch.
-        satelliteCallback.expectCallbackThat<OnNetworkUnneeded> { it.isRestricted }
-        restrictedSatelliteCallback.expectCallbackThat<OnNetworkUnneeded> { it.isRestricted }
-        satelliteCallback.expectCallbackThat<OnNetworkNeeded> { !it.isRestricted }
-        satelliteCallback.expectCallbackThat<OnNetworkNeeded> { it.isRestricted }
-        restrictedSatelliteCallback.expectCallbackThat<OnNetworkNeeded> { it.isRestricted }
+        satelliteCallback.expect<Unneeded> { it.isRestricted }
+        restrictedSatelliteCallback.expect<Unneeded> { it.isRestricted }
+        satelliteCallback.expect<Needed> { !it.isRestricted }
+        satelliteCallback.expect<Needed> { it.isRestricted }
+        restrictedSatelliteCallback.expect<Needed> { it.isRestricted }
         satelliteCallback.assertNoCallback()
         restrictedSatelliteCallback.assertNoCallback()
 
         updateSatellitePreference(emptySet(), setOf(UID1))
-        satelliteCallback.expectCallbackThat<OnNetworkUnneeded> { it.isRestricted }
-        satelliteCallback.expectCallbackThat<OnNetworkUnneeded> { !it.isRestricted }
-        satelliteCallback.expectCallbackThat<OnNetworkNeeded> { !it.isRestricted }
-        restrictedSatelliteCallback.expectCallbackThat<OnNetworkUnneeded> { it.isRestricted }
+        satelliteCallback.expect<Unneeded> { it.isRestricted }
+        satelliteCallback.expect<Unneeded> { !it.isRestricted }
+        satelliteCallback.expect<Needed> { !it.isRestricted }
+        restrictedSatelliteCallback.expect<Unneeded> { it.isRestricted }
         satelliteCallback.assertNoCallback()
         restrictedSatelliteCallback.assertNoCallback()
 
         updateSatellitePreference(setOf(SMSUID), setOf(UID1))
-        restrictedSatelliteCallback.expectCallbackThat<OnNetworkNeeded> { it.isRestricted }
+        restrictedSatelliteCallback.expect<Needed> { it.isRestricted }
         satelliteCallback.assertNoCallback()
         restrictedSatelliteCallback.assertNoCallback()
 
         val wifiAgent = Agent(TRANSPORT_WIFI)
         wifiAgent.connect()
-        satelliteCallback.expectCallbackThat<OnNetworkUnneeded> { it.isRestricted }
-        satelliteCallback.expectCallbackThat<OnNetworkUnneeded> { !it.isRestricted }
-        restrictedSatelliteCallback.expectCallbackThat<OnNetworkUnneeded> { it.isRestricted }
+        satelliteCallback.expect<Unneeded> { it.isRestricted }
+        satelliteCallback.expect<Unneeded> { !it.isRestricted }
+        restrictedSatelliteCallback.expect<Unneeded> { it.isRestricted }
         satelliteCallback.assertNoCallback()
         restrictedSatelliteCallback.assertNoCallback()
 
         wifiAgent.disconnect()
-        satelliteCallback.expectCallbackThat<OnNetworkNeeded> { it.isRestricted }
-        satelliteCallback.expectCallbackThat<OnNetworkNeeded> { !it.isRestricted }
-        restrictedSatelliteCallback.expectCallbackThat<OnNetworkNeeded> { it.isRestricted }
+        satelliteCallback.expect<Needed> { it.isRestricted }
+        satelliteCallback.expect<Needed> { !it.isRestricted }
+        restrictedSatelliteCallback.expect<Needed> { it.isRestricted }
         satelliteCallback.assertNoCallback()
         restrictedSatelliteCallback.assertNoCallback()
     }

From c96d1ae0e6e83167b3dd9cdfae322ca43db99c8e Mon Sep 17 00:00:00 2001
From: Chalard Jean <jchalard@google.com>
Date: Sun, 27 Apr 2025 11:01:10 +0900
Subject: [PATCH 167/377] Move failWithErrorReason to a common place
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is a shared public utility. Its main utility is for methods
that can fail, have an error message of their own, and also want
to take an error message from a caller and want to combine them.
Example use :
fun <T> assertEquals(expected: T, actual: T, msg: String? = null) {
  if (expected != null) {
    failWithErrorReason(msg, "Expected $expected, got $actual")
  }
}
...which allows someone to say
assertEquals(a, b, "Checking a vs b")

Test: TH
Flag: EXEMPT test-only change
Change-Id: Id3eaa8384b4177f38f13576d9b4d742c52027ae4
---
 .../com/android/testutils/TestableNetworkCallback.kt   |  8 +-------
 .../android/testutils/TestableNetworkOfferCallback.kt  |  6 ------
 .../hostdevice/com/android/testutils/MiscAsserts.kt    | 10 +++++++++-
 3 files changed, 10 insertions(+), 14 deletions(-)

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/TestableNetworkCallback.kt b/staticlibs/testutils/devicetests/com/android/testutils/TestableNetworkCallback.kt
index d9c51e5201..c4e236e1d0 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/TestableNetworkCallback.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/TestableNetworkCallback.kt
@@ -70,7 +70,7 @@ open class RecorderCallback private constructor(
         data class Reserved private constructor(
                 override val network: Network,
                 val caps: NetworkCapabilities
-        ): CallbackEntry() {
+        ) : CallbackEntry() {
             constructor(caps: NetworkCapabilities) : this(NULL_NETWORK, caps)
         }
         data class Available(override val network: Network) : CallbackEntry()
@@ -399,12 +399,6 @@ open class TestableNetworkCallback private constructor(
                 }
             } as T
 
-    // "Nothing" is the return type to declare a function never returns a value.
-    fun failWithErrorReason(errorMsg: String?, errorReason: String): Nothing {
-        val message = if (errorMsg != null) "$errorMsg : $errorReason" else errorReason
-        fail(message)
-    }
-
     inline fun <reified T : CallbackEntry> expect(
         network: HasNetwork,
         timeoutMs: Long = defaultTimeoutMs,
diff --git a/staticlibs/testutils/devicetests/com/android/testutils/TestableNetworkOfferCallback.kt b/staticlibs/testutils/devicetests/com/android/testutils/TestableNetworkOfferCallback.kt
index 8f9014c816..8228440f54 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/TestableNetworkOfferCallback.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/TestableNetworkOfferCallback.kt
@@ -56,12 +56,6 @@ class TestableNetworkOfferCallback(
         history.add(CallbackEntry.Unneeded(request))
     }
 
-    // TODO : move to some utility, this is copied from TestableNetworkCallback
-    fun failWithErrorReason(errorMsg: String?, errorReason: String): Nothing {
-        val message = if (errorMsg != null) "$errorMsg : $errorReason" else errorReason
-        fail(message)
-    }
-
     inline fun <reified T : CallbackEntry> expect(
         errorMsg: String? = null,
         predicate: (T) -> Boolean = { true }
diff --git a/staticlibs/testutils/hostdevice/com/android/testutils/MiscAsserts.kt b/staticlibs/testutils/hostdevice/com/android/testutils/MiscAsserts.kt
index 176546a4c0..de797b0ba4 100644
--- a/staticlibs/testutils/hostdevice/com/android/testutils/MiscAsserts.kt
+++ b/staticlibs/testutils/hostdevice/com/android/testutils/MiscAsserts.kt
@@ -142,4 +142,12 @@ fun assertEventuallyTrue(
         }
         Thread.sleep(pollIntervalMs)
     }
-}
\ No newline at end of file
+}
+
+// "Nothing" is the return type to declare a function never returns a value. This is useful
+// because the compiler will know the branch of the code calling this does not return, which
+// lets check exhaustivity, infer return types, nullability and smart casts.
+fun failWithErrorReason(errorMsg: String?, errorReason: String): Nothing {
+    val message = if (errorMsg != null) "$errorMsg : $errorReason" else errorReason
+    fail(message)
+}

From 2fd0d11db336f40b7bc2ccffbea3c42e6e0f784f Mon Sep 17 00:00:00 2001
From: Junyu Lai <junyulai@google.com>
Date: Fri, 25 Apr 2025 14:48:31 +0800
Subject: [PATCH 168/377] Pipe the satellite network opt-in UIDs down to
 ConnectivityService

Flag: EXEMPT flagged with a kill switch
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.connectivity.SatelliteAccessControllerTest \
  --update-device
Bug: 410731080
Change-Id: I76a57a3c42659b594cd541c55e0e179062461085
---
 .../SatelliteAccessController.java            | 55 +++++++-----
 .../SatelliteAccessControllerTest.kt          | 90 +++++++++++++------
 2 files changed, 96 insertions(+), 49 deletions(-)

diff --git a/service/src/com/android/server/connectivity/SatelliteAccessController.java b/service/src/com/android/server/connectivity/SatelliteAccessController.java
index b1a104cee1..baf146f734 100644
--- a/service/src/com/android/server/connectivity/SatelliteAccessController.java
+++ b/service/src/com/android/server/connectivity/SatelliteAccessController.java
@@ -43,6 +43,8 @@ import java.util.Set;
 import java.util.concurrent.Executor;
 import java.util.function.BiConsumer;
 
+import javax.annotation.CheckReturnValue;
+
 /**
  * Tracks the uid of all the default messaging application which are role_sms role and
  * satellite_communication permission complaint and requests ConnectivityService to create multi
@@ -145,6 +147,8 @@ public class SatelliteAccessController {
         mSupportConstrainedDataSatelliteOptIn = mDeps.supportConstrainedDataSatelliteOptIn(c);
     }
 
+    // TODO: Rename to updateSatelliteSmsRoleUidListCache since Opt-In apps are also
+    //  fallback uids.
     private Set<Integer> updateSatelliteNetworkFallbackUidListCache(List<String> packageNames,
             @NonNull UserHandle userHandle) {
         Set<Integer> fallbackUids = new ArraySet<>();
@@ -229,11 +233,13 @@ public class SatelliteAccessController {
             mergedSatelliteNetworkFallbackUidCache.addAll(
                     mAllUsersSatelliteNetworkFallbackUidCache.valueAt(i));
         }
-        Log.i(TAG, "merged uid list for multi layer request : "
-                + mergedSatelliteNetworkFallbackUidCache);
+        Log.i(TAG, "SmsRoleUids: " + mergedSatelliteNetworkFallbackUidCache
+                + " Opt-InUids:" + mSatelliteDataOptimizedUids);
 
         // trigger multiple layer request for satellite network fallback of multi user uids
-        mCallback.accept(mergedSatelliteNetworkFallbackUidCache, Set.of());
+        final ArraySet<Integer> optimizedApps = new ArraySet(mSatelliteDataOptimizedUids);
+        optimizedApps.removeAll(mergedSatelliteNetworkFallbackUidCache);
+        mCallback.accept(mergedSatelliteNetworkFallbackUidCache, optimizedApps);
     }
 
     public void start() {
@@ -241,12 +247,14 @@ public class SatelliteAccessController {
         mDefaultMessageRoleListener.register();
     }
 
-    private void updateSatelliteFallbackUidListOnUserRemoval(int userIdRemoved) {
+    @CheckReturnValue
+    private boolean updateSatelliteFallbackUidListOnUserRemoval(int userIdRemoved) {
         Log.i(TAG, "user id removed:" + userIdRemoved);
         if (mAllUsersSatelliteNetworkFallbackUidCache.contains(userIdRemoved)) {
             mAllUsersSatelliteNetworkFallbackUidCache.remove(userIdRemoved);
-            reportSatelliteNetworkFallbackUids();
+            return true; // Changed.
         }
+        return false; // Unchanged.
     }
 
     /**
@@ -269,7 +277,10 @@ public class SatelliteAccessController {
                 getSatelliteDataOptimizedAppsForUser(apps);
         Log.i(TAG, "Add SatelliteDataOptimizedApps + for user " + userHandle + ": "
                 + satelliteDataOptimizedAppsForUser);
-        mSatelliteDataOptimizedUids.addAll(satelliteDataOptimizedAppsForUser);
+        if (satelliteDataOptimizedAppsForUser.size() > 0) {
+            mSatelliteDataOptimizedUids.addAll(satelliteDataOptimizedAppsForUser);
+            reportSatelliteNetworkFallbackUids();
+        }
     }
 
     /**
@@ -278,9 +289,17 @@ public class SatelliteAccessController {
      * @param userHandle The integer userHandle of the removed user. See {@link #EXTRA_USER_HANDLE}.
      */
     public void onUserRemoved(@NonNull UserHandle userHandle) {
-        updateSatelliteFallbackUidListOnUserRemoval(userHandle.getIdentifier());
+        final boolean smsRoleUidsChanged =
+                updateSatelliteFallbackUidListOnUserRemoval(userHandle.getIdentifier());
+        final boolean mDataOptimizedUidChanged;
         if (mSupportConstrainedDataSatelliteOptIn) {
-            removeSatelliteDataOptimizedAppsForUser(userHandle.getIdentifier());
+            mDataOptimizedUidChanged =
+                    removeSatelliteDataOptimizedUidsForUser(userHandle.getIdentifier());
+        } else {
+            mDataOptimizedUidChanged = false;
+        }
+        if (smsRoleUidsChanged || mDataOptimizedUidChanged) {
+            reportSatelliteNetworkFallbackUids();
         }
     }
 
@@ -293,6 +312,7 @@ public class SatelliteAccessController {
     public void onPackageAdded(@NonNull final String packageName, final int uid) {
         if (mSupportConstrainedDataSatelliteOptIn && isSatelliteDataOptimizedApp(packageName)) {
             mSatelliteDataOptimizedUids.add(uid);
+            reportSatelliteNetworkFallbackUids();
         }
     }
 
@@ -317,18 +337,7 @@ public class SatelliteAccessController {
         // If the loop completes without returning, it means no other
         // satellite-optimized app shares the UID.
         mSatelliteDataOptimizedUids.remove(uid);
-    }
-
-    /** Checks if the given UID is in the set of satellite data optimized UIDs. */
-    @VisibleForTesting
-    public boolean isSatelliteDataOptimizedUid(int uid) {
-        return mSatelliteDataOptimizedUids.contains(uid);
-    }
-
-    /** Gets the number of satellite data optimized UIDs being tracked. */
-    @VisibleForTesting
-    public int getSatelliteDataOptimizedUidCount() {
-        return mSatelliteDataOptimizedUids.size();
+        reportSatelliteNetworkFallbackUids();
     }
 
     @NonNull
@@ -351,7 +360,9 @@ public class SatelliteAccessController {
         }
     }
 
-    private void removeSatelliteDataOptimizedAppsForUser(int userIdToRemove) {
-        mSatelliteDataOptimizedUids.removeIf(uid -> uid / PER_USER_RANGE == userIdToRemove);
+    // Return true if changed.
+    @CheckReturnValue
+    private boolean removeSatelliteDataOptimizedUidsForUser(int userIdToRemove) {
+        return mSatelliteDataOptimizedUids.removeIf(uid -> uid / PER_USER_RANGE == userIdToRemove);
     }
 }
diff --git a/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt b/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt
index 0191b3dad9..dc1aaca197 100644
--- a/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt
+++ b/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt
@@ -38,9 +38,6 @@ import com.android.testutils.com.android.testutils.SetFeatureFlagsRule.FeatureFl
 import java.util.concurrent.CompletableFuture
 import java.util.concurrent.Executor
 import java.util.function.BiConsumer
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertFalse
-import org.junit.Assert.assertTrue
 import org.junit.Before
 import org.junit.Rule
 import org.junit.Test
@@ -50,6 +47,7 @@ import org.mockito.ArgumentMatchers.any
 import org.mockito.ArgumentMatchers.anyInt
 import org.mockito.ArgumentMatchers.eq
 import org.mockito.Mockito.doReturn
+import org.mockito.Mockito.inOrder
 import org.mockito.Mockito.mock
 import org.mockito.Mockito.never
 import org.mockito.Mockito.times
@@ -355,8 +353,7 @@ class SatelliteAccessControllerTest {
     fun testSatelliteOptimizedUids_onPackageAdded() {
         mockIsSatelliteDataOptimizedApp(TEST_PACKAGE1, true)
         mSatelliteAccessController.onPackageAdded(TEST_PACKAGE1, TEST_UID1)
-        assertTrue(mSatelliteAccessController.isSatelliteDataOptimizedUid(TEST_UID1))
-        assertEquals(mSatelliteAccessController.satelliteDataOptimizedUidCount, 1)
+        verify(mCallback).accept(emptySet(), setOf(TEST_UID1))
     }
 
     @FeatureFlag(name = CONSTRAINED_DATA_SATELLITE_OPTIN)
@@ -364,8 +361,7 @@ class SatelliteAccessControllerTest {
     fun testSatelliteOptimizedUids_onPackageAdded_ignoresIfNotSatelliteOptimized() {
         mockIsSatelliteDataOptimizedApp(TEST_PACKAGE1, false)
         mSatelliteAccessController.onPackageAdded(TEST_PACKAGE1, TEST_UID1)
-        assertFalse(mSatelliteAccessController.isSatelliteDataOptimizedUid(TEST_UID1))
-        assertEquals(mSatelliteAccessController.satelliteDataOptimizedUidCount, 0)
+        verify(mCallback, never()).accept(any(), any())
     }
 
     @FeatureFlag(name = CONSTRAINED_DATA_SATELLITE_OPTIN)
@@ -375,11 +371,9 @@ class SatelliteAccessControllerTest {
         mockGetPackagesForUid(TEST_UID1, arrayOf(TEST_PACKAGE1))
 
         mSatelliteAccessController.onPackageAdded(TEST_PACKAGE1, TEST_UID1)
-        assertTrue(mSatelliteAccessController.isSatelliteDataOptimizedUid(TEST_UID1))
-        assertEquals(mSatelliteAccessController.satelliteDataOptimizedUidCount, 1)
+        verify(mCallback).accept(emptySet(), setOf(TEST_UID1))
         mSatelliteAccessController.onPackageRemoved(TEST_PACKAGE1, TEST_UID1)
-        assertFalse(mSatelliteAccessController.isSatelliteDataOptimizedUid(TEST_UID1))
-        assertEquals(mSatelliteAccessController.satelliteDataOptimizedUidCount, 0)
+        verify(mCallback).accept(emptySet(), emptySet())
     }
 
     @FeatureFlag(name = CONSTRAINED_DATA_SATELLITE_OPTIN)
@@ -390,18 +384,16 @@ class SatelliteAccessControllerTest {
         mockGetPackagesForUid(TEST_UID1, arrayOf(TEST_PACKAGE1, TEST_PACKAGE2))
 
         // Verify uid is not removed if there is still another package shares the same uid.
+        val inOrder = inOrder(mCallback)
         mSatelliteAccessController.onPackageAdded(TEST_PACKAGE1, TEST_UID1)
-        assertTrue(mSatelliteAccessController.isSatelliteDataOptimizedUid(TEST_UID1))
-        assertEquals(mSatelliteAccessController.satelliteDataOptimizedUidCount, 1)
+        inOrder.verify(mCallback).accept(emptySet(), setOf(TEST_UID1))
         mSatelliteAccessController.onPackageRemoved(TEST_PACKAGE1, TEST_UID1)
-        assertTrue(mSatelliteAccessController.isSatelliteDataOptimizedUid(TEST_UID1))
-        assertEquals(mSatelliteAccessController.satelliteDataOptimizedUidCount, 1)
+        inOrder.verifyNoMoreInteractions()
 
         // Verify uid is removed if there is no other package with shared uid.
         mockGetPackagesForUid(TEST_UID1, null)
         mSatelliteAccessController.onPackageRemoved(TEST_PACKAGE2, TEST_UID1)
-        assertFalse(mSatelliteAccessController.isSatelliteDataOptimizedUid(TEST_UID1))
-        assertEquals(mSatelliteAccessController.satelliteDataOptimizedUidCount, 0)
+        inOrder.verify(mCallback).accept(emptySet(), emptySet())
     }
 
     @FeatureFlag(name = CONSTRAINED_DATA_SATELLITE_OPTIN)
@@ -412,22 +404,22 @@ class SatelliteAccessControllerTest {
         val packageInfo1 = makePackageInfo(TEST_PACKAGE1, TEST_UID1)
         val packageInfo2 = makePackageInfo(TEST_PACKAGE2, TEST_UID2)
 
+        val inOrder = inOrder(mCallback)
         mSatelliteAccessController
                 .onUserAddedWithInstalledPackageList(PRIMARY_USER_HANDLE, listOf(packageInfo1))
         mSatelliteAccessController
                 .onUserAddedWithInstalledPackageList(SECONDARY_USER_HANDLE, listOf(packageInfo2))
-        assertTrue(mSatelliteAccessController.isSatelliteDataOptimizedUid(TEST_UID1))
-        assertTrue(mSatelliteAccessController.isSatelliteDataOptimizedUid(TEST_UID2))
+        inOrder.verify(mCallback).accept(emptySet(), setOf(TEST_UID1))
+        inOrder.verify(mCallback).accept(emptySet(), setOf(TEST_UID1, TEST_UID2))
 
         mSatelliteAccessController.onUserRemoved(SECONDARY_USER_HANDLE)
         // Verify that the app associated with the non-removed user is not removed.
-        assertTrue(mSatelliteAccessController.isSatelliteDataOptimizedUid(TEST_UID1))
-        // Verify that the app associated with the removed user is removed.
-        assertFalse(mSatelliteAccessController.isSatelliteDataOptimizedUid(TEST_UID2))
+        inOrder.verify(mCallback).accept(emptySet(), setOf(TEST_UID1))
 
         mSatelliteAccessController.onUserRemoved(PRIMARY_USER_HANDLE)
         // Verify everything is removed.
-        assertEquals(mSatelliteAccessController.satelliteDataOptimizedUidCount, 0)
+        inOrder.verify(mCallback).accept(emptySet(), emptySet())
+        inOrder.verifyNoMoreInteractions()
     }
 
     @FeatureFlag(name = CONSTRAINED_DATA_SATELLITE_OPTIN, enabled = false)
@@ -439,12 +431,56 @@ class SatelliteAccessControllerTest {
         // Verify nothing changes and nothing crashes.
         mSatelliteAccessController
                 .onUserAddedWithInstalledPackageList(PRIMARY_USER_HANDLE, listOf(packageInfo1))
-        assertEquals(mSatelliteAccessController.satelliteDataOptimizedUidCount, 0)
         mSatelliteAccessController.onPackageAdded(TEST_PACKAGE1, TEST_UID1)
-        assertEquals(mSatelliteAccessController.satelliteDataOptimizedUidCount, 0)
         mSatelliteAccessController.onPackageRemoved(TEST_PACKAGE1, TEST_UID1)
-        assertEquals(mSatelliteAccessController.satelliteDataOptimizedUidCount, 0)
         mSatelliteAccessController.onUserRemoved(PRIMARY_USER_HANDLE)
-        assertEquals(mSatelliteAccessController.satelliteDataOptimizedUidCount, 0)
+        verify(mCallback, never()).accept(any(), any())
+    }
+
+    @FeatureFlag(name = CONSTRAINED_DATA_SATELLITE_OPTIN)
+    @Test
+    fun testSatelliteOptimizedUids_withSmsRoleUids() {
+        startSatelliteAccessController()
+        // Set SMS_APP1 under primary user as a sms-role Uid.
+        doReturn(listOf(SMS_APP1))
+                .`when`(mDeps).getRoleHoldersAsUser(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        mRoleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        verify(mCallback).accept(setOf(SMS_APP_ID1.toUid(PRIMARY_USER)), emptySet())
+
+        // Mock another opt-in uid, verify they both reported via the callback.
+        mockIsSatelliteDataOptimizedApp(TEST_PACKAGE1, true)
+        mSatelliteAccessController.onPackageAdded(TEST_PACKAGE1, TEST_UID1)
+        verify(mCallback).accept(setOf(SMS_APP_ID1.toUid(PRIMARY_USER)), setOf(TEST_UID1))
+    }
+
+    @FeatureFlag(name = CONSTRAINED_DATA_SATELLITE_OPTIN)
+    @Test
+    fun testSatelliteOptimizedUids_withSmsRoleUids_overlappedUid() {
+        startSatelliteAccessController()
+        val smsUid = SMS_APP_ID1.toUid(PRIMARY_USER)
+
+        val inOrder = inOrder(mCallback)
+        // Mock opt-in uids, verify they both reported via the callback.
+        // However, one opt-in uid is a messaging app and will surprise us later.
+        mockIsSatelliteDataOptimizedApp(TEST_PACKAGE1, true)
+        mockIsSatelliteDataOptimizedApp(SMS_APP1, true)
+        mSatelliteAccessController.onPackageAdded(TEST_PACKAGE1, TEST_UID1)
+        inOrder.verify(mCallback).accept(emptySet(), setOf(TEST_UID1))
+        mSatelliteAccessController.onPackageAdded(SMS_APP1, smsUid)
+        inOrder.verify(mCallback).accept(emptySet(), setOf(TEST_UID1, smsUid))
+
+        // Set SMS_APP1 as a sms-role Uid.
+        // Verify the sms-role Uid is excluded from the opt-in Uid list.
+        doReturn(listOf(SMS_APP1))
+                .`when`(mDeps).getRoleHoldersAsUser(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        mRoleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        inOrder.verify(mCallback).accept(setOf(smsUid), setOf(TEST_UID1))
+
+        // Unset SMS_APP1 as the sms-role Uid.
+        // Verify the sms-role Uid is included to the opt-in Uid list again.
+        doReturn(emptyList<String>())
+                .`when`(mDeps).getRoleHoldersAsUser(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        mRoleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        inOrder.verify(mCallback).accept(emptySet(), setOf(TEST_UID1, smsUid))
     }
 }

From 809869a8ee33190b9ef30490a5a636366b14a836 Mon Sep 17 00:00:00 2001
From: Junyu Lai <junyulai@google.com>
Date: Fri, 25 Apr 2025 15:34:06 +0800
Subject: [PATCH 169/377] Support dumpsys for SatelliteAccessController

Sample output:
SatelliteAccessController:
  Sms-Role Apps: {0={10138}}
  Opt-In Uids: {10123}

Flag: EXEMPT flagged with a kill switch
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.connectivity.SatelliteAccessControllerTest \
      --update-device
Bug: 410731080
Change-Id: Ib868d61b9b1c1b5d8adde4d78b6d005a57d5526d
---
 .../com/android/server/ConnectivityService.java   |  5 +++++
 .../connectivity/SatelliteAccessController.java   | 15 +++++++++++++++
 2 files changed, 20 insertions(+)

diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index 269d7489be..05ea6f962f 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -4557,6 +4557,11 @@ public class ConnectivityService extends IConnectivityManager.Stub
         mPermissionMonitor.dump(pw);
         pw.decreaseIndent();
 
+        pw.println();
+        if (mSatelliteAccessController != null) {
+            mSatelliteAccessController.dump(pw);
+        }
+
         pw.println();
         pw.println("Legacy network activity:");
         pw.increaseIndent();
diff --git a/service/src/com/android/server/connectivity/SatelliteAccessController.java b/service/src/com/android/server/connectivity/SatelliteAccessController.java
index baf146f734..50edacf6f8 100644
--- a/service/src/com/android/server/connectivity/SatelliteAccessController.java
+++ b/service/src/com/android/server/connectivity/SatelliteAccessController.java
@@ -36,6 +36,7 @@ import android.util.Log;
 import android.util.SparseArray;
 
 import com.android.internal.annotations.VisibleForTesting;
+import com.android.internal.util.IndentingPrintWriter;
 import com.android.net.module.util.DeviceConfigUtils;
 
 import java.util.List;
@@ -365,4 +366,18 @@ public class SatelliteAccessController {
     private boolean removeSatelliteDataOptimizedUidsForUser(int userIdToRemove) {
         return mSatelliteDataOptimizedUids.removeIf(uid -> uid / PER_USER_RANGE == userIdToRemove);
     }
+
+    /** Dump info to dumpsys */
+    public void dump(@NonNull IndentingPrintWriter pw) {
+        pw.println("SatelliteAccessController:");
+        pw.increaseIndent();
+        pw.print("Sms-Role Uids: ");
+        pw.print(mAllUsersSatelliteNetworkFallbackUidCache);
+        pw.println();
+        pw.print("Opt-In Uids: ");
+        pw.print(mSatelliteDataOptimizedUids);
+        pw.println();
+        pw.decreaseIndent();
+        pw.println();
+    }
 }

From 8092ae7d29d7f781647f2b3e81a3b00e75e3b08c Mon Sep 17 00:00:00 2001
From: Chuwei He <chuweih@google.com>
Date: Tue, 25 Mar 2025 16:52:03 +0900
Subject: [PATCH 170/377] Add EthernetPort class

This patch adds EthernetPort class which is used to track configuration
of ethernet networks internally.

Bug: 397536853
Test: atest ConnectivityCoverageTests:android.net.connectivity.
      com.android.server.ethernet.EthernetPortTest
Flag: EXEMPT mainline

Change-Id: Iba1c4461ae7d666aa31c076baa33c32c2c1f7603
---
 .../android/server/ethernet/EthernetPort.java |  97 ++++++++++++++
 .../server/ethernet/EthernetPortTest.java     | 121 ++++++++++++++++++
 2 files changed, 218 insertions(+)
 create mode 100644 service-t/src/com/android/server/ethernet/EthernetPort.java
 create mode 100644 tests/unit/java/com/android/server/ethernet/EthernetPortTest.java

diff --git a/service-t/src/com/android/server/ethernet/EthernetPort.java b/service-t/src/com/android/server/ethernet/EthernetPort.java
new file mode 100644
index 0000000000..eb7a0bd885
--- /dev/null
+++ b/service-t/src/com/android/server/ethernet/EthernetPort.java
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.server.ethernet;
+
+import android.annotation.Nullable;
+import android.net.MacAddress;
+import android.text.TextUtils;
+
+import java.util.Objects;
+
+/**
+ * A class representing an ethernet port. This class is used as an internal class to track existing
+ * ethernet interfaces managed by EthernetTracker.
+ */
+public class EthernetPort {
+    private final String mInterfaceName;
+
+    private final MacAddress mMacAddress;
+
+    private final int mInterfaceIndex;
+
+    /**
+     * Creates an EthernetPort for the given interface name, MAC address and index.
+     */
+    public EthernetPort(String interfaceName, MacAddress macAddress, int index) {
+        if (TextUtils.isEmpty(interfaceName) || macAddress == null || index <= 0) {
+            throw new IllegalArgumentException("Ethernet port should have valid interface name, "
+                    + "MAC address and interface index.");
+        }
+
+        mInterfaceName = interfaceName;
+        mMacAddress = macAddress;
+        mInterfaceIndex = index;
+    }
+
+    /**
+     * Get the name of the ethernet interface port.
+     */
+    public String getInterfaceName() {
+        return mInterfaceName;
+    }
+
+    /**
+     * Get the MAC address of the ethernet port.
+     */
+    public MacAddress getMacAddress() {
+        return mMacAddress;
+    }
+
+    /**
+     * Get the interface index of the ethernet port.
+     */
+    public int getInterfaceIndex() {
+        return mInterfaceIndex;
+    }
+
+    @Override
+    public String toString() {
+        return "Interface name: " + mInterfaceName + ", MAC address: " + mMacAddress
+                + ", Interface index: " + mInterfaceIndex;
+    }
+
+    @Override
+    public int hashCode() {
+        return Objects.hash(mMacAddress, mInterfaceName, mInterfaceIndex);
+    }
+
+    @Override
+    public boolean equals(@Nullable Object o) {
+        if (o == this) {
+            return true;
+        }
+
+        if (!(o instanceof EthernetPort)) {
+            return false;
+        }
+
+        final EthernetPort other = (EthernetPort) o;
+        return Objects.equals(this.mInterfaceName, other.mInterfaceName)
+                && Objects.equals(this.mMacAddress, other.mMacAddress)
+                && this.mInterfaceIndex == other.mInterfaceIndex;
+    }
+}
diff --git a/tests/unit/java/com/android/server/ethernet/EthernetPortTest.java b/tests/unit/java/com/android/server/ethernet/EthernetPortTest.java
new file mode 100644
index 0000000000..0aa133405f
--- /dev/null
+++ b/tests/unit/java/com/android/server/ethernet/EthernetPortTest.java
@@ -0,0 +1,121 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.server.ethernet;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotEquals;
+import static org.junit.Assert.assertThrows;
+
+import android.net.MacAddress;
+import android.os.Build;
+
+import androidx.test.filters.SmallTest;
+
+import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo;
+import com.android.testutils.DevSdkIgnoreRunner;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@SmallTest
+@RunWith(DevSdkIgnoreRunner.class)
+@IgnoreUpTo(Build.VERSION_CODES.S_V2)
+public class EthernetPortTest {
+    private final String mTestInterfaceName = "eth0";
+    private final MacAddress mTestMacAddress = MacAddress.fromString("0A:1B:2C:3D:4E:5F");
+    private final int mTestInterfaceIndex = 1;
+
+    @Test
+    public void testMakeEthernetPort() {
+        EthernetPort port = new EthernetPort(
+                mTestInterfaceName, mTestMacAddress, mTestInterfaceIndex);
+        assertEquals(mTestInterfaceName, port.getInterfaceName());
+        assertEquals(mTestMacAddress, port.getMacAddress());
+        assertEquals(mTestInterfaceIndex, port.getInterfaceIndex());
+    }
+
+    @Test
+    public void testMakeEthernetPortWithEmptyInterfaceName() {
+        assertThrows("Ethernet port should have valid interface name, MAC address and "
+                + "interface index.",
+                IllegalArgumentException.class,
+                () -> new EthernetPort("", mTestMacAddress, mTestInterfaceIndex));
+    }
+
+    @Test
+    public void testMakeEthernetPortWithNullInterfaceName() {
+        assertThrows("Ethernet port should have valid interface name, MAC address and "
+                + "interface index.",
+                IllegalArgumentException.class,
+                () -> new EthernetPort(null, mTestMacAddress, mTestInterfaceIndex));
+    }
+
+    @Test
+    public void testMakeEthernetPortWithNullMacAddress() {
+        assertThrows("Ethernet port should have valid interface name, MAC address and "
+                + "interface index.",
+                IllegalArgumentException.class,
+                () -> new EthernetPort(mTestInterfaceName, null, mTestInterfaceIndex));
+    }
+
+    @Test
+    public void testMakeEthernetPortWithInvalidInterfaceIndex() {
+        assertThrows("Ethernet port should have valid interface name, MAC address and "
+                + "interface index.",
+                IllegalArgumentException.class,
+                () -> new EthernetPort(mTestInterfaceName, mTestMacAddress, 0));
+    }
+
+    @Test
+    public void testHashCodeConsistency() {
+        EthernetPort port = new EthernetPort(
+                mTestInterfaceName, mTestMacAddress, mTestInterfaceIndex);
+        int hash1 = port.hashCode();
+        int hash2 = port.hashCode();
+        assertEquals(hash1, hash2);
+    }
+
+    @Test
+    public void testHashCodeOfDifferentConfig() {
+        EthernetPort port1 = new EthernetPort(
+                mTestInterfaceName, mTestMacAddress, mTestInterfaceIndex);
+        EthernetPort port2 = new EthernetPort(
+                "eth1", MacAddress.fromString("DE:AD:BE:EF:00:01"), 2);
+        int hash1 = port1.hashCode();
+        int hash2 = port2.hashCode();
+        assertNotEquals(hash1, hash2);
+    }
+
+    @Test
+    public void testHashCodeOfTheSameConfig() {
+        EthernetPort port1 = new EthernetPort(
+                mTestInterfaceName, mTestMacAddress, mTestInterfaceIndex);
+        EthernetPort port2 = new EthernetPort(
+                mTestInterfaceName, mTestMacAddress, mTestInterfaceIndex);
+        int hash1 = port1.hashCode();
+        int hash2 = port2.hashCode();
+        assertEquals(hash1, hash2);
+    }
+
+    @Test
+    public void testToString() {
+        EthernetPort port = new EthernetPort(
+                mTestInterfaceName, mTestMacAddress, mTestInterfaceIndex);
+        String expect = "Interface name: eth0, MAC address: 0a:1b:2c:3d:4e:5f, Interface index: 1";
+        assertEquals(expect, port.toString());
+    }
+}

From 2ea5939672ac2b48cd736bbe32c7b23234e4f16c Mon Sep 17 00:00:00 2001
From: Motomu Utsumi <motomuman@google.com>
Date: Fri, 25 Apr 2025 14:56:11 +0900
Subject: [PATCH 171/377] Enable QUIC connection close by default in
 ConnectivityService

This feature will be controlled by the caller.
Cronet calls the register/unregisterQuicConnectionClosePayload APIs only
when the Chromium experiment flag is enabled
(http://crrev.com/c/6421621/).

This CL also updates testRegisterQuicConnectionClosePayload
to be skipped on U or older releases since FIREWALL_CHAIN_BACKGROUND is
supported on V or higher releases.

Flag: EXEMPT guarded by chromium flag
Bug: 311792075
Test: TH
Change-Id: Ib008e63c585cfe8775b25783cd55b0873bb5e2f0
---
 service/src/com/android/server/ConnectivityService.java   | 5 ++++-
 .../net/src/android/net/cts/ConnectivityManagerTest.java  | 8 ++++++--
 .../java/com/android/server/ConnectivityServiceTest.java  | 2 +-
 3 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index dd1edfeecf..32df8237d2 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -2157,7 +2157,10 @@ public class ConnectivityService extends IConnectivityManager.Stub {
 
         mL2capNetworkProvider = mDeps.makeL2capNetworkProvider(mContext);
 
-        mCloseQuicConnection = mDeps.isFeatureEnabled(context, CLOSE_QUIC_CONNECTION);
+        // QUIC connection close is triggered by freezer (U+) or background firewall chain (V+).
+        // TODO: Allow other firewall chains to close QUIC connection and enable this flag on T+
+        mCloseQuicConnection = mDeps.isAtLeastU()
+                && mDeps.isFeatureNotChickenedOut(context, CLOSE_QUIC_CONNECTION);
         if (mCloseQuicConnection) {
             mQuicConnectionCloser = mDeps.makeQuicConnectionCloser(mNetworkForNetId, mHandler);
         } else {
diff --git a/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java b/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
index 3a3b256fc9..2ddaa50245 100644
--- a/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
+++ b/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
@@ -4358,8 +4358,11 @@ public class ConnectivityManagerTest {
         });
     }
 
+    // This test is skipped on U and older releases because QUIC connection close can be triggered
+    // by the freezer (U+) or the background firewall chain (V+), but the freezer cannot be tested.
+    // TODO: Enable this test on T+ once other firewall chains can trigger QUIC connection close.
     @Test
-    @IgnoreUpTo(Build.VERSION_CODES.R)
+    @IgnoreUpTo(Build.VERSION_CODES.UPSIDE_DOWN_CAKE)
     @ConnectivityModuleTest
     @AppModeFull(reason = "Cannot create test network in instant app mode")
     public void testRegisterQuicConnectionClosePayload_blockNetwork() throws Exception {
@@ -4384,8 +4387,9 @@ public class ConnectivityManagerTest {
                 true /* blockNetwork */, false /* expectPacketSent */);
     }
 
+    // TODO: Enable this test on T+ once other firewall chains can trigger QUIC connection close.
     @Test
-    @IgnoreUpTo(Build.VERSION_CODES.R)
+    @IgnoreUpTo(Build.VERSION_CODES.UPSIDE_DOWN_CAKE)
     @ConnectivityModuleTest
     @AppModeFull(reason = "Cannot create test network in instant app mode")
     public void testRegisterQuicConnectionClosePayload_closeSocket() throws Exception {
diff --git a/tests/unit/java/com/android/server/ConnectivityServiceTest.java b/tests/unit/java/com/android/server/ConnectivityServiceTest.java
index 63d014aad9..d3ff5d133c 100755
--- a/tests/unit/java/com/android/server/ConnectivityServiceTest.java
+++ b/tests/unit/java/com/android/server/ConnectivityServiceTest.java
@@ -2188,7 +2188,6 @@ public class ConnectivityServiceTest {
                 case ConnectivityFlags.USE_DECLARED_METHODS_FOR_CALLBACKS:
                 case ConnectivityFlags.QUEUE_CALLBACKS_FOR_FROZEN_APPS:
                 case ConnectivityFlags.BACKGROUND_FIREWALL_CHAIN:
-                case ConnectivityFlags.CLOSE_QUIC_CONNECTION:
                 case ConnectivityService.KEY_DESTROY_FROZEN_SOCKETS_VERSION:
                     return true;
                 default:
@@ -2209,6 +2208,7 @@ public class ConnectivityServiceTest {
                 case ConnectivityFlags.USE_DECLARED_METHODS_FOR_CALLBACKS:
                 case ConnectivityFlags.QUEUE_CALLBACKS_FOR_FROZEN_APPS:
                 case ConnectivityFlags.QUEUE_NETWORK_AGENT_EVENTS_IN_SYSTEM_SERVER:
+                case ConnectivityFlags.CLOSE_QUIC_CONNECTION:
                     return true;
                 default:
                     throw new UnsupportedOperationException("Unknown flag " + name

From f56926095e06a382d3a14182b5c02228d899d584 Mon Sep 17 00:00:00 2001
From: Motomu Utsumi <motomuman@google.com>
Date: Fri, 25 Apr 2025 15:15:45 +0900
Subject: [PATCH 172/377] Allow QuicConnectionCloser to close loopback QUIC
 connection

The test for closing QUIC connection feature runs QuicTestServer
on the device to ensure the server tears down the connection after the
registered payload is sent to the server.
It is difficult to verify this with public servers because there is no
way to verify server internal state.

Before this CL, QuicConnectionCloser only closed connection when the
network's linkproperties contained the source address of the QUIC
connection.
This was to avoid sending packets from unused addresses.
However, this made it difficult to verify the feature in tests because
QuicTestServer listens on loopback address.

This could be solved by using test networks.
However, this requires a good amount of work, including updating
QuicTestServer to read packets from a tun file descriptor instead of a
UDP socket, and updating Cronet to allow overriding hostname resolution
when the HttpEngine is bound to a network.

So, this CL allows QuicConnectionCloser to close loopback QUIC
connections.
The impact of this change should be negligible because running a QUIC
server on the device is uncommon. Also, even if the connection is
closed, Cronet reconnects to the server quickly.

Flag: EXEMPT guarded by chromium flag
Test: TH
Bug: 311792075
Change-Id: I579b3cd912c47f15498527d7dc49e4169b9fe75f
---
 .../android/server/connectivity/QuicConnectionCloser.java | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/service/src/com/android/server/connectivity/QuicConnectionCloser.java b/service/src/com/android/server/connectivity/QuicConnectionCloser.java
index c582d60f4f..c4fe5b8621 100644
--- a/service/src/com/android/server/connectivity/QuicConnectionCloser.java
+++ b/service/src/com/android/server/connectivity/QuicConnectionCloser.java
@@ -254,8 +254,14 @@ public class QuicConnectionCloser {
 
         Log.d(TAG, "Close QUIC socket for " + info + ", destroySocket=" + destroySocket);
         final NetworkAgentInfo nai = getNetworkAgentInfoForNetId(info.netId);
-        if (nai == null || !nai.linkProperties.getAddresses().contains(info.src.getAddress())) {
+        if (nai == null) return; // The network has gone away already
+
+        final boolean isLoopbackConnection = info.dst.getAddress().isLoopbackAddress();
+        final boolean lpContainsSourceAddress =
+                nai.linkProperties.getAddresses().contains(info.src.getAddress());
+        if (!isLoopbackConnection && !lpContainsSourceAddress) {
             // The device should not send a packet with an unused source address.
+            // Loopback connections are closed exceptionally to simplify device local testing.
             return;
         }
 

From 515efcf47df513731ae46d0ccfb340604acb53f9 Mon Sep 17 00:00:00 2001
From: Paul Hu <paulhu@google.com>
Date: Tue, 15 Apr 2025 09:54:50 +0000
Subject: [PATCH 173/377] Update link properties early for VPN networks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When LinkProperties are updated after a private DNS configuration
is set in updateNetworkInfo(), particularly when private DNS mode
is set to opportunistic and the VPN server uses its own DNS
servers, this can cause the private DNS to use the underlying
network for TLS handshaking, potentially leading to a leak.
To fix this, adjusting the order of operations—setting the private
DNS configuration before updating LinkProperties should resolve
the issue. This ensures that private DNS validation occurs after
the VPN's network configuration is fully applied.

Bug: 274867806
Test: atest ConnectivityCoverageTests
Flag: EXEMPT legacy flag early_link_properties_update_for_vpn
Change-Id: If684b51e6522a8284d5baee8db0d2f767405d359
---
 .../android/server/ConnectivityService.java   |  14 ++-
 .../connectivity/ConnectivityFlags.java       |   9 ++
 .../server/ConnectivityServiceTest.java       |   1 +
 .../connectivityservice/CSNetworkAgentTest.kt | 119 ++++++++++++++++++
 .../server/connectivityservice/base/CSTest.kt |   5 +-
 .../connectivityservice/base/CSTestHelpers.kt |   5 +-
 6 files changed, 148 insertions(+), 5 deletions(-)

diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index 529c51d6bd..cac31017a3 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -549,6 +549,8 @@ public class ConnectivityService extends IConnectivityManager.Stub
 
     // Flag to delay callbacks for frozen apps, suppressing duplicate and stale callbacks.
     private final boolean mQueueCallbacksForFrozenApps;
+    // Flag for early link properties update
+    private final boolean mSupportEarlyLinkPropertiesUpdateForVPN;
 
     /**
      * Uids ConnectivityService tracks blocked status of to send blocked status callbacks.
@@ -1973,6 +1975,8 @@ public class ConnectivityService extends IConnectivityManager.Stub
         mQueueNetworkAgentEventsInSystemServer = mDeps.isAtLeastB()
                 && mDeps.isFeatureNotChickenedOut(context,
                         ConnectivityFlags.QUEUE_NETWORK_AGENT_EVENTS_IN_SYSTEM_SERVER);
+        mSupportEarlyLinkPropertiesUpdateForVPN = mDeps.isFeatureNotChickenedOut(context,
+                ConnectivityFlags.EARLY_LINK_PROPERTIES_UPDATE_FOR_VPN);
         // registerUidFrozenStateChangedCallback is only available on U+
         mQueueCallbacksForFrozenApps = mDeps.isAtLeastU()
                 && mDeps.isFeatureNotChickenedOut(context, QUEUE_CALLBACKS_FOR_FROZEN_APPS);
@@ -5532,6 +5536,10 @@ public class ConnectivityService extends IConnectivityManager.Stub
                 && !caps.hasTransport(TRANSPORT_THREAD));
     }
 
+    private boolean shouldUpdateLinkPropertiesEarlyForVPNNetwork(@NonNull NetworkAgentInfo nai) {
+        return mSupportEarlyLinkPropertiesUpdateForVPN && nai.isVPN();
+    }
+
     private boolean shouldCreateNativeNetwork(@NonNull NetworkAgentInfo nai,
             @NonNull NetworkInfo.State state) {
         if (nai.isCreated()) return false;
@@ -12218,7 +12226,8 @@ public class ConnectivityService extends IConnectivityManager.Stub
             // interfaces and routing rules have been added, DNS servers programmed, etc.
             // For VPNs, this must be done before the capabilities are updated, because as soon as
             // that happens, UIDs are routed to the network.
-            if (shouldCreateNetworksImmediately(networkAgent.getCapsNoCopy())) {
+            if (shouldCreateNetworksImmediately(networkAgent.getCapsNoCopy())
+                    || shouldUpdateLinkPropertiesEarlyForVPNNetwork(networkAgent)) {
                 applyInitialLinkProperties(networkAgent);
             }
 
@@ -12243,7 +12252,8 @@ public class ConnectivityService extends IConnectivityManager.Stub
             networkAgent.getAndSetNetworkCapabilities(networkAgent.networkCapabilities);
 
             handlePerNetworkPrivateDnsConfig(networkAgent, mDnsManager.getPrivateDnsConfig());
-            if (!shouldCreateNetworksImmediately(networkAgent.getCapsNoCopy())) {
+            if (!(shouldCreateNetworksImmediately(networkAgent.getCapsNoCopy())
+                    || shouldUpdateLinkPropertiesEarlyForVPNNetwork(networkAgent))) {
                 applyInitialLinkProperties(networkAgent);
             } else {
                 // The network was created when the agent registered, and the LinkProperties are
diff --git a/service/src/com/android/server/connectivity/ConnectivityFlags.java b/service/src/com/android/server/connectivity/ConnectivityFlags.java
index 1655328816..06f3d63291 100644
--- a/service/src/com/android/server/connectivity/ConnectivityFlags.java
+++ b/service/src/com/android/server/connectivity/ConnectivityFlags.java
@@ -70,6 +70,15 @@ public final class ConnectivityFlags {
     public static final String CONSTRAINED_DATA_SATELLITE_OPTIN =
             "constrained_data_satellite_optin";
 
+    /**
+     * A feature flag to control whether the early link properties update for vpn should be enabled.
+     *
+     * Note: This feature is automatically enabled if the flag
+     *       QUEUE_NETWORK_AGENT_EVENTS_IN_SYSTEM_SERVER is enabled.
+     */
+    public static final String EARLY_LINK_PROPERTIES_UPDATE_FOR_VPN =
+            "early_link_properties_update_for_vpn";
+
     private boolean mNoRematchAllRequestsOnRegister;
 
     /**
diff --git a/tests/unit/java/com/android/server/ConnectivityServiceTest.java b/tests/unit/java/com/android/server/ConnectivityServiceTest.java
index ce04e94d7c..1a3a399024 100755
--- a/tests/unit/java/com/android/server/ConnectivityServiceTest.java
+++ b/tests/unit/java/com/android/server/ConnectivityServiceTest.java
@@ -2209,6 +2209,7 @@ public class ConnectivityServiceTest {
                 case ConnectivityFlags.QUEUE_CALLBACKS_FOR_FROZEN_APPS:
                 case ConnectivityFlags.QUEUE_NETWORK_AGENT_EVENTS_IN_SYSTEM_SERVER:
                 case ConnectivityFlags.CLOSE_QUIC_CONNECTION:
+                case ConnectivityFlags.EARLY_LINK_PROPERTIES_UPDATE_FOR_VPN:
                     return true;
                 default:
                     throw new UnsupportedOperationException("Unknown flag " + name
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSNetworkAgentTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSNetworkAgentTest.kt
index 547a4cccf2..c07d0e2bc2 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSNetworkAgentTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSNetworkAgentTest.kt
@@ -16,16 +16,27 @@
 
 package com.android.server
 
+import android.net.ConnectivitySettingsManager
+import android.net.InetAddresses
+import android.net.IpPrefix
+import android.net.LinkAddress
+import android.net.LinkProperties
 import android.net.NativeNetworkConfig
+import android.net.NetworkCapabilities.NET_CAPABILITY_INTERNET
 import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_VPN
+import android.net.NetworkCapabilities.NET_CAPABILITY_TRUSTED
 import android.net.NetworkCapabilities.TRANSPORT_VPN
 import android.net.NetworkCapabilities.TRANSPORT_WIFI
+import android.net.ResolverParamsParcel
+import android.net.RouteInfo
 import android.net.VpnManager
 import android.net.VpnTransportInfo
 import android.net.netd.aidl.NativeUidRangeConfig
 import android.os.Build
 import android.os.Process
 import android.util.Range
+import com.android.server.connectivity.ConnectivityFlags.EARLY_LINK_PROPERTIES_UPDATE_FOR_VPN
+import com.android.server.connectivity.ConnectivityFlags.QUEUE_NETWORK_AGENT_EVENTS_IN_SYSTEM_SERVER
 import com.android.testutils.ConnectivityModuleTest
 import com.android.testutils.DevSdkIgnoreRule
 import com.android.testutils.DevSdkIgnoreRunner
@@ -33,13 +44,20 @@ import org.junit.Test
 import org.junit.runner.RunWith
 import org.mockito.ArgumentMatchers.anyInt
 import org.mockito.ArgumentMatchers.argThat
+import org.mockito.ArgumentMatchers.eq
 import org.mockito.Mockito.inOrder
 import org.mockito.Mockito.never
+import org.mockito.Mockito.times
+
+private const val DNS_ADDR = "8.8.8.8"
+private const val IPV4_ADDR = "192.168.2.1"
+private const val ROUTE_PREFIX = "0.0.0.0/0"
 
 @DevSdkIgnoreRunner.MonitorThreadLeak
 @RunWith(DevSdkIgnoreRunner::class)
 @DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.S)
 class CSNetworkAgentTest : CSTest() {
+
     @Test fun testVpnUidAgent() = testUidAgent(
         TRANSPORT_VPN,
         expectAddUidRanges = true
@@ -89,4 +107,105 @@ class CSNetworkAgentTest : CSTest() {
         // The old method should never be called in any case
         netdInOrder.verify(netd, never()).networkAddUidRanges(anyInt(), any())
     }
+
+    // Test the early link properties update for the VPN network when the flag
+    // QUEUE_NETWORK_AGENT_EVENTS_IN_SYSTEM_SERVER is disabled. That flag is enabled by default in
+    // the CSTest.
+    @ConnectivityModuleTest
+    @FeatureFlags(flags = [Flag(QUEUE_NETWORK_AGENT_EVENTS_IN_SYSTEM_SERVER, false)])
+    @Test
+    fun testEarlyLinkPropertiesUpdateForVPN() =
+            testEarlyLinkPropertiesUpdate(TRANSPORT_VPN, expectEarlyLinkPropertiesUpdate = true)
+
+    // Test the early link properties update for the non-VPN network when the flag
+    // QUEUE_NETWORK_AGENT_EVENTS_IN_SYSTEM_SERVER is disabled. That flag is enabled by default in
+    // the CSTest.
+    @ConnectivityModuleTest
+    @FeatureFlags(flags = [Flag(QUEUE_NETWORK_AGENT_EVENTS_IN_SYSTEM_SERVER, false)])
+    @Test
+    fun testEarlyLinkPropertiesUpdateForNonVPN() =
+            testEarlyLinkPropertiesUpdate(TRANSPORT_WIFI, expectEarlyLinkPropertiesUpdate = false)
+
+    // Test the early link properties update for the VPN network when both flags
+    // QUEUE_NETWORK_AGENT_EVENTS_IN_SYSTEM_SERVER and EARLY_LINK_PROPERTIES_UPDATE_FOR_VPN are
+    // disabled. These flags are enabled by default in the CSTest.
+    @ConnectivityModuleTest
+    @FeatureFlags(
+        flags = [Flag(QUEUE_NETWORK_AGENT_EVENTS_IN_SYSTEM_SERVER, false),
+            Flag(EARLY_LINK_PROPERTIES_UPDATE_FOR_VPN, false)]
+    )
+    @Test
+    fun testEarlyLinkPropertiesUpdateDisabledForVPN() =
+            testEarlyLinkPropertiesUpdate(TRANSPORT_VPN, expectEarlyLinkPropertiesUpdate = false)
+
+    private fun testEarlyLinkPropertiesUpdate(
+            transport: Int,
+            expectEarlyLinkPropertiesUpdate: Boolean
+    ) {
+        val netdInOrder = inOrder(netd)
+        val resolverInOrder = inOrder(dnsResolver)
+
+        val nc = defaultNc()
+                .addTransportType(transport)
+                .addCapability(NET_CAPABILITY_TRUSTED)
+                .addCapability(NET_CAPABILITY_INTERNET)
+        if (TRANSPORT_VPN == transport) {
+            nc.removeCapability(NET_CAPABILITY_NOT_VPN)
+            nc.setTransportInfo(
+                    VpnTransportInfo(
+                            VpnManager.TYPE_VPN_SERVICE,
+                            "MySession12345",
+                            true /* bypassable */,
+                            false /* longLivedTcpConnectionsExpensive */
+                    )
+            )
+        }
+        val linkAddress = LinkAddress(InetAddresses.parseNumericAddress(IPV4_ADDR), 32)
+        val lp = LinkProperties().apply {
+            addLinkAddress(linkAddress)
+            addRoute(RouteInfo(IpPrefix(ROUTE_PREFIX), null, null))
+            addDnsServer(InetAddresses.parseNumericAddress(DNS_ADDR))
+        }
+        ConnectivitySettingsManager.setPrivateDnsMode(
+                context,
+                ConnectivitySettingsManager.PRIVATE_DNS_MODE_OPPORTUNISTIC
+        )
+        val agent = Agent(nc = nc, lp = lp)
+        agent.connect()
+
+        netdInOrder.verify(netd).networkCreate(argThat { it.netId == agent.network.netId })
+        netdInOrder.verify(netd).networkAddRouteParcel(
+                eq(agent.network.netId),
+                argThat { it.destination == ROUTE_PREFIX }
+        )
+        netdInOrder.verify(netd).networkAddRouteParcel(
+                eq(agent.network.netId),
+                argThat { it.destination == linkAddress.toString() }
+        )
+
+        if (expectEarlyLinkPropertiesUpdate) {
+            // Update the DNS without the TLS servers because the private DNS hasn't been set.
+            resolverInOrder.verify(dnsResolver).setResolverConfiguration(
+                    argThat { it: ResolverParamsParcel ->
+                        it.netId == agent.network.netId &&
+                        it.servers.any { server -> server == DNS_ADDR } &&
+                        it.tlsServers.isEmpty() }
+            )
+            // The private DNS has been set. Update the DNS again with the TLS servers.
+            resolverInOrder.verify(dnsResolver).setResolverConfiguration(
+                    argThat {
+                        it.netId == agent.network.netId &&
+                        it.servers.any { server -> server == DNS_ADDR } &&
+                        it.tlsServers.any { server -> server == DNS_ADDR }}
+            )
+        } else {
+            // Update the DNS with the TLS servers because the private DNS has been set.
+            resolverInOrder.verify(dnsResolver, times(2)).setResolverConfiguration(
+                    argThat {
+                        it.netId == agent.network.netId &&
+                        it.servers.any { server -> server == DNS_ADDR } &&
+                        it.tlsServers.any { server -> server == DNS_ADDR }}
+            )
+        }
+    }
 }
diff --git a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
index 3b8b27a57d..afa8d13ac1 100644
--- a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
@@ -28,6 +28,7 @@ import android.content.pm.PackageManager.PERMISSION_GRANTED
 import android.content.pm.UserInfo
 import android.content.res.Resources
 import android.net.ConnectivityManager
+import android.net.IDnsResolver
 import android.net.INetd
 import android.net.INetd.PERMISSION_INTERNET
 import android.net.InetAddresses
@@ -177,6 +178,7 @@ open class CSTest {
         it[ConnectivityFlags.QUEUE_CALLBACKS_FOR_FROZEN_APPS] = true
         it[ConnectivityFlags.QUEUE_NETWORK_AGENT_EVENTS_IN_SYSTEM_SERVER] = true
         it[ConnectivityFlags.CLOSE_QUIC_CONNECTION] = true
+        it[ConnectivityFlags.EARLY_LINK_PROPERTIES_UPDATE_FOR_VPN] = true
     }
     fun setFeatureEnabled(flag: String, enabled: Boolean) = enabledFeatures.set(flag, enabled)
 
@@ -227,6 +229,7 @@ open class CSTest {
     val satelliteAccessController = mock<SatelliteAccessController>()
     val quicConnectionCloser = mock<QuicConnectionCloser>()
     val destroySocketsWrapper = mock<DestroySocketsWrapper>()
+    val dnsResolver = mock<IDnsResolver>()
 
     val deps = CSDeps()
     val permDeps = PermDeps()
@@ -266,7 +269,7 @@ open class CSTest {
 
         alarmHandlerThread = HandlerThread("TestAlarmManager").also { it.start() }
         alarmManager = makeMockAlarmManager(alarmHandlerThread)
-        service = makeConnectivityService(context, netd, deps, permDeps).also {
+        service = makeConnectivityService(context, netd, deps, permDeps, dnsResolver).also {
             it.systemReadyInternal()
         }
         cm = ConnectivityManager(context, service)
diff --git a/tests/unit/java/com/android/server/connectivityservice/base/CSTestHelpers.kt b/tests/unit/java/com/android/server/connectivityservice/base/CSTestHelpers.kt
index 827d73771f..69ff193594 100644
--- a/tests/unit/java/com/android/server/connectivityservice/base/CSTestHelpers.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/base/CSTestHelpers.kt
@@ -223,11 +223,12 @@ internal fun makeConnectivityService(
         context: Context,
         netd: INetd,
         deps: Dependencies,
-        mPermDeps: PermissionMonitor.Dependencies
+        mPermDeps: PermissionMonitor.Dependencies,
+        resolver: IDnsResolver
 ) =
         ConnectivityService(
                 context,
-                mock<IDnsResolver>(),
+                resolver,
                 mock<IpConnectivityLog>(),
                 netd,
                 deps,

From 63dbd3ec938d78b532c620c8c8e57ef3c452e241 Mon Sep 17 00:00:00 2001
From: Junyu Lai <junyulai@google.com>
Date: Fri, 25 Apr 2025 17:40:52 +0800
Subject: [PATCH 174/377] Listen to onExternalApplicationsAvailable in
 SatelliteAccessController

For maintaining constrained data satellite opt-in apps, this is
needed for tracking apps installed on the storage.

Flag: EXEMPT flagged with a kill switch
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.connectivity.SatelliteAccessControllerTest \
  --update-device
Bug: 410731080
Change-Id: I2a686a5a37747de97dcee6b78f66965cb4fd9942
---
 .../android/server/ConnectivityService.java   |  3 ++
 .../SatelliteAccessController.java            | 51 ++++++++++++++++++-
 .../SatelliteAccessControllerTest.kt          | 26 ++++++++++
 3 files changed, 78 insertions(+), 2 deletions(-)

diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index 05ea6f962f..9560d66cc8 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -7796,6 +7796,9 @@ public class ConnectivityService extends IConnectivityManager.Stub
     @Override
     public void onExternalApplicationsAvailable(@Nullable String[] pkgList) {
         mPermissionMonitor.onExternalApplicationsAvailable(pkgList);
+        if (mSatelliteAccessController != null) {
+            mSatelliteAccessController.onExternalApplicationsAvailable((pkgList));
+        }
     }
 
     private void handlePackageChanged(@NonNull final String packageName) {
diff --git a/service/src/com/android/server/connectivity/SatelliteAccessController.java b/service/src/com/android/server/connectivity/SatelliteAccessController.java
index 50edacf6f8..7616ed78bb 100644
--- a/service/src/com/android/server/connectivity/SatelliteAccessController.java
+++ b/service/src/com/android/server/connectivity/SatelliteAccessController.java
@@ -31,12 +31,14 @@ import android.content.pm.PackageManager;
 import android.os.Handler;
 import android.os.UserHandle;
 import android.text.TextUtils;
+import android.util.ArrayMap;
 import android.util.ArraySet;
 import android.util.Log;
 import android.util.SparseArray;
 
 import com.android.internal.annotations.VisibleForTesting;
 import com.android.internal.util.IndentingPrintWriter;
+import com.android.net.module.util.CollectionUtils;
 import com.android.net.module.util.DeviceConfigUtils;
 
 import java.util.List;
@@ -79,6 +81,8 @@ public class SatelliteAccessController {
     // accessed on the handler thread.
     private final Set<Integer> mSatelliteDataOptimizedUids = new ArraySet<>();
 
+    private final ArrayMap<UserHandle, PackageManager> mUserPackageManagers = new ArrayMap<>();
+
     /**
      *  Monitor {@link android.app.role.OnRoleHoldersChangedListener#onRoleHoldersChanged(String,
      *  UserHandle)},
@@ -272,6 +276,11 @@ public class SatelliteAccessController {
         // Obtain uids with role sms and satellite communication permission for the added user.
         onRoleSmsChanged(userHandle);
 
+        // Store PackageManager for user for later use.
+        final PackageManager pmForUser =
+                mContext.createContextAsUser(userHandle, 0 /* flag */).getPackageManager();
+        mUserPackageManagers.put(userHandle, pmForUser);
+
         if (!mSupportConstrainedDataSatelliteOptIn) return;
 
         final Set<Integer> satelliteDataOptimizedAppsForUser =
@@ -293,6 +302,7 @@ public class SatelliteAccessController {
         final boolean smsRoleUidsChanged =
                 updateSatelliteFallbackUidListOnUserRemoval(userHandle.getIdentifier());
         final boolean mDataOptimizedUidChanged;
+        mUserPackageManagers.remove(userHandle);
         if (mSupportConstrainedDataSatelliteOptIn) {
             mDataOptimizedUidChanged =
                     removeSatelliteDataOptimizedUidsForUser(userHandle.getIdentifier());
@@ -311,8 +321,43 @@ public class SatelliteAccessController {
      * @param uid The uid of the new package.
      */
     public void onPackageAdded(@NonNull final String packageName, final int uid) {
+        if (!mSupportConstrainedDataSatelliteOptIn) return;
+        if (addSatelliteDataOptimizedUid(packageName, uid)) {
+            reportSatelliteNetworkFallbackUids();
+        }
+    }
+
+    @CheckReturnValue
+    private boolean addSatelliteDataOptimizedUid(@NonNull final String packageName, final int uid) {
         if (mSupportConstrainedDataSatelliteOptIn && isSatelliteDataOptimizedApp(packageName)) {
             mSatelliteDataOptimizedUids.add(uid);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * Called when the availability of external applications changes.
+     *
+     * @param pkgList An array of package names that have become available.
+     */
+    public void onExternalApplicationsAvailable(String[] pkgList) {
+        if (!mSupportConstrainedDataSatelliteOptIn) return;
+        if (CollectionUtils.isEmpty(pkgList)) {
+            Log.e(TAG, "No available external application.");
+            return;
+        }
+
+        boolean added = false;
+        for (String app : pkgList) {
+            for (final PackageManager pm : mUserPackageManagers.values()) {
+                final int uid = getUidForPackage(pm, app);
+                if (uid != INVALID_UID && addSatelliteDataOptimizedUid(app, uid)) {
+                    added = true;
+                }
+            }
+        }
+        if (added) {
             reportSatelliteNetworkFallbackUids();
         }
     }
@@ -337,8 +382,10 @@ public class SatelliteAccessController {
         }
         // If the loop completes without returning, it means no other
         // satellite-optimized app shares the UID.
-        mSatelliteDataOptimizedUids.remove(uid);
-        reportSatelliteNetworkFallbackUids();
+        final boolean removed = mSatelliteDataOptimizedUids.remove(uid);
+        if (removed) {
+            reportSatelliteNetworkFallbackUids();
+        }
     }
 
     @NonNull
diff --git a/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt b/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt
index dc1aaca197..5df65eb06c 100644
--- a/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt
+++ b/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt
@@ -433,6 +433,7 @@ class SatelliteAccessControllerTest {
                 .onUserAddedWithInstalledPackageList(PRIMARY_USER_HANDLE, listOf(packageInfo1))
         mSatelliteAccessController.onPackageAdded(TEST_PACKAGE1, TEST_UID1)
         mSatelliteAccessController.onPackageRemoved(TEST_PACKAGE1, TEST_UID1)
+        mSatelliteAccessController.onExternalApplicationsAvailable(arrayOf(SMS_APP1, SMS_APP2))
         mSatelliteAccessController.onUserRemoved(PRIMARY_USER_HANDLE)
         verify(mCallback, never()).accept(any(), any())
     }
@@ -483,4 +484,29 @@ class SatelliteAccessControllerTest {
         mRoleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
         inOrder.verify(mCallback).accept(emptySet(), setOf(TEST_UID1, smsUid))
     }
+
+    @FeatureFlag(name = CONSTRAINED_DATA_SATELLITE_OPTIN)
+    @Test
+    fun test_onExternalApplicationsAvailable() {
+        // Mock the sms apps as general opt-in apps without setting sms-role.
+        mockIsSatelliteDataOptimizedApp(SMS_APP1, true)
+        mockIsSatelliteDataOptimizedApp(SMS_APP2, true)
+
+        val inOrder = inOrder(mCallback)
+        mSatelliteAccessController
+                .onUserAddedWithInstalledPackageList(PRIMARY_USER_HANDLE, emptyList<PackageInfo>())
+        mSatelliteAccessController
+                .onUserAddedWithInstalledPackageList(
+                        SECONDARY_USER_HANDLE,
+                    emptyList<PackageInfo>()
+                )
+        mSatelliteAccessController.onExternalApplicationsAvailable(arrayOf(SMS_APP1, SMS_APP2))
+        inOrder.verify(mCallback).accept(emptySet(), setOf(
+                SMS_APP_ID1.toUid(PRIMARY_USER),
+                SMS_APP_ID1.toUid(SECONDARY_USER),
+                SMS_APP_ID2.toUid(PRIMARY_USER),
+                SMS_APP_ID2.toUid(SECONDARY_USER)
+        ))
+        inOrder.verifyNoMoreInteractions()
+    }
 }

From e9524a5298030727c769235227fcb8ae10f5dd97 Mon Sep 17 00:00:00 2001
From: Sandro Montanari <sandrom@google.com>
Date: Tue, 29 Apr 2025 04:07:46 -0700
Subject: [PATCH 175/377] Migrate CT demo app to Android

Bug: 409238442
Test: m CertificateTransparencyDemoApp
Flag: NONE demo app for testing
Change-Id: I499989131a9ae8a37425caa420f6b9d4c415f7d0
---
 networksecurity/tests/test-apps/Android.bp    |  34 ++++
 .../tests/test-apps/AndroidManifest.xml       |  39 +++++
 .../test-apps/res/layout/activity_main.xml    |  58 +++++++
 .../tests/test-apps/res/values/strings.xml    |  19 +++
 .../res/xml/network_security_config.xml       |  21 +++
 .../src/com/android/ctdemo/MainActivity.java  | 148 ++++++++++++++++++
 6 files changed, 319 insertions(+)
 create mode 100644 networksecurity/tests/test-apps/Android.bp
 create mode 100644 networksecurity/tests/test-apps/AndroidManifest.xml
 create mode 100644 networksecurity/tests/test-apps/res/layout/activity_main.xml
 create mode 100644 networksecurity/tests/test-apps/res/values/strings.xml
 create mode 100644 networksecurity/tests/test-apps/res/xml/network_security_config.xml
 create mode 100644 networksecurity/tests/test-apps/src/com/android/ctdemo/MainActivity.java

diff --git a/networksecurity/tests/test-apps/Android.bp b/networksecurity/tests/test-apps/Android.bp
new file mode 100644
index 0000000000..2882ca74fb
--- /dev/null
+++ b/networksecurity/tests/test-apps/Android.bp
@@ -0,0 +1,34 @@
+// Copyright (C) 2025 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package {
+    default_team: "trendy_team_rubidium_sdk_runtime",
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+android_app {
+    name: "CertificateTransparencyDemoApp",
+
+    manifest: "AndroidManifest.xml",
+
+    resource_dirs: ["res"],
+    srcs: [
+        "src/**/*.java",
+    ],
+    static_libs: [
+        "androidx-constraintlayout_constraintlayout",
+    ],
+
+    sdk_version: "current",
+}
diff --git a/networksecurity/tests/test-apps/AndroidManifest.xml b/networksecurity/tests/test-apps/AndroidManifest.xml
new file mode 100644
index 0000000000..276eb0fa31
--- /dev/null
+++ b/networksecurity/tests/test-apps/AndroidManifest.xml
@@ -0,0 +1,39 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- /*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ -->
+<manifest
+    xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools"
+    package="com.android.ctdemo">
+    <uses-permission android:name="android.permission.INTERNET" />
+    <application
+        android:allowBackup="true"
+        android:label="@string/app_name"
+        android:networkSecurityConfig="@xml/network_security_config"
+        android:supportsRtl="true"
+        android:theme="@style/Theme.AppCompat.DayNight.NoActionBar"
+        tools:targetApi="34">
+        <profileable android:shell="true" />
+        <activity
+            android:name=".MainActivity"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+    </application>
+</manifest>
diff --git a/networksecurity/tests/test-apps/res/layout/activity_main.xml b/networksecurity/tests/test-apps/res/layout/activity_main.xml
new file mode 100644
index 0000000000..513af95b3a
--- /dev/null
+++ b/networksecurity/tests/test-apps/res/layout/activity_main.xml
@@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- /*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ -->
+<androidx.constraintlayout.widget.ConstraintLayout
+  xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:app="http://schemas.android.com/apk/res-auto"
+    xmlns:tools="http://schemas.android.com/tools"
+    android:id="@+id/main"
+    android:layout_width="match_parent"
+    android:layout_height="match_parent"
+    android:paddingLeft="16dp"
+    android:paddingRight="16dp"
+    android:paddingTop="32dp"
+    tools:context=".MainActivity">
+  <LinearLayout
+      android:layout_width="match_parent"
+      android:layout_height="match_parent"
+      android:paddingLeft="16dp"
+      android:paddingRight="16dp"
+      android:paddingTop="32dp"
+      android:orientation="vertical"
+      tools:layout_editor_absoluteX="1dp">
+    <Button
+        android:id="@+id/button_wikipedia"
+        android:layout_width="match_parent"
+        android:layout_height="wrap_content"
+        android:text="Connect to wikipedia.org" />
+    <Button
+        android:id="@+id/button_valid_badssl"
+        android:layout_width="match_parent"
+        android:layout_height="wrap_content"
+        android:text="Connect to sha256.badssl.com" />
+    <Button
+        android:id="@+id/button_no_sct_badssl"
+        android:layout_width="match_parent"
+        android:layout_height="wrap_content"
+        android:text="Connect to no-sct.badssl.com" />
+    <TextView
+        android:id="@+id/textView"
+        android:layout_width="match_parent"
+        android:layout_height="wrap_content"
+        android:paddingTop="10dp"
+        android:text="this is empty" />
+  </LinearLayout>
+</androidx.constraintlayout.widget.ConstraintLayout>
\ No newline at end of file
diff --git a/networksecurity/tests/test-apps/res/values/strings.xml b/networksecurity/tests/test-apps/res/values/strings.xml
new file mode 100644
index 0000000000..3c36a8529e
--- /dev/null
+++ b/networksecurity/tests/test-apps/res/values/strings.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- /*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ -->
+<resources>
+  <string name="app_name">CTDemo</string>
+</resources>
\ No newline at end of file
diff --git a/networksecurity/tests/test-apps/res/xml/network_security_config.xml b/networksecurity/tests/test-apps/res/xml/network_security_config.xml
new file mode 100644
index 0000000000..8cd2446fcb
--- /dev/null
+++ b/networksecurity/tests/test-apps/res/xml/network_security_config.xml
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- /*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ -->
+<network-security-config>
+  <base-config>
+    <certificateTransparency enabled="true" />
+  </base-config>
+</network-security-config>
\ No newline at end of file
diff --git a/networksecurity/tests/test-apps/src/com/android/ctdemo/MainActivity.java b/networksecurity/tests/test-apps/src/com/android/ctdemo/MainActivity.java
new file mode 100644
index 0000000000..56b56fa31d
--- /dev/null
+++ b/networksecurity/tests/test-apps/src/com/android/ctdemo/MainActivity.java
@@ -0,0 +1,148 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.android.ctdemo;
+
+import android.os.Bundle;
+import android.os.Handler;
+import android.os.Looper;
+import android.os.Trace;
+import android.view.View;
+import android.widget.Button;
+import android.widget.TextView;
+
+import androidx.appcompat.app.AppCompatActivity;
+
+import java.io.BufferedInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.net.HttpURLConnection;
+import java.net.MalformedURLException;
+import java.net.URL;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+
+public class MainActivity extends AppCompatActivity {
+
+    Handler handler;
+    int cookie;
+
+    private void connectTo(String urlString, TextView textView) {
+        int myCookie = cookie++;
+        URL url = null;
+        long startTime = System.nanoTime();
+        Trace.beginAsyncSection("connectTo", myCookie);
+        try {
+            url = new URL(urlString);
+        } catch (MalformedURLException e) {
+            Trace.endAsyncSection("connectTo", myCookie);
+            handler.post(
+                    new Runnable() {
+                        @Override
+                        public void run() {
+                            textView.setText(e.toString());
+                        }
+                    });
+            return;
+        }
+        HttpURLConnection urlConnection = null;
+        try {
+            urlConnection = (HttpURLConnection) url.openConnection();
+        } catch (IOException e) {
+            Trace.endAsyncSection("connectTo", myCookie);
+            long estimatedTime = (System.nanoTime() - startTime) / 1000;
+            handler.post(
+                    new Runnable() {
+                        @Override
+                        public void run() {
+                            textView.setText("Failure in " + estimatedTime + " us");
+                        }
+                    });
+            return;
+        }
+        try {
+            InputStream in = new BufferedInputStream(urlConnection.getInputStream());
+            in.read();
+        } catch (IOException e) {
+            Trace.endAsyncSection("connectTo", myCookie);
+            long estimatedTime = (System.nanoTime() - startTime) / 1000;
+            handler.post(
+                    new Runnable() {
+                        @Override
+                        public void run() {
+                            textView.setText("Failure in " + estimatedTime + " us");
+                        }
+                    });
+        }
+        Trace.endAsyncSection("connectTo", myCookie);
+        long estimatedTime = (System.nanoTime() - startTime) / 1000;
+        handler.post(
+                new Runnable() {
+                    @Override
+                    public void run() {
+                        textView.setText("Success in " + estimatedTime + " us");
+                    }
+                });
+        urlConnection.disconnect();
+    }
+
+    @Override
+    protected void onCreate(Bundle savedInstanceState) {
+        super.onCreate(savedInstanceState);
+        setContentView(R.layout.activity_main);
+        ExecutorService executor = Executors.newSingleThreadExecutor();
+        handler = new Handler(Looper.getMainLooper());
+        Button buttonWikipedia = (Button) findViewById(R.id.button_wikipedia);
+        Button buttonValid = (Button) findViewById(R.id.button_valid_badssl);
+        Button buttonNoSCT = (Button) findViewById(R.id.button_no_sct_badssl);
+        final TextView textView = (TextView) findViewById(R.id.textView);
+        buttonWikipedia.setOnClickListener(
+                new View.OnClickListener() {
+                    public void onClick(View v) {
+                        executor.execute(
+                                new Runnable() {
+                                    @Override
+                                    public void run() {
+                                        connectTo("https://www.android.com", textView);
+                                    }
+                                });
+                    }
+                });
+        buttonValid.setOnClickListener(
+                new View.OnClickListener() {
+                    public void onClick(View v) {
+                        executor.execute(
+                                new Runnable() {
+                                    @Override
+                                    public void run() {
+                                        connectTo("https://sha256.badssl.com/", textView);
+                                    }
+                                });
+                    }
+                });
+        buttonNoSCT.setOnClickListener(
+                new View.OnClickListener() {
+                    public void onClick(View v) {
+                        executor.execute(
+                                new Runnable() {
+                                    @Override
+                                    public void run() {
+                                        connectTo("https://no-sct.badssl.com/", textView);
+                                    }
+                                });
+                    }
+                });
+    }
+}

From d161f1dcf1a826265241a57cd33417b364abb434 Mon Sep 17 00:00:00 2001
From: Jacque Li <jacqueli@google.com>
Date: Tue, 29 Apr 2025 19:51:09 -0400
Subject: [PATCH 176/377] Add NET_CAPABILITY_NOT_RESTRICTED to test network in
 CtsNetUtils

Bug: 404377608
Flag: TEST_ONLY
Test: atest CtsNetTestCases
Change-Id: I594de55622d20d6fe178d121472d95b92c611ee4
---
 tests/cts/net/util/java/android/net/cts/util/CtsNetUtils.java | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/cts/net/util/java/android/net/cts/util/CtsNetUtils.java b/tests/cts/net/util/java/android/net/cts/util/CtsNetUtils.java
index e8ce959d00..680aa08731 100644
--- a/tests/cts/net/util/java/android/net/cts/util/CtsNetUtils.java
+++ b/tests/cts/net/util/java/android/net/cts/util/CtsNetUtils.java
@@ -172,6 +172,7 @@ public final class CtsNetUtils {
                 new NetworkRequest.Builder()
                         .clearCapabilities()
                         .addTransportType(TRANSPORT_TEST)
+                        .addCapability(NetworkCapabilities.NET_CAPABILITY_NOT_RESTRICTED)
                         .setNetworkSpecifier(ifname)
                         .build();
 

From 5408415ab12d0d6bdc9a4f544ee80e45035b8251 Mon Sep 17 00:00:00 2001
From: Quang Anh Luong <qal@google.com>
Date: Wed, 30 Apr 2025 12:16:30 +0900
Subject: [PATCH 177/377] Change tethering terrible error wtf log to info log

Terrible errors in Tethering.java aren't used to log actual errors, but
just to provide metrics on how often these expected codepaths occur. To
avoid spamming the android error logs or crashing eng devices, change
these to use info logs instead.

Flag: EXEMPT logging change only

Bug: 410470516
Test: atest TetheringTest
Change-Id: I4ec202231e79c32f727a7620a6cab08e850d1629
---
 .../networkstack/tethering/Tethering.java     | 21 +++++++++----------
 1 file changed, 10 insertions(+), 11 deletions(-)

diff --git a/Tethering/src/com/android/networkstack/tethering/Tethering.java b/Tethering/src/com/android/networkstack/tethering/Tethering.java
index 62e0ec7765..0b615e9ea4 100644
--- a/Tethering/src/com/android/networkstack/tethering/Tethering.java
+++ b/Tethering/src/com/android/networkstack/tethering/Tethering.java
@@ -156,7 +156,6 @@ import com.android.net.module.util.HandlerUtils;
 import com.android.net.module.util.NetdUtils;
 import com.android.net.module.util.RoutingCoordinatorManager;
 import com.android.net.module.util.SharedLog;
-import com.android.net.module.util.TerribleErrorLog;
 import com.android.networkstack.apishim.common.BluetoothPanShim;
 import com.android.networkstack.apishim.common.BluetoothPanShim.TetheredInterfaceCallbackShim;
 import com.android.networkstack.apishim.common.BluetoothPanShim.TetheredInterfaceRequestShim;
@@ -1144,25 +1143,25 @@ public class Tethering {
         int result = tetherInternal(request, iface);
         switch (type) {
             case TETHERING_WIFI:
-                TerribleErrorLog.logTerribleError(TetheringStatsLog::write,
-                        "Legacy tether API called on Wifi iface " + iface,
+                Log.i(TAG, "Legacy tether API called on Wifi iface " + iface);
+                TetheringStatsLog.write(
                         CORE_NETWORKING_TERRIBLE_ERROR_OCCURRED,
                         CORE_NETWORKING_TERRIBLE_ERROR_OCCURRED__ERROR_TYPE__TYPE_LEGACY_TETHER_WITH_TYPE_WIFI);
                 if (result == TETHER_ERROR_NO_ERROR) {
-                    TerribleErrorLog.logTerribleError(TetheringStatsLog::write,
-                            "Legacy tether API succeeded on Wifi iface " + iface,
+                    Log.i(TAG, "Legacy tether API succeeded on Wifi iface " + iface);
+                    TetheringStatsLog.write(
                             CORE_NETWORKING_TERRIBLE_ERROR_OCCURRED,
                             CORE_NETWORKING_TERRIBLE_ERROR_OCCURRED__ERROR_TYPE__TYPE_LEGACY_TETHER_WITH_TYPE_WIFI_SUCCESS);
                 }
                 break;
             case TETHERING_WIFI_P2P:
-                TerribleErrorLog.logTerribleError(TetheringStatsLog::write,
-                        "Legacy tether API called on Wifi P2P iface " + iface,
+                Log.i(TAG, "Legacy tether API called on Wifi P2P iface " + iface);
+                TetheringStatsLog.write(
                         CORE_NETWORKING_TERRIBLE_ERROR_OCCURRED,
                         CORE_NETWORKING_TERRIBLE_ERROR_OCCURRED__ERROR_TYPE__TYPE_LEGACY_TETHER_WITH_TYPE_WIFI_P2P);
                 if (result == TETHER_ERROR_NO_ERROR) {
-                    TerribleErrorLog.logTerribleError(TetheringStatsLog::write,
-                            "Legacy tether API succeeded on Wifi P2P iface " + iface,
+                    Log.i(TAG, "Legacy tether API succeeded on Wifi P2P iface " + iface);
+                    TetheringStatsLog.write(
                             CORE_NETWORKING_TERRIBLE_ERROR_OCCURRED,
                             CORE_NETWORKING_TERRIBLE_ERROR_OCCURRED__ERROR_TYPE__TYPE_LEGACY_TETHER_WITH_TYPE_WIFI_P2P_SUCCESS);
                 }
@@ -1209,8 +1208,8 @@ public class Tethering {
         // processed, this will be a no-op and it will not return an error.
         tetherState.ipServer.enable(request);
         if (request.getRequestType() == REQUEST_TYPE_PLACEHOLDER) {
-            TerribleErrorLog.logTerribleError(TetheringStatsLog::write,
-                    "Started tethering with placeholder request: " + request,
+            Log.i(TAG, "Started tethering with placeholder request: " + request);
+            TetheringStatsLog.write(
                     CORE_NETWORKING_TERRIBLE_ERROR_OCCURRED,
                     CORE_NETWORKING_TERRIBLE_ERROR_OCCURRED__ERROR_TYPE__TYPE_TETHER_WITH_PLACEHOLDER_REQUEST);
         }

From b0b5dcf96e610a48e813476462775017eb20737a Mon Sep 17 00:00:00 2001
From: Junyu Lai <junyulai@google.com>
Date: Tue, 29 Apr 2025 11:00:42 +0800
Subject: [PATCH 178/377] Improve naming for SatelliteAccessController

This is a no-op refactoring, which renames several methods and
variables to more accurately reflect their functionality and
follow the naming style.

Flag: EXEMPT flagged with a kill switch
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.connectivity.SatelliteAccessControllerTest \
--update-device
Bug: 410731080

Change-Id: I84b9eca60f2b8543b8bdb7cf972103b79105e670
---
 .../SatelliteAccessController.java            | 114 ++++---
 .../SatelliteAccessControllerTest.kt          | 280 +++++++++---------
 2 files changed, 193 insertions(+), 201 deletions(-)

diff --git a/service/src/com/android/server/connectivity/SatelliteAccessController.java b/service/src/com/android/server/connectivity/SatelliteAccessController.java
index 7616ed78bb..5634984233 100644
--- a/service/src/com/android/server/connectivity/SatelliteAccessController.java
+++ b/service/src/com/android/server/connectivity/SatelliteAccessController.java
@@ -72,14 +72,13 @@ public class SatelliteAccessController {
 
     // At this sparseArray, Key is userId and values are uids of SMS apps that are allowed
     // to use satellite network as fallback.
-    private final SparseArray<Set<Integer>> mAllUsersSatelliteNetworkFallbackUidCache =
-            new SparseArray<>();
+    private final SparseArray<Set<Integer>> mSatelliteRoleSmsUids = new SparseArray<>();
 
     // Set of UIDs that have declared the
     // {@code android.telephony.PROPERTY_SATELLITE_DATA_OPTIMIZED} property
     // with a value of package name in their manifest file. This variable will only be
     // accessed on the handler thread.
-    private final Set<Integer> mSatelliteDataOptimizedUids = new ArraySet<>();
+    private final Set<Integer> mSatelliteDataOptInUids = new ArraySet<>();
 
     private final ArrayMap<UserHandle, PackageManager> mUserPackageManagers = new ArrayMap<>();
 
@@ -94,7 +93,7 @@ public class SatelliteAccessController {
         public void onRoleHoldersChanged(String role, UserHandle userHandle) {
             if (RoleManager.ROLE_SMS.equals(role)) {
                 Log.i(TAG, "ROLE_SMS Change detected ");
-                onRoleSmsChanged(userHandle);
+                updateSatelliteRoleSmsUids(userHandle);
             }
         }
 
@@ -152,32 +151,30 @@ public class SatelliteAccessController {
         mSupportConstrainedDataSatelliteOptIn = mDeps.supportConstrainedDataSatelliteOptIn(c);
     }
 
-    // TODO: Rename to updateSatelliteSmsRoleUidListCache since Opt-In apps are also
-    //  fallback uids.
-    private Set<Integer> updateSatelliteNetworkFallbackUidListCache(List<String> packageNames,
+    @NonNull
+    private Set<Integer> getRoleSmsUidsWithSatellitePermission(List<String> packageNames,
             @NonNull UserHandle userHandle) {
-        Set<Integer> fallbackUids = new ArraySet<>();
-        PackageManager pm =
-                mContext.createContextAsUser(userHandle, 0).getPackageManager();
+        final Set<Integer> roleSmsUids = new ArraySet<>();
+        final PackageManager pm = mContext.createContextAsUser(userHandle, 0).getPackageManager();
         if (pm != null) {
             for (String packageName : packageNames) {
                 // Check if SATELLITE_COMMUNICATION permission is enabled for default sms
-                // application package before adding it part of satellite network fallback uid
+                // application package before adding it part of satellite network role-sms uid
                 // cache list.
                 if (isSatellitePermissionEnabled(pm, packageName)) {
                     int uid = getUidForPackage(pm, packageName);
                     if (uid != INVALID_UID) {
-                        fallbackUids.add(uid);
+                        roleSmsUids.add(uid);
                     }
                 }
             }
         } else {
             Log.wtf(TAG, "package manager found null");
         }
-        return fallbackUids;
+        return roleSmsUids;
     }
 
-    //Check if satellite communication is enabled for the package
+    // Check if satellite communication is enabled for the package
     private boolean isSatellitePermissionEnabled(PackageManager packageManager,
             String packageName) {
         return packageManager.checkPermission(
@@ -198,8 +195,7 @@ public class SatelliteAccessController {
         return INVALID_UID;
     }
 
-    // on Role sms change triggered by OnRoleHoldersChangedListener()
-    private void onRoleSmsChanged(@NonNull UserHandle userHandle) {
+    private void updateSatelliteRoleSmsUids(@NonNull UserHandle userHandle) {
         int userId = userHandle.getIdentifier();
         if (userId == INVALID_UID) {
             Log.wtf(TAG, "Invalid User Id");
@@ -210,22 +206,18 @@ public class SatelliteAccessController {
         final List<String> packageNames =
                 mDeps.getRoleHoldersAsUser(RoleManager.ROLE_SMS, userHandle);
 
-        // Store previous satellite fallback uid available
-        final Set<Integer> prevUidsForUser =
-                mAllUsersSatelliteNetworkFallbackUidCache.get(userId, new ArraySet<>());
-
-        Log.i(TAG, "currentUser : role_sms_packages: " + userId + " : " + packageNames);
+        // Store previous satellite role sms uid available
+        final Set<Integer> prevUidsForUser = mSatelliteRoleSmsUids.get(userId, new ArraySet<>());
         final Set<Integer> newUidsForUser =
-                updateSatelliteNetworkFallbackUidListCache(packageNames, userHandle);
-        Log.i(TAG, "satellite_fallback_uid: " + newUidsForUser);
+                getRoleSmsUidsWithSatellitePermission(packageNames, userHandle);
 
         // on Role change, update the multilayer request at ConnectivityService with updated
-        // satellite network fallback uid cache list of multiple users as applicable
+        // satellite network role-sms uid cache list of multiple users as applicable
         if (newUidsForUser.equals(prevUidsForUser)) {
             return;
         }
 
-        mAllUsersSatelliteNetworkFallbackUidCache.put(userId, newUidsForUser);
+        mSatelliteRoleSmsUids.put(userId, newUidsForUser);
 
         // Update all users fallback cache for user, send cs fallback to update ML request
         reportSatelliteNetworkFallbackUids();
@@ -233,18 +225,19 @@ public class SatelliteAccessController {
 
     private void reportSatelliteNetworkFallbackUids() {
         // Merge all uids of multiple users available
-        Set<Integer> mergedSatelliteNetworkFallbackUidCache = new ArraySet<>();
-        for (int i = 0; i < mAllUsersSatelliteNetworkFallbackUidCache.size(); i++) {
-            mergedSatelliteNetworkFallbackUidCache.addAll(
-                    mAllUsersSatelliteNetworkFallbackUidCache.valueAt(i));
+        final Set<Integer> mergedSatelliteRoleSmsUids = new ArraySet<>();
+        for (int i = 0; i < mSatelliteRoleSmsUids.size(); i++) {
+            mergedSatelliteRoleSmsUids.addAll(mSatelliteRoleSmsUids.valueAt(i));
         }
-        Log.i(TAG, "SmsRoleUids: " + mergedSatelliteNetworkFallbackUidCache
-                + " Opt-InUids:" + mSatelliteDataOptimizedUids);
+        Log.i(TAG, "SmsRoleUids: " + mergedSatelliteRoleSmsUids
+                + " Opt-InUids:" + mSatelliteDataOptInUids);
 
         // trigger multiple layer request for satellite network fallback of multi user uids
-        final ArraySet<Integer> optimizedApps = new ArraySet(mSatelliteDataOptimizedUids);
-        optimizedApps.removeAll(mergedSatelliteNetworkFallbackUidCache);
-        mCallback.accept(mergedSatelliteNetworkFallbackUidCache, optimizedApps);
+        final ArraySet<Integer> optInUids = new ArraySet(mSatelliteDataOptInUids);
+        // If the same UID is in both sets, keep it only in the first one, which grant
+        // stronger privilege to access the satellite network.
+        optInUids.removeAll(mergedSatelliteRoleSmsUids);
+        mCallback.accept(mergedSatelliteRoleSmsUids, optInUids);
     }
 
     public void start() {
@@ -253,10 +246,10 @@ public class SatelliteAccessController {
     }
 
     @CheckReturnValue
-    private boolean updateSatelliteFallbackUidListOnUserRemoval(int userIdRemoved) {
+    private boolean updateSatelliteRoleSmsUidListOnUserRemoval(int userIdRemoved) {
         Log.i(TAG, "user id removed:" + userIdRemoved);
-        if (mAllUsersSatelliteNetworkFallbackUidCache.contains(userIdRemoved)) {
-            mAllUsersSatelliteNetworkFallbackUidCache.remove(userIdRemoved);
+        if (mSatelliteRoleSmsUids.contains(userIdRemoved)) {
+            mSatelliteRoleSmsUids.remove(userIdRemoved);
             return true; // Changed.
         }
         return false; // Unchanged.
@@ -274,7 +267,7 @@ public class SatelliteAccessController {
     public void onUserAddedWithInstalledPackageList(@NonNull UserHandle userHandle,
             @NonNull List<PackageInfo> apps) {
         // Obtain uids with role sms and satellite communication permission for the added user.
-        onRoleSmsChanged(userHandle);
+        updateSatelliteRoleSmsUids(userHandle);
 
         // Store PackageManager for user for later use.
         final PackageManager pmForUser =
@@ -283,12 +276,11 @@ public class SatelliteAccessController {
 
         if (!mSupportConstrainedDataSatelliteOptIn) return;
 
-        final Set<Integer> satelliteDataOptimizedAppsForUser =
-                getSatelliteDataOptimizedAppsForUser(apps);
-        Log.i(TAG, "Add SatelliteDataOptimizedApps + for user " + userHandle + ": "
-                + satelliteDataOptimizedAppsForUser);
-        if (satelliteDataOptimizedAppsForUser.size() > 0) {
-            mSatelliteDataOptimizedUids.addAll(satelliteDataOptimizedAppsForUser);
+        final Set<Integer> satelliteDataOptInUidsForUser = getSatelliteDataOptInUidsForUser(apps);
+        Log.i(TAG, "Add SatelliteDataOptInUids for user " + userHandle + ": "
+                + satelliteDataOptInUidsForUser);
+        if (satelliteDataOptInUidsForUser.size() > 0) {
+            mSatelliteDataOptInUids.addAll(satelliteDataOptInUidsForUser);
             reportSatelliteNetworkFallbackUids();
         }
     }
@@ -300,16 +292,16 @@ public class SatelliteAccessController {
      */
     public void onUserRemoved(@NonNull UserHandle userHandle) {
         final boolean smsRoleUidsChanged =
-                updateSatelliteFallbackUidListOnUserRemoval(userHandle.getIdentifier());
-        final boolean mDataOptimizedUidChanged;
+                updateSatelliteRoleSmsUidListOnUserRemoval(userHandle.getIdentifier());
+        final boolean satelliteOptInUidsChanged;
         mUserPackageManagers.remove(userHandle);
         if (mSupportConstrainedDataSatelliteOptIn) {
-            mDataOptimizedUidChanged =
-                    removeSatelliteDataOptimizedUidsForUser(userHandle.getIdentifier());
+            satelliteOptInUidsChanged =
+                    removeSatelliteDataOptInUidsForUser(userHandle.getIdentifier());
         } else {
-            mDataOptimizedUidChanged = false;
+            satelliteOptInUidsChanged = false;
         }
-        if (smsRoleUidsChanged || mDataOptimizedUidChanged) {
+        if (smsRoleUidsChanged || satelliteOptInUidsChanged) {
             reportSatelliteNetworkFallbackUids();
         }
     }
@@ -322,15 +314,15 @@ public class SatelliteAccessController {
      */
     public void onPackageAdded(@NonNull final String packageName, final int uid) {
         if (!mSupportConstrainedDataSatelliteOptIn) return;
-        if (addSatelliteDataOptimizedUid(packageName, uid)) {
+        if (addSatelliteDataOptInUid(packageName, uid)) {
             reportSatelliteNetworkFallbackUids();
         }
     }
 
     @CheckReturnValue
-    private boolean addSatelliteDataOptimizedUid(@NonNull final String packageName, final int uid) {
+    private boolean addSatelliteDataOptInUid(@NonNull final String packageName, final int uid) {
         if (mSupportConstrainedDataSatelliteOptIn && isSatelliteDataOptimizedApp(packageName)) {
-            mSatelliteDataOptimizedUids.add(uid);
+            mSatelliteDataOptInUids.add(uid);
             return true;
         }
         return false;
@@ -352,7 +344,7 @@ public class SatelliteAccessController {
         for (String app : pkgList) {
             for (final PackageManager pm : mUserPackageManagers.values()) {
                 final int uid = getUidForPackage(pm, app);
-                if (uid != INVALID_UID && addSatelliteDataOptimizedUid(app, uid)) {
+                if (uid != INVALID_UID && addSatelliteDataOptInUid(app, uid)) {
                     added = true;
                 }
             }
@@ -382,14 +374,14 @@ public class SatelliteAccessController {
         }
         // If the loop completes without returning, it means no other
         // satellite-optimized app shares the UID.
-        final boolean removed = mSatelliteDataOptimizedUids.remove(uid);
+        final boolean removed = mSatelliteDataOptInUids.remove(uid);
         if (removed) {
             reportSatelliteNetworkFallbackUids();
         }
     }
 
     @NonNull
-    private Set<Integer> getSatelliteDataOptimizedAppsForUser(@NonNull List<PackageInfo> apps) {
+    private Set<Integer> getSatelliteDataOptInUidsForUser(@NonNull List<PackageInfo> apps) {
         final ArraySet<Integer> uids = new ArraySet<>();
         for (PackageInfo app : apps) {
             if (null == app.applicationInfo || app.applicationInfo.uid < 0) continue;
@@ -410,19 +402,19 @@ public class SatelliteAccessController {
 
     // Return true if changed.
     @CheckReturnValue
-    private boolean removeSatelliteDataOptimizedUidsForUser(int userIdToRemove) {
-        return mSatelliteDataOptimizedUids.removeIf(uid -> uid / PER_USER_RANGE == userIdToRemove);
+    private boolean removeSatelliteDataOptInUidsForUser(int userIdToRemove) {
+        return mSatelliteDataOptInUids.removeIf(uid -> uid / PER_USER_RANGE == userIdToRemove);
     }
 
     /** Dump info to dumpsys */
     public void dump(@NonNull IndentingPrintWriter pw) {
         pw.println("SatelliteAccessController:");
         pw.increaseIndent();
-        pw.print("Sms-Role Uids: ");
-        pw.print(mAllUsersSatelliteNetworkFallbackUidCache);
+        pw.print("Role-Sms Uids: ");
+        pw.print(mSatelliteRoleSmsUids);
         pw.println();
         pw.print("Opt-In Uids: ");
-        pw.print(mSatelliteDataOptimizedUids);
+        pw.print(mSatelliteDataOptInUids);
         pw.println();
         pw.decreaseIndent();
         pw.println();
diff --git a/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt b/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt
index 5df65eb06c..90cda29b9c 100644
--- a/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt
+++ b/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt
@@ -82,14 +82,14 @@ class SatelliteAccessControllerTest {
     private val primaryUserContext = mock(Context::class.java)
     private val secondaryUserContext = mock(Context::class.java)
     private val packageManager = mock(PackageManager::class.java)
-    private val mPackageManagerPrimaryUser = mock(PackageManager::class.java)
-    private val mPackageManagerSecondaryUser = mock(PackageManager::class.java)
-    private val mDeps = mock(SatelliteAccessController.Dependencies::class.java)
-    private val mCallback = mock(BiConsumer::class.java) as BiConsumer<Set<Int>, Set<Int>>
+    private val packageManagerPrimaryUser = mock(PackageManager::class.java)
+    private val packageManagerSecondaryUser = mock(PackageManager::class.java)
+    private val deps = mock(SatelliteAccessController.Dependencies::class.java)
+    private val callback = mock(BiConsumer::class.java) as BiConsumer<Set<Int>, Set<Int>>
     private val userManager = mock(UserManager::class.java)
-    private val mHandler = Handler(Looper.getMainLooper())
-    private lateinit var mSatelliteAccessController: SatelliteAccessController
-    private lateinit var mRoleHolderChangedListener: OnRoleHoldersChangedListener
+    private val handler = Handler(Looper.getMainLooper())
+    private lateinit var satelliteAccessController: SatelliteAccessController
+    private lateinit var roleHolderChangedListener: OnRoleHoldersChangedListener
 
     private val featureFlags = HashSet<String>()
 
@@ -117,21 +117,21 @@ class SatelliteAccessControllerTest {
         mockService(Context.USER_SERVICE, UserManager::class.java, userManager)
         doReturn(packageManager).`when`(context).packageManager
         doReturn(featureFlags.contains(CONSTRAINED_DATA_SATELLITE_OPTIN))
-                .`when`(mDeps).supportConstrainedDataSatelliteOptIn(any())
-        mSatelliteAccessController = SatelliteAccessController(context, mDeps, mCallback, mHandler)
+                .`when`(deps).supportConstrainedDataSatelliteOptIn(any())
+        satelliteAccessController = SatelliteAccessController(context, deps, callback, handler)
 
         doReturn(primaryUserContext).`when`(context).createContextAsUser(PRIMARY_USER_HANDLE, 0)
-        doReturn(mPackageManagerPrimaryUser).`when`(primaryUserContext).packageManager
+        doReturn(packageManagerPrimaryUser).`when`(primaryUserContext).packageManager
 
         doReturn(secondaryUserContext).`when`(context).createContextAsUser(SECONDARY_USER_HANDLE, 0)
-        doReturn(mPackageManagerSecondaryUser).`when`(secondaryUserContext).packageManager
+        doReturn(packageManagerSecondaryUser).`when`(secondaryUserContext).packageManager
 
         for (app in listOf(SMS_APP1, SMS_APP2)) {
             doReturn(PackageManager.PERMISSION_GRANTED)
-                .`when`(mPackageManagerPrimaryUser)
+                .`when`(packageManagerPrimaryUser)
                 .checkPermission(Manifest.permission.SATELLITE_COMMUNICATION, app)
             doReturn(PackageManager.PERMISSION_GRANTED)
-                .`when`(mPackageManagerSecondaryUser)
+                .`when`(packageManagerSecondaryUser)
                 .checkPermission(Manifest.permission.SATELLITE_COMMUNICATION, app)
         }
 
@@ -142,168 +142,168 @@ class SatelliteAccessControllerTest {
             val primaryUid = appId.toUid(PRIMARY_USER)
             val primaryAppInfo = ApplicationInfo().apply { uid = primaryUid }
             doReturn(primaryAppInfo)
-                    .`when`(mPackageManagerPrimaryUser)
+                    .`when`(packageManagerPrimaryUser)
                     .getApplicationInfo(eq(appName), anyInt())
             val secondaryUid = appId.toUid(SECONDARY_USER)
             val secondaryAppInfo = ApplicationInfo().apply { uid = secondaryUid }
             doReturn(secondaryAppInfo)
-                    .`when`(mPackageManagerSecondaryUser)
+                    .`when`(packageManagerSecondaryUser)
                     .getApplicationInfo(eq(appName), anyInt())
         }
     }
 
     @Test
-    fun test_onRoleHoldersChanged_SatelliteFallbackUid_Changed_SingleUser() {
+    fun testRoleHoldersChanged_satelliteRoleSmsUidChanged_singleUser() {
         startSatelliteAccessController()
-        doReturn(listOf<String>()).`when`(mDeps).getRoleHoldersAsUser(
+        doReturn(listOf<String>()).`when`(deps).getRoleHoldersAsUser(
             RoleManager.ROLE_SMS,
             PRIMARY_USER_HANDLE
         )
-        mRoleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
-        verify(mCallback, never()).accept(any(), any())
+        roleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        verify(callback, never()).accept(any(), any())
 
         // check DEFAULT_MESSAGING_APP1 is available as satellite network fallback uid
         doReturn(listOf(SMS_APP1))
-            .`when`(mDeps).getRoleHoldersAsUser(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
-        mRoleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
-        verify(mCallback).accept(setOf(SMS_APP_ID1.toUid(PRIMARY_USER)), emptySet())
+            .`when`(deps).getRoleHoldersAsUser(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        roleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        verify(callback).accept(setOf(SMS_APP_ID1.toUid(PRIMARY_USER)), emptySet())
 
         // check SMS_APP2 is available as satellite network Fallback uid
-        doReturn(listOf(SMS_APP2)).`when`(mDeps).getRoleHoldersAsUser(
+        doReturn(listOf(SMS_APP2)).`when`(deps).getRoleHoldersAsUser(
             RoleManager.ROLE_SMS,
             PRIMARY_USER_HANDLE
         )
-        mRoleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
-        verify(mCallback).accept(setOf(SMS_APP_ID2.toUid(PRIMARY_USER)), emptySet())
+        roleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        verify(callback).accept(setOf(SMS_APP_ID2.toUid(PRIMARY_USER)), emptySet())
 
         // check no uid is available as satellite network fallback uid
-        doReturn(listOf<String>()).`when`(mDeps).getRoleHoldersAsUser(
+        doReturn(listOf<String>()).`when`(deps).getRoleHoldersAsUser(
             RoleManager.ROLE_SMS,
             PRIMARY_USER_HANDLE
         )
-        mRoleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
-        verify(mCallback).accept(emptySet(), emptySet())
+        roleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        verify(callback).accept(emptySet(), emptySet())
     }
 
     @Test
-    fun test_onRoleHoldersChanged_NoSatelliteCommunicationPermission() {
+    fun testRoleHoldersChanged_noSatelliteCommunicationPermission() {
         startSatelliteAccessController()
-        doReturn(listOf<Any>()).`when`(mDeps).getRoleHoldersAsUser(
+        doReturn(listOf<Any>()).`when`(deps).getRoleHoldersAsUser(
             RoleManager.ROLE_SMS,
             PRIMARY_USER_HANDLE
         )
-        mRoleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
-        verify(mCallback, never()).accept(any(), any())
+        roleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        verify(callback, never()).accept(any(), any())
 
         // Check DEFAULT_MESSAGING_APP1 is not available as satellite network fallback uid
         // since satellite communication permission not available.
         doReturn(PackageManager.PERMISSION_DENIED)
-            .`when`(mPackageManagerPrimaryUser)
+            .`when`(packageManagerPrimaryUser)
             .checkPermission(Manifest.permission.SATELLITE_COMMUNICATION, SMS_APP1)
         doReturn(listOf(SMS_APP1))
-            .`when`(mDeps).getRoleHoldersAsUser(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
-        mRoleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
-        verify(mCallback, never()).accept(any(), any())
+            .`when`(deps).getRoleHoldersAsUser(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        roleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        verify(callback, never()).accept(any(), any())
     }
 
     @Test
-    fun test_onRoleHoldersChanged_RoleSms_NotAvailable() {
+    fun testRoleHoldersChanged_roleSms_notAvailable() {
         startSatelliteAccessController()
         doReturn(listOf(SMS_APP1))
-            .`when`(mDeps).getRoleHoldersAsUser(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
-        mRoleHolderChangedListener.onRoleHoldersChanged(
+            .`when`(deps).getRoleHoldersAsUser(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        roleHolderChangedListener.onRoleHoldersChanged(
             RoleManager.ROLE_BROWSER,
             PRIMARY_USER_HANDLE
         )
-        verify(mCallback, never()).accept(any(), any())
+        verify(callback, never()).accept(any(), any())
     }
 
     @Test
-    fun test_onRoleHoldersChanged_SatelliteNetworkFallbackUid_Changed_multiUser() {
+    fun testRoleHoldersChanged_satelliteRoleSmsUidChanged_multiUser() {
         startSatelliteAccessController()
-        doReturn(listOf<String>()).`when`(mDeps).getRoleHoldersAsUser(
+        doReturn(listOf<String>()).`when`(deps).getRoleHoldersAsUser(
             RoleManager.ROLE_SMS,
             PRIMARY_USER_HANDLE
         )
-        mRoleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
-        verify(mCallback, never()).accept(any(), any())
+        roleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        verify(callback, never()).accept(any(), any())
 
         // check SMS_APP1 is available as satellite network fallback uid at primary user
         doReturn(listOf(SMS_APP1))
-            .`when`(mDeps).getRoleHoldersAsUser(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
-        mRoleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
-        verify(mCallback).accept(setOf(SMS_APP_ID1.toUid(PRIMARY_USER)), emptySet())
+            .`when`(deps).getRoleHoldersAsUser(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        roleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        verify(callback).accept(setOf(SMS_APP_ID1.toUid(PRIMARY_USER)), emptySet())
 
         // check SMS_APP2 is available as satellite network fallback uid at primary user
-        doReturn(listOf(SMS_APP2)).`when`(mDeps).getRoleHoldersAsUser(
+        doReturn(listOf(SMS_APP2)).`when`(deps).getRoleHoldersAsUser(
             RoleManager.ROLE_SMS,
             PRIMARY_USER_HANDLE
         )
-        mRoleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
-        verify(mCallback).accept(setOf(SMS_APP_ID2.toUid(PRIMARY_USER)), emptySet())
+        roleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        verify(callback).accept(setOf(SMS_APP_ID2.toUid(PRIMARY_USER)), emptySet())
 
         // check SMS_APP1 is available as satellite network fallback uid at secondary user
-        doReturn(listOf(SMS_APP1)).`when`(mDeps).getRoleHoldersAsUser(
+        doReturn(listOf(SMS_APP1)).`when`(deps).getRoleHoldersAsUser(
             RoleManager.ROLE_SMS,
             SECONDARY_USER_HANDLE
         )
-        mRoleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, SECONDARY_USER_HANDLE)
-        verify(mCallback).accept(
+        roleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, SECONDARY_USER_HANDLE)
+        verify(callback).accept(
             setOf(SMS_APP_ID2.toUid(PRIMARY_USER), SMS_APP_ID1.toUid(SECONDARY_USER)),
             emptySet()
         )
 
         // check no uid is available as satellite network fallback uid at primary user
-        doReturn(listOf<String>()).`when`(mDeps).getRoleHoldersAsUser(
+        doReturn(listOf<String>()).`when`(deps).getRoleHoldersAsUser(
             RoleManager.ROLE_SMS,
             PRIMARY_USER_HANDLE
         )
-        mRoleHolderChangedListener.onRoleHoldersChanged(
+        roleHolderChangedListener.onRoleHoldersChanged(
             RoleManager.ROLE_SMS,
             PRIMARY_USER_HANDLE
         )
-        verify(mCallback).accept(setOf(SMS_APP_ID1.toUid(SECONDARY_USER)), emptySet())
+        verify(callback).accept(setOf(SMS_APP_ID1.toUid(SECONDARY_USER)), emptySet())
 
         // check SMS_APP2 is available as satellite network fallback uid at secondary user
         doReturn(listOf(SMS_APP2))
-            .`when`(mDeps).getRoleHoldersAsUser(RoleManager.ROLE_SMS, SECONDARY_USER_HANDLE)
-        mRoleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, SECONDARY_USER_HANDLE)
-        verify(mCallback).accept(setOf(SMS_APP_ID2.toUid(SECONDARY_USER)), emptySet())
+            .`when`(deps).getRoleHoldersAsUser(RoleManager.ROLE_SMS, SECONDARY_USER_HANDLE)
+        roleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, SECONDARY_USER_HANDLE)
+        verify(callback).accept(setOf(SMS_APP_ID2.toUid(SECONDARY_USER)), emptySet())
 
         // check no uid is available as satellite network fallback uid at secondary user
-        doReturn(listOf<String>()).`when`(mDeps).getRoleHoldersAsUser(
+        doReturn(listOf<String>()).`when`(deps).getRoleHoldersAsUser(
             RoleManager.ROLE_SMS,
             SECONDARY_USER_HANDLE
         )
-        mRoleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, SECONDARY_USER_HANDLE)
-        verify(mCallback).accept(emptySet(), emptySet())
+        roleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, SECONDARY_USER_HANDLE)
+        verify(callback).accept(emptySet(), emptySet())
     }
 
     @Test
-    fun test_SatelliteFallbackUidCallback_OnUserRemoval() {
+    fun testSatelliteFallbackUidCallback_onUserRemoval() {
         startSatelliteAccessController()
         // check SMS_APP2 is available as satellite network fallback uid at primary user
-        doReturn(listOf(SMS_APP2)).`when`(mDeps).getRoleHoldersAsUser(
+        doReturn(listOf(SMS_APP2)).`when`(deps).getRoleHoldersAsUser(
             RoleManager.ROLE_SMS,
             PRIMARY_USER_HANDLE
         )
-        mRoleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
-        verify(mCallback).accept(setOf(SMS_APP_ID2.toUid(PRIMARY_USER)), emptySet())
+        roleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        verify(callback).accept(setOf(SMS_APP_ID2.toUid(PRIMARY_USER)), emptySet())
 
         // check SMS_APP1 is available as satellite network fallback uid at secondary user
-        doReturn(listOf(SMS_APP1)).`when`(mDeps).getRoleHoldersAsUser(
+        doReturn(listOf(SMS_APP1)).`when`(deps).getRoleHoldersAsUser(
             RoleManager.ROLE_SMS,
             SECONDARY_USER_HANDLE
         )
-        mRoleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, SECONDARY_USER_HANDLE)
-        verify(mCallback).accept(
+        roleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, SECONDARY_USER_HANDLE)
+        verify(callback).accept(
             setOf(SMS_APP_ID2.toUid(PRIMARY_USER), SMS_APP_ID1.toUid(SECONDARY_USER)),
             emptySet()
         )
         processOnHandlerThread {
-            mSatelliteAccessController.onUserRemoved(SECONDARY_USER_HANDLE)
+            satelliteAccessController.onUserRemoved(SECONDARY_USER_HANDLE)
         }
-        verify(mCallback, times(2)).accept(
+        verify(callback, times(2)).accept(
             setOf(SMS_APP_ID2.toUid(PRIMARY_USER)),
             emptySet()
         )
@@ -311,20 +311,20 @@ class SatelliteAccessControllerTest {
 
     private fun <T : Any> processOnHandlerThread(function: () -> T): T {
         val future = CompletableFuture<T>()
-        mHandler.post { future.complete(function()) }
+        handler.post { future.complete(function()) }
         return future.get()
     }
 
     private fun startSatelliteAccessController() {
-        mSatelliteAccessController.start()
+        satelliteAccessController.start()
         // Get registered listener using captor
         val listenerCaptor = ArgumentCaptor.forClass(OnRoleHoldersChangedListener::class.java)
-        verify(mDeps).addOnRoleHoldersChangedListenerAsUser(
+        verify(deps).addOnRoleHoldersChangedListenerAsUser(
             any(Executor::class.java),
             listenerCaptor.capture(),
             any(UserHandle::class.java)
         )
-        mRoleHolderChangedListener = listenerCaptor.value
+        roleHolderChangedListener = listenerCaptor.value
     }
 
     private fun makePackageInfo(packageName: String, uid: Int) = PackageInfo().apply {
@@ -350,158 +350,158 @@ class SatelliteAccessControllerTest {
 
     @FeatureFlag(name = CONSTRAINED_DATA_SATELLITE_OPTIN)
     @Test
-    fun testSatelliteOptimizedUids_onPackageAdded() {
+    fun testSatelliteOptInUids_onPackageAdded() {
         mockIsSatelliteDataOptimizedApp(TEST_PACKAGE1, true)
-        mSatelliteAccessController.onPackageAdded(TEST_PACKAGE1, TEST_UID1)
-        verify(mCallback).accept(emptySet(), setOf(TEST_UID1))
+        satelliteAccessController.onPackageAdded(TEST_PACKAGE1, TEST_UID1)
+        verify(callback).accept(emptySet(), setOf(TEST_UID1))
     }
 
     @FeatureFlag(name = CONSTRAINED_DATA_SATELLITE_OPTIN)
     @Test
-    fun testSatelliteOptimizedUids_onPackageAdded_ignoresIfNotSatelliteOptimized() {
+    fun testSatelliteOptInUids_onPackageAdded_ignoresIfNotSatelliteOptimized() {
         mockIsSatelliteDataOptimizedApp(TEST_PACKAGE1, false)
-        mSatelliteAccessController.onPackageAdded(TEST_PACKAGE1, TEST_UID1)
-        verify(mCallback, never()).accept(any(), any())
+        satelliteAccessController.onPackageAdded(TEST_PACKAGE1, TEST_UID1)
+        verify(callback, never()).accept(any(), any())
     }
 
     @FeatureFlag(name = CONSTRAINED_DATA_SATELLITE_OPTIN)
     @Test
-    fun testSatelliteOptimizedUids_onPackageRemoved_noOtherShareUid() {
+    fun testSatelliteOptInUids_onPackageRemoved_noOtherShareUid() {
         mockIsSatelliteDataOptimizedApp(TEST_PACKAGE1, true)
         mockGetPackagesForUid(TEST_UID1, arrayOf(TEST_PACKAGE1))
 
-        mSatelliteAccessController.onPackageAdded(TEST_PACKAGE1, TEST_UID1)
-        verify(mCallback).accept(emptySet(), setOf(TEST_UID1))
-        mSatelliteAccessController.onPackageRemoved(TEST_PACKAGE1, TEST_UID1)
-        verify(mCallback).accept(emptySet(), emptySet())
+        satelliteAccessController.onPackageAdded(TEST_PACKAGE1, TEST_UID1)
+        verify(callback).accept(emptySet(), setOf(TEST_UID1))
+        satelliteAccessController.onPackageRemoved(TEST_PACKAGE1, TEST_UID1)
+        verify(callback).accept(emptySet(), emptySet())
     }
 
     @FeatureFlag(name = CONSTRAINED_DATA_SATELLITE_OPTIN)
     @Test
-    fun testSatelliteOptimizedUids_onPackageRemoved_otherShareUid() {
+    fun testSatelliteOptInUids_onPackageRemoved_otherShareUid() {
         mockIsSatelliteDataOptimizedApp(TEST_PACKAGE1, true)
         mockIsSatelliteDataOptimizedApp(TEST_PACKAGE2, true)
         mockGetPackagesForUid(TEST_UID1, arrayOf(TEST_PACKAGE1, TEST_PACKAGE2))
 
         // Verify uid is not removed if there is still another package shares the same uid.
-        val inOrder = inOrder(mCallback)
-        mSatelliteAccessController.onPackageAdded(TEST_PACKAGE1, TEST_UID1)
-        inOrder.verify(mCallback).accept(emptySet(), setOf(TEST_UID1))
-        mSatelliteAccessController.onPackageRemoved(TEST_PACKAGE1, TEST_UID1)
+        val inOrder = inOrder(callback)
+        satelliteAccessController.onPackageAdded(TEST_PACKAGE1, TEST_UID1)
+        inOrder.verify(callback).accept(emptySet(), setOf(TEST_UID1))
+        satelliteAccessController.onPackageRemoved(TEST_PACKAGE1, TEST_UID1)
         inOrder.verifyNoMoreInteractions()
 
         // Verify uid is removed if there is no other package with shared uid.
         mockGetPackagesForUid(TEST_UID1, null)
-        mSatelliteAccessController.onPackageRemoved(TEST_PACKAGE2, TEST_UID1)
-        inOrder.verify(mCallback).accept(emptySet(), emptySet())
+        satelliteAccessController.onPackageRemoved(TEST_PACKAGE2, TEST_UID1)
+        inOrder.verify(callback).accept(emptySet(), emptySet())
     }
 
     @FeatureFlag(name = CONSTRAINED_DATA_SATELLITE_OPTIN)
     @Test
-    fun testSatelliteOptimizedUids_onUserAddedRemoved() {
+    fun testSatelliteOptInUids_onUserAddedRemoved() {
         mockIsSatelliteDataOptimizedApp(TEST_PACKAGE1, true)
         mockIsSatelliteDataOptimizedApp(TEST_PACKAGE2, true)
         val packageInfo1 = makePackageInfo(TEST_PACKAGE1, TEST_UID1)
         val packageInfo2 = makePackageInfo(TEST_PACKAGE2, TEST_UID2)
 
-        val inOrder = inOrder(mCallback)
-        mSatelliteAccessController
+        val inOrder = inOrder(callback)
+        satelliteAccessController
                 .onUserAddedWithInstalledPackageList(PRIMARY_USER_HANDLE, listOf(packageInfo1))
-        mSatelliteAccessController
+        satelliteAccessController
                 .onUserAddedWithInstalledPackageList(SECONDARY_USER_HANDLE, listOf(packageInfo2))
-        inOrder.verify(mCallback).accept(emptySet(), setOf(TEST_UID1))
-        inOrder.verify(mCallback).accept(emptySet(), setOf(TEST_UID1, TEST_UID2))
+        inOrder.verify(callback).accept(emptySet(), setOf(TEST_UID1))
+        inOrder.verify(callback).accept(emptySet(), setOf(TEST_UID1, TEST_UID2))
 
-        mSatelliteAccessController.onUserRemoved(SECONDARY_USER_HANDLE)
+        satelliteAccessController.onUserRemoved(SECONDARY_USER_HANDLE)
         // Verify that the app associated with the non-removed user is not removed.
-        inOrder.verify(mCallback).accept(emptySet(), setOf(TEST_UID1))
+        inOrder.verify(callback).accept(emptySet(), setOf(TEST_UID1))
 
-        mSatelliteAccessController.onUserRemoved(PRIMARY_USER_HANDLE)
+        satelliteAccessController.onUserRemoved(PRIMARY_USER_HANDLE)
         // Verify everything is removed.
-        inOrder.verify(mCallback).accept(emptySet(), emptySet())
+        inOrder.verify(callback).accept(emptySet(), emptySet())
         inOrder.verifyNoMoreInteractions()
     }
 
     @FeatureFlag(name = CONSTRAINED_DATA_SATELLITE_OPTIN, enabled = false)
     @Test
-    fun testSatelliteOptimizedUids_featureDisabled() {
+    fun testSatelliteOptInUids_featureDisabled() {
         mockIsSatelliteDataOptimizedApp(TEST_PACKAGE1, true)
         val packageInfo1 = makePackageInfo(TEST_PACKAGE1, TEST_UID1)
 
         // Verify nothing changes and nothing crashes.
-        mSatelliteAccessController
+        satelliteAccessController
                 .onUserAddedWithInstalledPackageList(PRIMARY_USER_HANDLE, listOf(packageInfo1))
-        mSatelliteAccessController.onPackageAdded(TEST_PACKAGE1, TEST_UID1)
-        mSatelliteAccessController.onPackageRemoved(TEST_PACKAGE1, TEST_UID1)
-        mSatelliteAccessController.onExternalApplicationsAvailable(arrayOf(SMS_APP1, SMS_APP2))
-        mSatelliteAccessController.onUserRemoved(PRIMARY_USER_HANDLE)
-        verify(mCallback, never()).accept(any(), any())
+        satelliteAccessController.onPackageAdded(TEST_PACKAGE1, TEST_UID1)
+        satelliteAccessController.onPackageRemoved(TEST_PACKAGE1, TEST_UID1)
+        satelliteAccessController.onExternalApplicationsAvailable(arrayOf(SMS_APP1, SMS_APP2))
+        satelliteAccessController.onUserRemoved(PRIMARY_USER_HANDLE)
+        verify(callback, never()).accept(any(), any())
     }
 
     @FeatureFlag(name = CONSTRAINED_DATA_SATELLITE_OPTIN)
     @Test
-    fun testSatelliteOptimizedUids_withSmsRoleUids() {
+    fun testSatelliteOptInUids_withRoleSmsUids() {
         startSatelliteAccessController()
-        // Set SMS_APP1 under primary user as a sms-role Uid.
+        // Set SMS_APP1 under primary user as a role-sms Uid.
         doReturn(listOf(SMS_APP1))
-                .`when`(mDeps).getRoleHoldersAsUser(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
-        mRoleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
-        verify(mCallback).accept(setOf(SMS_APP_ID1.toUid(PRIMARY_USER)), emptySet())
+                .`when`(deps).getRoleHoldersAsUser(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        roleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        verify(callback).accept(setOf(SMS_APP_ID1.toUid(PRIMARY_USER)), emptySet())
 
         // Mock another opt-in uid, verify they both reported via the callback.
         mockIsSatelliteDataOptimizedApp(TEST_PACKAGE1, true)
-        mSatelliteAccessController.onPackageAdded(TEST_PACKAGE1, TEST_UID1)
-        verify(mCallback).accept(setOf(SMS_APP_ID1.toUid(PRIMARY_USER)), setOf(TEST_UID1))
+        satelliteAccessController.onPackageAdded(TEST_PACKAGE1, TEST_UID1)
+        verify(callback).accept(setOf(SMS_APP_ID1.toUid(PRIMARY_USER)), setOf(TEST_UID1))
     }
 
     @FeatureFlag(name = CONSTRAINED_DATA_SATELLITE_OPTIN)
     @Test
-    fun testSatelliteOptimizedUids_withSmsRoleUids_overlappedUid() {
+    fun testSatelliteOptInUids_withRoleSmsUids_overlappedUid() {
         startSatelliteAccessController()
         val smsUid = SMS_APP_ID1.toUid(PRIMARY_USER)
 
-        val inOrder = inOrder(mCallback)
+        val inOrder = inOrder(callback)
         // Mock opt-in uids, verify they both reported via the callback.
         // However, one opt-in uid is a messaging app and will surprise us later.
         mockIsSatelliteDataOptimizedApp(TEST_PACKAGE1, true)
         mockIsSatelliteDataOptimizedApp(SMS_APP1, true)
-        mSatelliteAccessController.onPackageAdded(TEST_PACKAGE1, TEST_UID1)
-        inOrder.verify(mCallback).accept(emptySet(), setOf(TEST_UID1))
-        mSatelliteAccessController.onPackageAdded(SMS_APP1, smsUid)
-        inOrder.verify(mCallback).accept(emptySet(), setOf(TEST_UID1, smsUid))
+        satelliteAccessController.onPackageAdded(TEST_PACKAGE1, TEST_UID1)
+        inOrder.verify(callback).accept(emptySet(), setOf(TEST_UID1))
+        satelliteAccessController.onPackageAdded(SMS_APP1, smsUid)
+        inOrder.verify(callback).accept(emptySet(), setOf(TEST_UID1, smsUid))
 
-        // Set SMS_APP1 as a sms-role Uid.
-        // Verify the sms-role Uid is excluded from the opt-in Uid list.
+        // Set SMS_APP1 as a role-sms Uid.
+        // Verify the role-sms Uid is excluded from the opt-in Uid list.
         doReturn(listOf(SMS_APP1))
-                .`when`(mDeps).getRoleHoldersAsUser(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
-        mRoleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
-        inOrder.verify(mCallback).accept(setOf(smsUid), setOf(TEST_UID1))
+                .`when`(deps).getRoleHoldersAsUser(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        roleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        inOrder.verify(callback).accept(setOf(smsUid), setOf(TEST_UID1))
 
-        // Unset SMS_APP1 as the sms-role Uid.
-        // Verify the sms-role Uid is included to the opt-in Uid list again.
+        // Unset SMS_APP1 as the role-sms Uid.
+        // Verify the role-sms Uid is included to the opt-in Uid list again.
         doReturn(emptyList<String>())
-                .`when`(mDeps).getRoleHoldersAsUser(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
-        mRoleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
-        inOrder.verify(mCallback).accept(emptySet(), setOf(TEST_UID1, smsUid))
+                .`when`(deps).getRoleHoldersAsUser(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        roleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        inOrder.verify(callback).accept(emptySet(), setOf(TEST_UID1, smsUid))
     }
 
     @FeatureFlag(name = CONSTRAINED_DATA_SATELLITE_OPTIN)
     @Test
-    fun test_onExternalApplicationsAvailable() {
-        // Mock the sms apps as general opt-in apps without setting sms-role.
+    fun testSatelliteOptInUids_onExternalApplicationsAvailable() {
+        // Mock the sms apps as general opt-in apps without setting role-sms.
         mockIsSatelliteDataOptimizedApp(SMS_APP1, true)
         mockIsSatelliteDataOptimizedApp(SMS_APP2, true)
 
-        val inOrder = inOrder(mCallback)
-        mSatelliteAccessController
+        val inOrder = inOrder(callback)
+        satelliteAccessController
                 .onUserAddedWithInstalledPackageList(PRIMARY_USER_HANDLE, emptyList<PackageInfo>())
-        mSatelliteAccessController
+        satelliteAccessController
                 .onUserAddedWithInstalledPackageList(
                         SECONDARY_USER_HANDLE,
                     emptyList<PackageInfo>()
                 )
-        mSatelliteAccessController.onExternalApplicationsAvailable(arrayOf(SMS_APP1, SMS_APP2))
-        inOrder.verify(mCallback).accept(emptySet(), setOf(
+        satelliteAccessController.onExternalApplicationsAvailable(arrayOf(SMS_APP1, SMS_APP2))
+        inOrder.verify(callback).accept(emptySet(), setOf(
                 SMS_APP_ID1.toUid(PRIMARY_USER),
                 SMS_APP_ID1.toUid(SECONDARY_USER),
                 SMS_APP_ID2.toUid(PRIMARY_USER),

From d3bae6f3cc453bb7fb0d24693c633aeb642a15ef Mon Sep 17 00:00:00 2001
From: Yuyang Huang <yuyanghuang@google.com>
Date: Tue, 29 Apr 2025 23:35:36 +0900
Subject: [PATCH 179/377] Add @UnsupportedAppUsage to
 NsdManager.registerService for MediaShell

The NsdManager.registerService() method was originally scheduled to
become a public API in the 25Q2 release. However, this transition did
not occur as planned. The current target for making this method a public
API is the 25Q4 release. In the interim, the @UnsupportedAppUsage
annotation is being added. This is necessary to support an internal
MediaShell use case for the 25Q2 TV release. This change marks the API
as available in the dex so callers can call without being blocked by
hidden API restrictions. This API will be marked as public API
immediately after this change for 25Q4.

Test: TH
Flag: EXEMPT no logic change
Change-Id: I8e6e33ca224f459c3d8344c05ea6d6e5a4556a8d
---
 framework-t/src/android/net/nsd/NsdManager.java | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/framework-t/src/android/net/nsd/NsdManager.java b/framework-t/src/android/net/nsd/NsdManager.java
index 426a92d2bf..7ba4f91819 100644
--- a/framework-t/src/android/net/nsd/NsdManager.java
+++ b/framework-t/src/android/net/nsd/NsdManager.java
@@ -32,6 +32,7 @@ import android.annotation.SdkConstant.SdkConstantType;
 import android.annotation.SystemApi;
 import android.annotation.SystemService;
 import android.app.compat.CompatChanges;
+import android.compat.annotation.UnsupportedAppUsage;
 import android.content.Context;
 import android.net.ConnectivityManager;
 import android.net.ConnectivityManager.NetworkCallback;
@@ -1356,6 +1357,7 @@ public final class NsdManager {
      * @hide
      */
 //    @FlaggedApi(Flags.ADVERTISE_REQUEST_API)
+    @UnsupportedAppUsage
     public void registerService(@NonNull AdvertisingRequest advertisingRequest,
             @NonNull Executor executor,
             @NonNull RegistrationListener listener) {

From f0e3d9b1d7151aa978c5d800d7138875ac11d967 Mon Sep 17 00:00:00 2001
From: Junyu Lai <junyulai@google.com>
Date: Wed, 30 Apr 2025 10:34:30 +0800
Subject: [PATCH 180/377] Deduplicate fallback UID callbacks

Currently, onUserAdded calls onRoleSmsChanged, which triggers a
fallback UIDs callback.  Updating opt-in UIDs also triggers a
callback. The callback triggered by onRoleSmsChanged actually
not necessary and should be removed.

Flag: EXEMPT flagged with a kill switch
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.connectivity.SatelliteAccessControllerTest \
      --update-device
Bug: 410731080

Change-Id: Ifc6aa8d6b798cca2bfc575f986a012c52ea75667
---
 .../SatelliteAccessController.java            | 36 ++++++++++---------
 .../SatelliteAccessControllerTest.kt          | 18 ++++++++++
 2 files changed, 38 insertions(+), 16 deletions(-)

diff --git a/service/src/com/android/server/connectivity/SatelliteAccessController.java b/service/src/com/android/server/connectivity/SatelliteAccessController.java
index 5634984233..1ae41011c3 100644
--- a/service/src/com/android/server/connectivity/SatelliteAccessController.java
+++ b/service/src/com/android/server/connectivity/SatelliteAccessController.java
@@ -91,9 +91,9 @@ public class SatelliteAccessController {
             implements OnRoleHoldersChangedListener {
         @Override
         public void onRoleHoldersChanged(String role, UserHandle userHandle) {
-            if (RoleManager.ROLE_SMS.equals(role)) {
+            if (RoleManager.ROLE_SMS.equals(role) && updateSatelliteRoleSmsUids(userHandle)) {
                 Log.i(TAG, "ROLE_SMS Change detected ");
-                updateSatelliteRoleSmsUids(userHandle);
+                reportSatelliteNetworkFallbackUids();
             }
         }
 
@@ -195,11 +195,12 @@ public class SatelliteAccessController {
         return INVALID_UID;
     }
 
-    private void updateSatelliteRoleSmsUids(@NonNull UserHandle userHandle) {
+    @CheckReturnValue
+    private boolean updateSatelliteRoleSmsUids(@NonNull UserHandle userHandle) {
         int userId = userHandle.getIdentifier();
         if (userId == INVALID_UID) {
             Log.wtf(TAG, "Invalid User Id");
-            return;
+            return false;
         }
 
         //Returns empty list if no package exists
@@ -214,13 +215,11 @@ public class SatelliteAccessController {
         // on Role change, update the multilayer request at ConnectivityService with updated
         // satellite network role-sms uid cache list of multiple users as applicable
         if (newUidsForUser.equals(prevUidsForUser)) {
-            return;
+            return false;
         }
 
         mSatelliteRoleSmsUids.put(userId, newUidsForUser);
-
-        // Update all users fallback cache for user, send cs fallback to update ML request
-        reportSatelliteNetworkFallbackUids();
+        return true;
     }
 
     private void reportSatelliteNetworkFallbackUids() {
@@ -267,20 +266,25 @@ public class SatelliteAccessController {
     public void onUserAddedWithInstalledPackageList(@NonNull UserHandle userHandle,
             @NonNull List<PackageInfo> apps) {
         // Obtain uids with role sms and satellite communication permission for the added user.
-        updateSatelliteRoleSmsUids(userHandle);
+        final boolean roleSmsUidsChanged = updateSatelliteRoleSmsUids(userHandle);
 
         // Store PackageManager for user for later use.
         final PackageManager pmForUser =
                 mContext.createContextAsUser(userHandle, 0 /* flag */).getPackageManager();
         mUserPackageManagers.put(userHandle, pmForUser);
 
-        if (!mSupportConstrainedDataSatelliteOptIn) return;
-
-        final Set<Integer> satelliteDataOptInUidsForUser = getSatelliteDataOptInUidsForUser(apps);
-        Log.i(TAG, "Add SatelliteDataOptInUids for user " + userHandle + ": "
-                + satelliteDataOptInUidsForUser);
-        if (satelliteDataOptInUidsForUser.size() > 0) {
-            mSatelliteDataOptInUids.addAll(satelliteDataOptInUidsForUser);
+        boolean optInUidsChanged = false;
+        if (mSupportConstrainedDataSatelliteOptIn) {
+            final Set<Integer> satelliteDataOptInUidsForUser =
+                    getSatelliteDataOptInUidsForUser(apps);
+            if (satelliteDataOptInUidsForUser.size() > 0) {
+                Log.i(TAG, "Add SatelliteDataOptInUids for user " + userHandle + ": "
+                        + satelliteDataOptInUidsForUser);
+                mSatelliteDataOptInUids.addAll(satelliteDataOptInUidsForUser);
+                optInUidsChanged = true;
+            }
+        }
+        if (roleSmsUidsChanged || optInUidsChanged) {
             reportSatelliteNetworkFallbackUids();
         }
     }
diff --git a/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt b/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt
index 90cda29b9c..4c157d4370 100644
--- a/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt
+++ b/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt
@@ -454,6 +454,24 @@ class SatelliteAccessControllerTest {
         verify(callback).accept(setOf(SMS_APP_ID1.toUid(PRIMARY_USER)), setOf(TEST_UID1))
     }
 
+    @FeatureFlag(name = CONSTRAINED_DATA_SATELLITE_OPTIN)
+    @Test
+    fun testSatelliteOptInUids_onUserAddedWithRoleSmsUids() {
+        mockIsSatelliteDataOptimizedApp(TEST_PACKAGE1, true)
+        val packageInfo1 = makePackageInfo(TEST_PACKAGE1, TEST_UID1)
+        doReturn(listOf(SMS_APP1))
+                .`when`(deps).getRoleHoldersAsUser(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+
+        val inOrder = inOrder(callback)
+        satelliteAccessController
+                .onUserAddedWithInstalledPackageList(PRIMARY_USER_HANDLE, listOf(packageInfo1))
+        // Verify the callback only fired once after both lists are ready.
+        inOrder.verify(callback, never())
+                .accept(setOf(SMS_APP_ID1.toUid(PRIMARY_USER)), emptySet())
+        inOrder.verify(callback).accept(setOf(SMS_APP_ID1.toUid(PRIMARY_USER)), setOf(TEST_UID1))
+        inOrder.verifyNoMoreInteractions()
+    }
+
     @FeatureFlag(name = CONSTRAINED_DATA_SATELLITE_OPTIN)
     @Test
     fun testSatelliteOptInUids_withRoleSmsUids_overlappedUid() {

From 882a44f978b8b2d53a3e07bb4f7529fb2dba613b Mon Sep 17 00:00:00 2001
From: Paul Hu <paulhu@google.com>
Date: Wed, 30 Apr 2025 06:52:54 +0000
Subject: [PATCH 181/377] Add connectivity pre-check for
 CtsHostsideNetworkTests

Test: atest CtsHostsideNetworkTests
Flag: TEST_ONLY
Change-Id: If7f8cd614f0528248ca87be1d3aac5396b64e071
---
 tests/cts/hostside/Android.bp      | 1 +
 tests/cts/hostside/AndroidTest.xml | 1 +
 2 files changed, 2 insertions(+)

diff --git a/tests/cts/hostside/Android.bp b/tests/cts/hostside/Android.bp
index 0b4375a8a8..18032cddad 100644
--- a/tests/cts/hostside/Android.bp
+++ b/tests/cts/hostside/Android.bp
@@ -47,6 +47,7 @@ java_test_host {
     ],
     static_libs: [
         "modules-utils-build-testing",
+        "net-tests-utils-host-common",
     ],
     // Tag this module as a cts test artifact
     test_suites: [
diff --git a/tests/cts/hostside/AndroidTest.xml b/tests/cts/hostside/AndroidTest.xml
index 03ea17827f..6e13b88646 100644
--- a/tests/cts/hostside/AndroidTest.xml
+++ b/tests/cts/hostside/AndroidTest.xml
@@ -25,6 +25,7 @@
     <option name="config-descriptor:metadata" key="mainline-param" value="com.google.android.tethering.apex" />
 
     <target_preparer class="com.android.compatibility.common.tradefed.targetprep.LocationCheck" />
+    <target_preparer class="com.android.testutils.ConnectivityTestTargetPreparer" />
 
     <!-- Enabling change id ALLOW_TEST_API_ACCESS allows that package to access @TestApi methods -->
     <target_preparer class="com.android.tradefed.targetprep.RunCommandTargetPreparer">

From a79574a9e5843868aa48404e955f38f7fc269c50 Mon Sep 17 00:00:00 2001
From: Junyu Lai <junyulai@google.com>
Date: Tue, 29 Apr 2025 15:02:36 +0800
Subject: [PATCH 182/377] Support SharedLog for SatelliteAccessController

This is needed because user/package changed events occur rarely
and might not be included in bugreports when satellite network
problems occur.

This change also prints the feature flag in the dumpsys and
removing some logs which are redundant and not useful.

Sample output:
SatelliteAccessController:
  SupportConstrainedDataSatelliteOptIn: true
  Role-Sms Uids: {0={10138}}
  Opt-In Uids: {}
  Log:
  2025-04-29T15:22:50.816963 - SmsRoleUids: {10138} Opt-InUids:{}
  2025-04-29T15:22:49.164469 - SmsRoleUids: {10138} Opt-InUids:{10260}
  2025-04-29T15:22:24.392085 - SmsRoleUids: {10138} Opt-InUids:{}

Flag: EXEMPT flagged with a kill switch
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.connectivity.SatelliteAccessControllerTest \
--update-device
Bug: 410731080

Change-Id: Ic80aff756a0552e7d0e26fb906460c31e67a960e
---
 .../SatelliteAccessController.java            | 26 ++++++++++++-------
 1 file changed, 16 insertions(+), 10 deletions(-)

diff --git a/service/src/com/android/server/connectivity/SatelliteAccessController.java b/service/src/com/android/server/connectivity/SatelliteAccessController.java
index 1ae41011c3..3055b27eab 100644
--- a/service/src/com/android/server/connectivity/SatelliteAccessController.java
+++ b/service/src/com/android/server/connectivity/SatelliteAccessController.java
@@ -33,13 +33,13 @@ import android.os.UserHandle;
 import android.text.TextUtils;
 import android.util.ArrayMap;
 import android.util.ArraySet;
-import android.util.Log;
 import android.util.SparseArray;
 
 import com.android.internal.annotations.VisibleForTesting;
 import com.android.internal.util.IndentingPrintWriter;
 import com.android.net.module.util.CollectionUtils;
 import com.android.net.module.util.DeviceConfigUtils;
+import com.android.net.module.util.SharedLog;
 
 import java.util.List;
 import java.util.Set;
@@ -62,6 +62,7 @@ public class SatelliteAccessController {
     // This value is taken from android.os.UserHandle#PER_USER_RANGE.
     @VisibleForTesting
     public static final int PER_USER_RANGE = 100000;
+    private static final int MAX_LOG_ENTRIES = 50;
     private final Context mContext;
     private final Dependencies mDeps;
     private final DefaultMessageRoleListener mDefaultMessageRoleListener;
@@ -69,6 +70,7 @@ public class SatelliteAccessController {
     private final Handler mConnectivityServiceHandler;
     private final PackageManager mPackageManager;
     private final boolean mSupportConstrainedDataSatelliteOptIn;
+    private final SharedLog mLog = new SharedLog(MAX_LOG_ENTRIES, TAG);
 
     // At this sparseArray, Key is userId and values are uids of SMS apps that are allowed
     // to use satellite network as fallback.
@@ -92,7 +94,7 @@ public class SatelliteAccessController {
         @Override
         public void onRoleHoldersChanged(String role, UserHandle userHandle) {
             if (RoleManager.ROLE_SMS.equals(role) && updateSatelliteRoleSmsUids(userHandle)) {
-                Log.i(TAG, "ROLE_SMS Change detected ");
+                mLog.i("ROLE_SMS Change detected ");
                 reportSatelliteNetworkFallbackUids();
             }
         }
@@ -102,7 +104,7 @@ public class SatelliteAccessController {
                 mDeps.addOnRoleHoldersChangedListenerAsUser(
                         mConnectivityServiceHandler::post, this, UserHandle.ALL);
             } catch (RuntimeException e) {
-                Log.wtf(TAG, "Could not register satellite controller listener due to " + e);
+                mLog.wtf("Could not register satellite controller listener due to " + e);
             }
         }
     }
@@ -169,7 +171,7 @@ public class SatelliteAccessController {
                 }
             }
         } else {
-            Log.wtf(TAG, "package manager found null");
+            mLog.wtf("package manager found null for user " + userHandle);
         }
         return roleSmsUids;
     }
@@ -190,7 +192,7 @@ public class SatelliteAccessController {
             ApplicationInfo applicationInfo = packageManager.getApplicationInfo(pkgName, 0);
             return applicationInfo.uid;
         } catch (PackageManager.NameNotFoundException exception) {
-            Log.e(TAG, "Unable to find uid for package: " + pkgName);
+            mLog.e("Unable to find uid for package: " + pkgName);
         }
         return INVALID_UID;
     }
@@ -199,7 +201,7 @@ public class SatelliteAccessController {
     private boolean updateSatelliteRoleSmsUids(@NonNull UserHandle userHandle) {
         int userId = userHandle.getIdentifier();
         if (userId == INVALID_UID) {
-            Log.wtf(TAG, "Invalid User Id");
+            mLog.wtf("Invalid User Id for userHandle:" + userHandle);
             return false;
         }
 
@@ -228,7 +230,7 @@ public class SatelliteAccessController {
         for (int i = 0; i < mSatelliteRoleSmsUids.size(); i++) {
             mergedSatelliteRoleSmsUids.addAll(mSatelliteRoleSmsUids.valueAt(i));
         }
-        Log.i(TAG, "SmsRoleUids: " + mergedSatelliteRoleSmsUids
+        mLog.i("SmsRoleUids:" + mergedSatelliteRoleSmsUids
                 + " Opt-InUids:" + mSatelliteDataOptInUids);
 
         // trigger multiple layer request for satellite network fallback of multi user uids
@@ -246,7 +248,7 @@ public class SatelliteAccessController {
 
     @CheckReturnValue
     private boolean updateSatelliteRoleSmsUidListOnUserRemoval(int userIdRemoved) {
-        Log.i(TAG, "user id removed:" + userIdRemoved);
+        mLog.i("user id removed:" + userIdRemoved);
         if (mSatelliteRoleSmsUids.contains(userIdRemoved)) {
             mSatelliteRoleSmsUids.remove(userIdRemoved);
             return true; // Changed.
@@ -278,7 +280,7 @@ public class SatelliteAccessController {
             final Set<Integer> satelliteDataOptInUidsForUser =
                     getSatelliteDataOptInUidsForUser(apps);
             if (satelliteDataOptInUidsForUser.size() > 0) {
-                Log.i(TAG, "Add SatelliteDataOptInUids for user " + userHandle + ": "
+                mLog.i("Add SatelliteDataOptInUids for user " + userHandle + ": "
                         + satelliteDataOptInUidsForUser);
                 mSatelliteDataOptInUids.addAll(satelliteDataOptInUidsForUser);
                 optInUidsChanged = true;
@@ -340,7 +342,7 @@ public class SatelliteAccessController {
     public void onExternalApplicationsAvailable(String[] pkgList) {
         if (!mSupportConstrainedDataSatelliteOptIn) return;
         if (CollectionUtils.isEmpty(pkgList)) {
-            Log.e(TAG, "No available external application.");
+            mLog.e("No available external application.");
             return;
         }
 
@@ -414,12 +416,16 @@ public class SatelliteAccessController {
     public void dump(@NonNull IndentingPrintWriter pw) {
         pw.println("SatelliteAccessController:");
         pw.increaseIndent();
+        pw.println("SupportConstrainedDataSatelliteOptIn: "
+                + mSupportConstrainedDataSatelliteOptIn);
         pw.print("Role-Sms Uids: ");
         pw.print(mSatelliteRoleSmsUids);
         pw.println();
         pw.print("Opt-In Uids: ");
         pw.print(mSatelliteDataOptInUids);
         pw.println();
+        pw.println("Log:");
+        mLog.reverseDump(pw);
         pw.decreaseIndent();
         pw.println();
     }

From 6f04bb0ef4385931b849bef53a5cbf5898d5f06c Mon Sep 17 00:00:00 2001
From: Remi NGUYEN VAN <reminv@google.com>
Date: Wed, 30 Apr 2025 18:24:33 +0900
Subject: [PATCH 183/377] Require DnsResolver M-2025-07 for DDR

The DnsResolver needs to support FLAG_TRY_ALL_SERVERS, so this limits
the feature to devices having a new enough version of the resolver.

Test: atest
Bug: 240259333
Flag: EXEMPT legacy flag dns_ddr_version
Change-Id: I30fd55c9c2863857ca477b738ace88712ca01be3
---
 .../device/com/android/net/module/util/FeatureVersions.java   | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/staticlibs/device/com/android/net/module/util/FeatureVersions.java b/staticlibs/device/com/android/net/module/util/FeatureVersions.java
index d0cf3fd2ca..78ef94a4ec 100644
--- a/staticlibs/device/com/android/net/module/util/FeatureVersions.java
+++ b/staticlibs/device/com/android/net/module/util/FeatureVersions.java
@@ -54,6 +54,8 @@ public class FeatureVersions {
     // The flag that enables this feature is in NetworkStack.
     public static final long FEATURE_DDR_IN_CONNECTIVITY =
             CONNECTIVITY_MODULE_ID + 35_11_00_000L;
+    // DnsResolver needs to support RESOLV_TRY_ALL_SERVERS when querying the SVCB record for
+    // the feature to behave properly.
     public static final long FEATURE_DDR_IN_DNSRESOLVER =
-            DNS_RESOLVER_MODULE_ID + 35_11_00_000L;
+            DNS_RESOLVER_MODULE_ID + 36_07_00_000L;
 }

From 746540b874d8f7c9d1c3e56c307d8e3e6a32d73d Mon Sep 17 00:00:00 2001
From: Sarup Dalwani <sarup@google.com>
Date: Tue, 22 Apr 2025 16:01:52 +0000
Subject: [PATCH 184/377] Adding IpAddress Struct type to store ip v4 and v6
 addresses.

IPv4 addresses will be converted as v4-mapped-v6 address while
writting it to byte form. v4-mapped-v6 addresses in byte form will be
parsed to Inet4Address while converting it back.

Bug: 392509494
Test: atest NetworkStaticLibTests:com.android.net.moduletests.util.StructTest
Flag: EXEMPT refactor
Change-Id: Ia906d2cae7bb7402ff937da267c2552431b2d0f7
---
 staticlibs/Android.bp                         |  3 +
 .../com/android/net/module/util/Struct.java   | 28 ++++++-
 .../android/net/module/util/StructTest.java   | 78 +++++++++++++++----
 3 files changed, 95 insertions(+), 14 deletions(-)

diff --git a/staticlibs/Android.bp b/staticlibs/Android.bp
index 484b93d401..5e01efaa96 100644
--- a/staticlibs/Android.bp
+++ b/staticlibs/Android.bp
@@ -484,6 +484,9 @@ java_library {
         "framework-configinfrastructure.stubs.module_lib",
         "framework-connectivity.stubs.module_lib",
     ],
+    static_libs: [
+        "net-utils-framework-common",
+    ],
     lint: {
         strict_updatability_linting: true,
         error_checks: ["NewApi"],
diff --git a/staticlibs/device/com/android/net/module/util/Struct.java b/staticlibs/device/com/android/net/module/util/Struct.java
index 69ca678c71..fec2c5bd94 100644
--- a/staticlibs/device/com/android/net/module/util/Struct.java
+++ b/staticlibs/device/com/android/net/module/util/Struct.java
@@ -123,6 +123,9 @@ public class Struct {
         EUI48,       // IEEE Extended Unique Identifier, a 48-bits long MAC address in network order
         Ipv4Address, // IPv4 address in network order
         Ipv6Address, // IPv6 address in network order
+        IpAddress,   // IP address in network order. IPv4 address is written to byte format as 
+                     // v4-mapped-v6 address. IpAddress should be used over Ipv6Address when 
+                     // the field wants to contain both v4 and v6 addresses.
     }
 
     /**
@@ -212,6 +215,9 @@ public class Struct {
             case Ipv6Address:
                 if (fieldType == Inet6Address.class) return;
                 break;
+            case IpAddress:
+                if (fieldType == InetAddress.class) return;
+                break;
             default:
                 throw new IllegalArgumentException("Unknown type" + annotation.type());
         }
@@ -254,6 +260,7 @@ public class Struct {
                 length = 4;
                 break;
             case Ipv6Address:
+            case IpAddress:
                 length = 16;
                 break;
             default:
@@ -442,6 +449,17 @@ public class Struct {
                     throw new IllegalArgumentException("illegal length of IP address", e);
                 }
                 break;
+            case IpAddress:
+                final byte[] ipAddress = new byte[16];
+                buf.get(ipAddress);
+                try {
+                    // InetAddress.getByAddress converts v4-mapped-v6 address to v4 address
+                    // internally and returns Inet4Address, otherwise returns Inet6Address.
+                    value = InetAddress.getByAddress(null /* host */, ipAddress);
+                } catch (UnknownHostException e) {
+                    throw new IllegalArgumentException("illegal length of IP address", e);
+                }
+                break;
             default:
                 throw new IllegalArgumentException("Unknown type:" + fieldInfo.annotation.type());
         }
@@ -533,6 +551,13 @@ public class Struct {
                 final byte[] address = ((InetAddress) value).getAddress();
                 output.put(address);
                 break;
+            case IpAddress:
+                InetAddress inetAddress = (InetAddress) value;
+                if (inetAddress instanceof Inet4Address) {
+                    inetAddress = InetAddressUtils.v4MappedV6Address((Inet4Address) value);
+                }
+                output.put(inetAddress.getAddress());
+                break;
             default:
                 throw new IllegalArgumentException("Unknown type:" + fieldInfo.annotation.type());
         }
@@ -749,7 +774,8 @@ public class Struct {
             } else if (fieldInfos[i].annotation.type() == Type.ByteArray) {
                 sb.append("0x").append(HexDump.toHexString((byte[]) value));
             } else if (fieldInfos[i].annotation.type() == Type.Ipv4Address
-                    || fieldInfos[i].annotation.type() == Type.Ipv6Address) {
+                    || fieldInfos[i].annotation.type() == Type.Ipv6Address
+                    || fieldInfos[i].annotation.type() == Type.IpAddress) {
                 sb.append(((InetAddress) value).getHostAddress());
             } else {
                 sb.append(value.toString());
diff --git a/staticlibs/tests/unit/src/com/android/net/module/util/StructTest.java b/staticlibs/tests/unit/src/com/android/net/module/util/StructTest.java
index 0c2605ff63..c5a922643c 100644
--- a/staticlibs/tests/unit/src/com/android/net/module/util/StructTest.java
+++ b/staticlibs/tests/unit/src/com/android/net/module/util/StructTest.java
@@ -809,6 +809,31 @@ public class StructTest {
                                    toByteBuffer("c0a86401" + "20010db8000300040005000600070008")));
     }
 
+    public static class InetAddressMessage extends Struct {
+        @Field(order = 0, type = Type.IpAddress) public final InetAddress ipAddress;
+
+        InetAddressMessage(final InetAddress ipAddress) {
+            this.ipAddress = ipAddress;
+        }
+    }
+
+    @Test
+    public void testV4AddressInIpAddress() {
+        final InetAddressMessage msg = doParsingMessageTest(
+                "00000000000000000000ffffc0a86401", InetAddressMessage.class, ByteOrder.BIG_ENDIAN);
+        assertEquals(TEST_IPV4_ADDRESS, msg.ipAddress);
+        assertArrayEquals(toByteBuffer("00000000000000000000ffffc0a86401").array(),
+                msg.writeToBytes(ByteOrder.BIG_ENDIAN));
+    }
+    @Test
+    public void testV6AddressInIpAddress() {
+        final InetAddressMessage msg = doParsingMessageTest(
+                "20010db8000300040005000600070008", InetAddressMessage.class, ByteOrder.BIG_ENDIAN);
+        assertEquals(TEST_IPV6_ADDRESS, msg.ipAddress);
+        assertArrayEquals(toByteBuffer("20010db8000300040005000600070008").array(),
+                msg.writeToBytes(ByteOrder.BIG_ENDIAN));
+    }
+
     public static class FullTypeMessage extends Struct {
         @Field(order = 0, type = Type.U8) public final short u8;
         @Field(order = 1, type = Type.U16) public final int u16;
@@ -827,12 +852,13 @@ public class StructTest {
         @Field(order = 14, type = Type.EUI48) public final MacAddress eui48;
         @Field(order = 15, type = Type.Ipv4Address) public final Inet4Address ipv4Address;
         @Field(order = 16, type = Type.Ipv6Address) public final Inet6Address ipv6Address;
+        @Field(order = 17, type = Type.IpAddress) public final InetAddress ipAddress;
 
         FullTypeMessage(final short u8, final int u16, final long u32, final long u63,
                 final BigInteger u64, final byte s8, final short s16, final int s32, final long s64,
                 final int ube16, final long ube32, final long ube63, final BigInteger ube64,
                 final byte[] bytes, final MacAddress eui48, final Inet4Address ipv4Address,
-                final Inet6Address ipv6Address) {
+                final Inet6Address ipv6Address, final InetAddress ipAddress) {
             this.u8 = u8;
             this.u16 = u16;
             this.u32 = u32;
@@ -850,38 +876,52 @@ public class StructTest {
             this.eui48 = eui48;
             this.ipv4Address = ipv4Address;
             this.ipv6Address = ipv6Address;
+            this.ipAddress = ipAddress;
         }
     }
 
     private static final String FULL_TYPE_DATA = "ff" + "ffff" + "ffffffff" + "7fffffffffffffff"
             + "ffffffffffffffff" + "7f" + "7fff" + "7fffffff" + "7fffffffffffffff" + "7fff"
             + "7fffffff" + "7fffffffffffffff" + "ffffffffffffffff" + "20010db80003000400050006"
-            + "001122334455" + "c0a86401" + "20010db8000300040005000600070008";
+            + "001122334455" + "c0a86401" + "20010db8000300040005000600070008"
+            + "00000000000000000000ffffc0a86401";
     private static final String FULL_TYPE_DATA_DIFF_MAC = "ff" + "ffff" + "ffffffff"
             + "7fffffffffffffff" + "ffffffffffffffff" + "7f" + "7fff" + "7fffffff"
             + "7fffffffffffffff" + "7fff" + "7fffffff" + "7fffffffffffffff" + "ffffffffffffffff"
             + "20010db80003000400050006" + "112233445566"
-            + "c0a86401" + "20010db8000300040005000600070008";
+            + "c0a86401" + "20010db8000300040005000600070008"
+            + "00000000000000000000ffffc0a86401";
     private static final String FULL_TYPE_DATA_DIFF_LONG = "ff" + "ffff" + "ffffffff"
             + "7ffffffffffffffe" + "ffffffffffffffff" + "7f" + "7fff" + "7fffffff"
             + "7fffffffffffffff" + "7fff" + "7fffffff" + "7fffffffffffffff" + "ffffffffffffffff"
             + "20010db80003000400050006" + "001122334455"
-            + "c0a86401" + "20010db8000300040005000600070008";
+            + "c0a86401" + "20010db8000300040005000600070008"
+            + "00000000000000000000ffffc0a86401";
     private static final String FULL_TYPE_DATA_DIFF_INTEGER = "ff" + "ffff" + "ffffffff"
             + "7fffffffffffffff" + "ffffffffffffffff" + "7f" + "7fff" + "7fffffff"
             + "7fffffffffffffff" + "7fff" + "ffffff7f" + "7fffffffffffffff" + "ffffffffffffffff"
             + "20010db80003000400050006" + "001122334455"
-            + "c0a86401" + "20010db8000300040005000600070008";
+            + "c0a86401" + "20010db8000300040005000600070008"
+            + "00000000000000000000ffffc0a86401";
     private static final String FULL_TYPE_DATA_DIFF_IPV4 = "ff" + "ffff" + "ffffffff"
             + "7fffffffffffffff" + "ffffffffffffffff" + "7f" + "7fff" + "7fffffff"
             + "7fffffffffffffff" + "7fff" + "ffffff7f" + "7fffffffffffffff" + "ffffffffffffffff"
             + "20010db80003000400050006" + "001122334455"
-            + "c0a81010" + "20010db8000300040005000600070008";
+            + "c0a81010" + "20010db8000300040005000600070008"
+            + "00000000000000000000ffffc0a86401";
     private static final String FULL_TYPE_DATA_DIFF_IPV6 = "ff" + "ffff" + "ffffffff"
             + "7fffffffffffffff" + "ffffffffffffffff" + "7f" + "7fff" + "7fffffff"
             + "7fffffffffffffff" + "7fff" + "ffffff7f" + "7fffffffffffffff" + "ffffffffffffffff"
             + "20010db80003000400050006" + "001122334455"
-            + "c0a86401" + "20010db800030004000500060007000a";
+            + "c0a86401" + "20010db800030004000500060007000a"
+            + "00000000000000000000ffffc0a86401";
+
+    private static final String FULL_TYPE_DATA_DIFF_IP = "ff" + "ffff" + "ffffffff"
+            + "7fffffffffffffff" + "ffffffffffffffff" + "7f" + "7fff" + "7fffffff"
+            + "7fffffffffffffff" + "7fff" + "7fffffff" + "7fffffffffffffff" + "ffffffffffffffff"
+            + "20010db80003000400050006" + "001122334455" + "c0a86401"
+            + "20010db8000300040005000600070008" + "20010db8000300040005000600070008";
+
     @Test
     public void testStructClass_equals() {
         final FullTypeMessage msg = doParsingMessageTest(FULL_TYPE_DATA, FullTypeMessage.class,
@@ -904,8 +944,9 @@ public class StructTest {
         assertEquals(MacAddress.fromString("00:11:22:33:44:55"), msg.eui48);
         assertEquals(TEST_IPV4_ADDRESS, msg.ipv4Address);
         assertEquals(TEST_IPV6_ADDRESS, msg.ipv6Address);
+        assertEquals(TEST_IPV4_ADDRESS, msg.ipAddress);
 
-        assertEquals(98, msg.getSize(FullTypeMessage.class));
+        assertEquals(114, msg.getSize(FullTypeMessage.class));
         assertArrayEquals(toByteBuffer(FULL_TYPE_DATA).array(),
                 msg.writeToBytes(ByteOrder.BIG_ENDIAN));
 
@@ -914,7 +955,8 @@ public class StructTest {
                 new BigInteger("18446744073709551615"), (byte) 0x7f, (short) 0x7fff,
                 (int) 0x7fffffff, (long) 0x7fffffffffffffffL, (int) 0x7fff, (long) 0x7fffffffL,
                 (long) 0x7fffffffffffffffL, new BigInteger("18446744073709551615"), TEST_PREFIX64,
-                MacAddress.fromString("00:11:22:33:44:55"), TEST_IPV4_ADDRESS, TEST_IPV6_ADDRESS);
+                MacAddress.fromString("00:11:22:33:44:55"), TEST_IPV4_ADDRESS, TEST_IPV6_ADDRESS,
+                TEST_IPV4_ADDRESS);
         assertTrue(msg.equals(msg1));
     }
 
@@ -936,12 +978,13 @@ public class StructTest {
         @Field(order = 14, type = Type.EUI48) public final MacAddress eui48;
         @Field(order = 15, type = Type.Ipv4Address) public final Inet4Address ipv4Address;
         @Field(order = 16, type = Type.Ipv6Address) public final Inet6Address ipv6Address;
+        @Field(order = 17, type = Type.IpAddress) public final InetAddress ipAddress;
 
         FullTypeMessageWithDupType(final short u8, final int u16, final long u32, final long u63,
                 final BigInteger u64, final byte s8, final short s16, final int s32, final long s64,
                 final int ube16, final long ube32, final long ube63, final BigInteger ube64,
                 final byte[] bytes, final MacAddress eui48, final Inet4Address ipv4Address,
-                final Inet6Address ipv6Address) {
+                final Inet6Address ipv6Address, final InetAddress ipAddress) {
             this.u8 = u8;
             this.u16 = u16;
             this.u32 = u32;
@@ -959,6 +1002,7 @@ public class StructTest {
             this.eui48 = eui48;
             this.ipv4Address = ipv4Address;
             this.ipv6Address = ipv6Address;
+            this.ipAddress = ipAddress;
         }
     }
 
@@ -1012,6 +1056,12 @@ public class StructTest {
                 FullTypeMessage.class, ByteOrder.BIG_ENDIAN);
         assertNotEquals(msg.ipv6Address, msg6.ipv6Address);
         assertFalse(msg.equals(msg6));
+
+        // With different IP address.
+        final FullTypeMessage msg7 = doParsingMessageTest(FULL_TYPE_DATA_DIFF_IP,
+                FullTypeMessage.class, ByteOrder.BIG_ENDIAN);
+        assertNotEquals(msg.ipAddress, msg7.ipAddress);
+        assertFalse(msg.equals(msg7));
     }
 
     @Test
@@ -1023,7 +1073,8 @@ public class StructTest {
                 + " bytes: 0x20010DB80003000400050006,"
                 + " eui48: 00:11:22:33:44:55,"
                 + " ipv4Address: 192.168.100.1,"
-                + " ipv6Address: 2001:db8:3:4:5:6:7:8";
+                + " ipv6Address: 2001:db8:3:4:5:6:7:8,"
+                + " ipAddress: 192.168.100.1";
 
         final FullTypeMessage msg = doParsingMessageTest(FULL_TYPE_DATA, FullTypeMessage.class,
                 ByteOrder.BIG_ENDIAN);
@@ -1037,14 +1088,15 @@ public class StructTest {
                 + " s32: 2147483647, s64: 9223372036854775807, ube16: 32767, ube32: 2147483647,"
                 + " ube63: 9223372036854775807, ube64: 18446744073709551615,"
                 + " bytes: null, eui48: null, ipv4Address: 192.168.100.1,"
-                + " ipv6Address: null";
+                + " ipv6Address: null, ipAddress: 192.168.100.1";
 
         final FullTypeMessage msg = new FullTypeMessage((short) 0xff, (int) 0xffff,
                 (long) 0xffffffffL, (long) 0x7fffffffffffffffL,
                 null /* u64 */, (byte) 0x7f, (short) 0x7fff,
                 (int) 0x7fffffff, (long) 0x7fffffffffffffffL, (int) 0x7fff, (long) 0x7fffffffL,
                 (long) 0x7fffffffffffffffL, new BigInteger("18446744073709551615"),
-                null /* bytes */, null /* eui48 */, TEST_IPV4_ADDRESS, null /* ipv6Address */);
+                null /* bytes */, null /* eui48 */, TEST_IPV4_ADDRESS, null /* ipv6Address */,
+                TEST_IPV4_ADDRESS);
         assertEquals(expected, msg.toString());
     }
 

From 09c0307b9aa4bcdaef9627a571100fae9a9266f2 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Wed, 30 Apr 2025 12:24:09 -0700
Subject: [PATCH 185/377] Update outdated example code

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I0a87d71f693edcf13ad85049bff24169ddbedb3e
---
 .../devicetests/com/android/testutils/PacketBuilderUtils.kt     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
index b386f48c9e..ad9a25cb16 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
@@ -638,7 +638,7 @@ class Ip4Pkt(
  * val ra = RaPkt(lft = 50, reachableTime = 100, flags = "O")
  *         .addPioOption(prefix = "2001:db8::1/64", flags = "LA")
  * val p = ether / ipv6 / ra
- * val bytes = p.bytes
+ * val bytes = p.build()
  * }
  * </pre>
  **/

From cb555726759433afbcf99508e701d953bb54cc6a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Thu, 1 May 2025 06:12:00 -0700
Subject: [PATCH 186/377] NetBpfLoad: relax version checks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Test: TreeHugger
Flag: EXEMPT mainline
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ie4ac3608d3f9599ffca40b0b2073f21efed7b17c
---
 bpf/loader/NetBpfLoad.cpp | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/bpf/loader/NetBpfLoad.cpp b/bpf/loader/NetBpfLoad.cpp
index 5c420df0ba..4a79a0fc1a 100644
--- a/bpf/loader/NetBpfLoad.cpp
+++ b/bpf/loader/NetBpfLoad.cpp
@@ -1826,9 +1826,12 @@ static int doLoad(char** argv, char * const envp[]) {
         int v = fscanf(f, "# %d %d %d %d %d #", &y, &q, &a, &b, &c);
         ALOGI("detected %d of 5: %dQ%d api:%d.%d.%d", v, y, q, a, b, c);
         fclose(f);
-        if (v != 5 || y != 2025 || a != 36 || b) return 1;
-        if (q < 2 || q > 3) return 1;
-        if (c < 0 || c > 1) return 1;
+        if (v != 5) return 1;
+        if (y < 2025 || y > 2099) return 1;
+        if (q < 1 || q > 4) return 1;
+        if (a < 36) return 1;
+        if (b < 0 || b > 4) return 1;
+        if (c < 0) return 1;
     }
 
     // Ensure we can determine the Android build type.

From 1ff7c3ef71e6e82464105c3e0f439b380069b60e Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Thu, 1 May 2025 10:31:58 -0700
Subject: [PATCH 187/377] Move Dhcp6*Packet.java to staticlibs

For use in tests. This CL won't build by itself

mv NetworkStack/src/android/net/dhcp6/Dhcp6*Packet.java \
Connectivity/staticlibs/device/com/android/net/module/util/dhcp6

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: Ie072f2f20ecfbf23f77606dd064e0f6fbd7c2232
---
 .../util/dhcp6/Dhcp6AdvertisePacket.java      |  55 ++
 .../net/module/util/dhcp6/Dhcp6Packet.java    | 737 ++++++++++++++++++
 .../module/util/dhcp6/Dhcp6RebindPacket.java  |  56 ++
 .../module/util/dhcp6/Dhcp6RenewPacket.java   |  57 ++
 .../module/util/dhcp6/Dhcp6ReplyPacket.java   |  60 ++
 .../module/util/dhcp6/Dhcp6RequestPacket.java |  57 ++
 .../module/util/dhcp6/Dhcp6SolicitPacket.java |  59 ++
 7 files changed, 1081 insertions(+)
 create mode 100644 staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6AdvertisePacket.java
 create mode 100644 staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java
 create mode 100644 staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6RebindPacket.java
 create mode 100644 staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6RenewPacket.java
 create mode 100644 staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6ReplyPacket.java
 create mode 100644 staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6RequestPacket.java
 create mode 100644 staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6SolicitPacket.java

diff --git a/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6AdvertisePacket.java b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6AdvertisePacket.java
new file mode 100644
index 0000000000..263ab5ff04
--- /dev/null
+++ b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6AdvertisePacket.java
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.net.dhcp6;
+
+import static com.android.net.module.util.NetworkStackConstants.DHCP_MAX_LENGTH;
+
+import androidx.annotation.NonNull;
+
+import java.nio.ByteBuffer;
+
+/**
+ * DHCPv6 ADVERTISE packet class, a server sends an Advertise message to indicate that it's
+ * available for DHCP service, in response to a Solicit message received from a client.
+ *
+ * https://tools.ietf.org/html/rfc8415#page-24
+ */
+public class Dhcp6AdvertisePacket extends Dhcp6Packet {
+    /**
+     * Generates an advertise packet with the specified parameters.
+     */
+    Dhcp6AdvertisePacket(int transId, @NonNull final byte[] clientDuid,
+            @NonNull final byte[] serverDuid, final byte[] iapd) {
+        super(transId, 0 /* elapsedTime */, clientDuid, serverDuid, iapd);
+    }
+
+    /**
+     * Build a DHCPv6 Advertise message with the specific parameters.
+     */
+    public ByteBuffer buildPacket() {
+        final ByteBuffer packet = ByteBuffer.allocate(DHCP_MAX_LENGTH);
+        final int msgTypeAndTransId = (DHCP6_MESSAGE_TYPE_ADVERTISE << 24) | mTransId;
+        packet.putInt(msgTypeAndTransId);
+
+        addTlv(packet, DHCP6_CLIENT_IDENTIFIER, mClientDuid);
+        addTlv(packet, DHCP6_SERVER_IDENTIFIER, mServerDuid);
+        addTlv(packet, DHCP6_IA_PD, mIaPd);
+
+        packet.flip();
+        return packet;
+    }
+}
diff --git a/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java
new file mode 100644
index 0000000000..ff7b036d61
--- /dev/null
+++ b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java
@@ -0,0 +1,737 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.net.dhcp6;
+
+import static com.android.net.module.util.NetworkStackConstants.DHCP_MAX_OPTION_LEN;
+
+import android.net.MacAddress;
+import android.util.Log;
+
+import androidx.annotation.NonNull;
+
+import com.android.internal.annotations.VisibleForTesting;
+import com.android.internal.util.HexDump;
+import com.android.net.module.util.Struct;
+import com.android.net.module.util.structs.IaPdOption;
+import com.android.net.module.util.structs.IaPrefixOption;
+
+import java.nio.BufferUnderflowException;
+import java.nio.ByteBuffer;
+import java.nio.ByteOrder;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+import java.util.Objects;
+import java.util.OptionalInt;
+
+/**
+ * Defines basic data and operations needed to build and use packets for the
+ * DHCPv6 protocol. Subclasses create the specific packets used at each
+ * stage of the negotiation.
+ *
+ * @hide
+ */
+public class Dhcp6Packet {
+    private static final String TAG = Dhcp6Packet.class.getSimpleName();
+    /**
+     * DHCPv6 Message Type.
+     */
+    public static final byte DHCP6_MESSAGE_TYPE_SOLICIT = 1;
+    public static final byte DHCP6_MESSAGE_TYPE_ADVERTISE = 2;
+    public static final byte DHCP6_MESSAGE_TYPE_REQUEST = 3;
+    public static final byte DHCP6_MESSAGE_TYPE_CONFIRM = 4;
+    public static final byte DHCP6_MESSAGE_TYPE_RENEW = 5;
+    public static final byte DHCP6_MESSAGE_TYPE_REBIND = 6;
+    public static final byte DHCP6_MESSAGE_TYPE_REPLY = 7;
+    public static final byte DHCP6_MESSAGE_TYPE_RELEASE = 8;
+    public static final byte DHCP6_MESSAGE_TYPE_DECLINE = 9;
+    public static final byte DHCP6_MESSAGE_TYPE_RECONFIGURE = 10;
+    public static final byte DHCP6_MESSAGE_TYPE_INFORMATION_REQUEST = 11;
+    public static final byte DHCP6_MESSAGE_TYPE_RELAY_FORW = 12;
+    public static final byte DHCP6_MESSAGE_TYPE_RELAY_REPL = 13;
+
+    /**
+     * DHCPv6 Optional Type: Client Identifier.
+     * DHCPv6 message from client must have this option.
+     */
+    public static final byte DHCP6_CLIENT_IDENTIFIER = 1;
+    @NonNull
+    protected final byte[] mClientDuid;
+
+    /**
+     * DHCPv6 Optional Type: Server Identifier.
+     */
+    public static final byte DHCP6_SERVER_IDENTIFIER = 2;
+    protected final byte[] mServerDuid;
+
+    /**
+     * DHCPv6 Optional Type: Option Request Option.
+     */
+    public static final byte DHCP6_OPTION_REQUEST_OPTION = 6;
+
+    /**
+     * DHCPv6 Optional Type: Elapsed time.
+     * This time is expressed in hundredths of a second.
+     */
+    public static final byte DHCP6_ELAPSED_TIME = 8;
+    protected final int mElapsedTime;
+
+    /**
+     * DHCPv6 Optional Type: Status Code.
+     */
+    public static final byte DHCP6_STATUS_CODE = 13;
+    private static final byte MIN_STATUS_CODE_OPT_LEN = 6;
+    protected short mStatusCode;
+
+    public static final short STATUS_SUCCESS           = 0;
+    public static final short STATUS_UNSPEC_FAIL       = 1;
+    public static final short STATUS_NO_ADDRS_AVAIL    = 2;
+    public static final short STATUS_NO_BINDING        = 3;
+    public static final short STATUS_NOT_ONLINK        = 4;
+    public static final short STATUS_USE_MULTICAST     = 5;
+    public static final short STATUS_NO_PREFIX_AVAIL   = 6;
+
+    /**
+     * DHCPv6 zero-length Optional Type: Rapid Commit. Per RFC4039, both DHCPDISCOVER and DHCPACK
+     * packet may include this option.
+     */
+    public static final byte DHCP6_RAPID_COMMIT = 14;
+    public boolean mRapidCommit;
+
+    /**
+     * DHCPv6 Optional Type: IA_PD.
+     */
+    public static final byte DHCP6_IA_PD = 25;
+    @NonNull
+    protected final byte[] mIaPd;
+    @NonNull
+    protected PrefixDelegation mPrefixDelegation;
+
+    /**
+     * DHCPv6 Optional Type: IA Prefix Option.
+     */
+    public static final byte DHCP6_IAPREFIX = 26;
+
+    /**
+     * DHCPv6 Optional Type: SOL_MAX_RT.
+     */
+    public static final byte DHCP6_SOL_MAX_RT = 82;
+    private OptionalInt mSolMaxRt;
+
+    /**
+     * The transaction identifier used in this particular DHCPv6 negotiation
+     */
+    protected final int mTransId;
+
+    /**
+     * The unique identifier for IA_NA, IA_TA, IA_PD used in this particular DHCPv6 negotiation
+     */
+    protected int mIaId;
+    // Per rfc8415#section-12, the IAID MUST be consistent across restarts.
+    // Since currently only one IAID is supported, a well-known value can be used (0).
+    public static final int IAID = 0;
+
+    Dhcp6Packet(int transId, int elapsedTime, @NonNull final byte[] clientDuid,
+            final byte[] serverDuid, @NonNull final byte[] iapd) {
+        mTransId = transId;
+        mElapsedTime = elapsedTime;
+        mClientDuid = clientDuid;
+        mServerDuid = serverDuid;
+        mIaPd = iapd;
+    }
+
+    /**
+     * Returns the transaction ID.
+     */
+    public int getTransactionId() {
+        return mTransId;
+    }
+
+    /**
+     * Returns decoded IA_PD options associated with IA_ID.
+     */
+    @VisibleForTesting
+    public PrefixDelegation getPrefixDelegation() {
+        return mPrefixDelegation;
+    }
+
+    /**
+     * Returns IA_ID associated to IA_PD.
+     */
+    public int getIaId() {
+        return mIaId;
+    }
+
+    /**
+     * Returns the client's DUID.
+     */
+    @NonNull
+    public byte[] getClientDuid() {
+        return mClientDuid;
+    }
+
+    /**
+     * Returns the server's DUID.
+     */
+    public byte[] getServerDuid() {
+        return mServerDuid;
+    }
+
+    /**
+     * Returns the SOL_MAX_RT option value in milliseconds.
+     */
+    public OptionalInt getSolMaxRtMs() {
+        return mSolMaxRt;
+    }
+
+    /**
+     * A class to take DHCPv6 IA_PD option allocated from server.
+     * https://www.rfc-editor.org/rfc/rfc8415.html#section-21.21
+     */
+    public static class PrefixDelegation {
+        public final int iaid;
+        public final int t1;
+        public final int t2;
+        @NonNull
+        public final List<IaPrefixOption> ipos;
+        public final short statusCode;
+
+        @VisibleForTesting
+        public PrefixDelegation(int iaid, int t1, int t2,
+                @NonNull final List<IaPrefixOption> ipos, short statusCode) {
+            Objects.requireNonNull(ipos);
+            this.iaid = iaid;
+            this.t1 = t1;
+            this.t2 = t2;
+            this.ipos = ipos;
+            this.statusCode = statusCode;
+        }
+
+        public PrefixDelegation(int iaid, int t1, int t2,
+                @NonNull final List<IaPrefixOption> ipos) {
+            this(iaid, t1, t2, ipos, STATUS_SUCCESS /* statusCode */);
+        }
+
+        /**
+         * Check whether or not the IA_PD option in DHCPv6 message is valid.
+         *
+         * TODO: ensure that the prefix has a reasonable lifetime, and the timers aren't too short.
+         */
+        public boolean isValid() {
+            if (iaid != IAID) {
+                Log.w(TAG, "IA_ID doesn't match, expected: " + IAID + ", actual: " + iaid);
+                return false;
+            }
+            if (t1 < 0 || t2 < 0) {
+                Log.e(TAG, "IA_PD option with invalid T1 " + t1 + " or T2 " + t2);
+                return false;
+            }
+            // Generally, t1 must be smaller or equal to t2 (except when t2 is 0).
+            if (t2 != 0 && t1 > t2) {
+                Log.e(TAG, "IA_PD option with T1 " + t1 + " greater than T2 " + t2);
+                return false;
+            }
+            return true;
+        }
+
+        /**
+         * Decode an IA_PD option from the byte buffer.
+         */
+        public static PrefixDelegation decode(@NonNull final ByteBuffer buffer)
+                throws ParseException {
+            try {
+                final int iaid = buffer.getInt();
+                final int t1 = buffer.getInt();
+                final int t2 = buffer.getInt();
+                final List<IaPrefixOption> ipos = new ArrayList<IaPrefixOption>();
+                short statusCode = STATUS_SUCCESS;
+                while (buffer.remaining() > 0) {
+                    final int original = buffer.position();
+                    final short optionType = buffer.getShort();
+                    final int optionLen = buffer.getShort() & 0xFFFF;
+                    switch (optionType) {
+                        case DHCP6_IAPREFIX:
+                            buffer.position(original);
+                            final IaPrefixOption ipo = Struct.parse(IaPrefixOption.class, buffer);
+                            Log.d(TAG, "IA Prefix Option: " + ipo);
+                            ipos.add(ipo);
+                            break;
+                        case DHCP6_STATUS_CODE:
+                            statusCode = buffer.getShort();
+                            // Skip the status message if any.
+                            if (optionLen > 2) {
+                                skipOption(buffer, optionLen - 2);
+                            }
+                            break;
+                        default:
+                            skipOption(buffer, optionLen);
+                    }
+                }
+                return new PrefixDelegation(iaid, t1, t2, ipos, statusCode);
+            } catch (BufferUnderflowException e) {
+                throw new ParseException(e.getMessage());
+            }
+        }
+
+        /**
+         * Build an IA_PD option from given specific parameters, including IA_PREFIX options.
+         */
+        public ByteBuffer build() {
+            return build(ipos);
+        }
+
+        /**
+         * Build an IA_PD option from given specific parameters, including IA_PREFIX options.
+         *
+         * Per RFC8415 section 21.13 if the Status Code option does not appear in a message in
+         * which the option could appear, the status of the message is assumed to be Success. So
+         * only put the Status Code option in IA_PD when the status code is not Success.
+         */
+        public ByteBuffer build(@NonNull final List<IaPrefixOption> input) {
+            final ByteBuffer iapd = ByteBuffer.allocate(IaPdOption.LENGTH
+                    + Struct.getSize(IaPrefixOption.class) * input.size()
+                    + (statusCode != STATUS_SUCCESS ? MIN_STATUS_CODE_OPT_LEN : 0));
+            iapd.putInt(iaid);
+            iapd.putInt(t1);
+            iapd.putInt(t2);
+            for (IaPrefixOption ipo : input) {
+                ipo.writeToByteBuffer(iapd);
+            }
+            if (statusCode != STATUS_SUCCESS) {
+                iapd.putShort(DHCP6_STATUS_CODE);
+                iapd.putShort((short) 2);
+                iapd.putShort(statusCode);
+            }
+            iapd.flip();
+            return iapd;
+        }
+
+        /**
+         * Return valid IA prefix options to be used and extended in the Reply message. It may
+         * return empty list if there isn't any valid IA prefix option in the Reply message.
+         *
+         * TODO: ensure that the prefix has a reasonable lifetime, and the timers aren't too short.
+         * and handle status code such as NoPrefixAvail.
+         */
+        public List<IaPrefixOption> getValidIaPrefixes() {
+            final List<IaPrefixOption> validIpos = new ArrayList<IaPrefixOption>();
+            for (IaPrefixOption ipo : ipos) {
+                if (!ipo.isValid()) continue;
+                validIpos.add(ipo);
+            }
+            return validIpos;
+        }
+
+        @Override
+        public String toString() {
+            return String.format("Prefix Delegation, iaid: %s, t1: %s, t2: %s, status code: %s,"
+                    + " IA prefix options: %s", iaid, t1, t2, statusCodeToString(statusCode), ipos);
+        }
+
+        /**
+         * Compare the preferred lifetime in the IA prefix optin list and return the minimum one.
+         */
+        public long getMinimalPreferredLifetime() {
+            long min = Long.MAX_VALUE;
+            for (IaPrefixOption ipo : ipos) {
+                min = (ipo.preferred != 0 && min > ipo.preferred) ? ipo.preferred : min;
+            }
+            return min;
+        }
+
+        /**
+         * Compare the valid lifetime in the IA prefix optin list and return the minimum one.
+         */
+        public long getMinimalValidLifetime() {
+            long min = Long.MAX_VALUE;
+            for (IaPrefixOption ipo : ipos) {
+                min = (ipo.valid != 0 && min > ipo.valid) ? ipo.valid : min;
+            }
+            return min;
+        }
+
+        /**
+         * Return IA prefix option list to be renewed/rebound.
+         *
+         * Per RFC8415#section-18.2.4, client must not include any prefixes that it didn't obtain
+         * from server or that are no longer valid (that have a valid lifetime of 0). Section-18.3.4
+         * also mentions that server can inform client that it will not extend the prefix by setting
+         * T1 and T2 to values equal to the valid lifetime, so in this case client has no point in
+         * renewing as well.
+         */
+        public List<IaPrefixOption> getRenewableIaPrefixes() {
+            final List<IaPrefixOption> toBeRenewed = getValidIaPrefixes();
+            toBeRenewed.removeIf(ipo -> ipo.preferred == 0 && ipo.valid == 0);
+            toBeRenewed.removeIf(ipo -> t1 == ipo.valid && t2 == ipo.valid);
+            return toBeRenewed;
+        }
+    }
+
+    /**
+     * DHCPv6 packet parsing exception.
+     */
+    public static class ParseException extends Exception {
+        ParseException(String msg) {
+            super(msg);
+        }
+    }
+
+    private static String statusCodeToString(short statusCode) {
+        switch (statusCode) {
+            case STATUS_SUCCESS:
+                return "Success";
+            case STATUS_UNSPEC_FAIL:
+                return "UnspecFail";
+            case STATUS_NO_ADDRS_AVAIL:
+                return "NoAddrsAvail";
+            case STATUS_NO_BINDING:
+                return "NoBinding";
+            case STATUS_NOT_ONLINK:
+                return "NotOnLink";
+            case STATUS_USE_MULTICAST:
+                return "UseMulticast";
+            case STATUS_NO_PREFIX_AVAIL:
+                return "NoPrefixAvail";
+            default:
+                return "Unknown";
+        }
+    }
+
+    private static void skipOption(@NonNull final ByteBuffer packet, int optionLen)
+            throws BufferUnderflowException {
+        for (int i = 0; i < optionLen; i++) {
+            packet.get();
+        }
+    }
+
+    /**
+     * Creates a concrete Dhcp6Packet from the supplied ByteBuffer.
+     *
+     * The buffer only starts with a UDP encapsulation (i.e. DHCPv6 message). A subset of the
+     * optional parameters are parsed and are stored in object fields. Client/Server message
+     * format:
+     *
+     *  0                   1                   2                   3
+     *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+     * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+     * |    msg-type   |               transaction-id                  |
+     * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+     * |                                                               |
+     * .                            options                            .
+     * .                 (variable number and length)                  .
+     * |                                                               |
+     * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+     */
+    private static Dhcp6Packet decode(@NonNull final ByteBuffer packet) throws ParseException {
+        int elapsedTime = 0;
+        byte[] iapd = null;
+        byte[] serverDuid = null;
+        byte[] clientDuid = null;
+        short statusCode = STATUS_SUCCESS;
+        boolean rapidCommit = false;
+        int solMaxRt = 0;
+        PrefixDelegation pd = null;
+
+        packet.order(ByteOrder.BIG_ENDIAN);
+
+        // DHCPv6 message contents.
+        final int msgTypeAndTransId = packet.getInt();
+        final byte messageType = (byte) (msgTypeAndTransId >> 24);
+        final int transId = msgTypeAndTransId & 0xffffff;
+
+        /**
+         * Parse DHCPv6 options, option format:
+         *
+         * 0                   1                   2                   3
+         * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+         * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+         * |          option-code          |           option-len          |
+         * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+         * |                          option-data                          |
+         * |                      (option-len octets)                      |
+         * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+         */
+        while (packet.hasRemaining()) {
+            try {
+                final short optionType = packet.getShort();
+                final int optionLen = packet.getShort() & 0xFFFF;
+                int expectedLen = 0;
+
+                switch(optionType) {
+                    case DHCP6_SERVER_IDENTIFIER:
+                        expectedLen = optionLen;
+                        final byte[] sduid = new byte[expectedLen];
+                        packet.get(sduid, 0 /* offset */, expectedLen);
+                        serverDuid = sduid;
+                        break;
+                    case DHCP6_CLIENT_IDENTIFIER:
+                        expectedLen = optionLen;
+                        final byte[] cduid = new byte[expectedLen];
+                        packet.get(cduid, 0 /* offset */, expectedLen);
+                        clientDuid = cduid;
+                        break;
+                    case DHCP6_IA_PD:
+                        expectedLen = optionLen;
+                        final byte[] bytes = new byte[expectedLen];
+                        packet.get(bytes, 0 /* offset */, expectedLen);
+                        iapd = bytes;
+                        pd = PrefixDelegation.decode(ByteBuffer.wrap(iapd));
+                        break;
+                    case DHCP6_RAPID_COMMIT:
+                        expectedLen = 0;
+                        rapidCommit = true;
+                        break;
+                    case DHCP6_ELAPSED_TIME:
+                        expectedLen = 2;
+                        elapsedTime = (int) (packet.getShort() & 0xFFFF);
+                        break;
+                    case DHCP6_STATUS_CODE:
+                        expectedLen = optionLen;
+                        statusCode = packet.getShort();
+                        // Skip the status message (if any), which is a UTF-8 encoded text string
+                        // suitable for display to the end user, but is not useful for Dhcp6Client
+                        // to decide how to properly handle the status code.
+                        if (optionLen - 2 > 0) {
+                            skipOption(packet, optionLen - 2);
+                        }
+                        break;
+                    case DHCP6_SOL_MAX_RT:
+                        expectedLen = 4;
+                        solMaxRt = packet.getInt();
+                        break;
+                    default:
+                        expectedLen = optionLen;
+                        // BufferUnderflowException will be thrown if option is truncated.
+                        skipOption(packet, optionLen);
+                        break;
+                }
+                if (expectedLen != optionLen) {
+                    throw new ParseException(
+                            "Invalid length " + optionLen + " for option " + optionType
+                                    + ", expected " + expectedLen);
+                }
+            } catch (BufferUnderflowException e) {
+                throw new ParseException(e.getMessage());
+            }
+        }
+
+        Dhcp6Packet newPacket;
+
+        switch(messageType) {
+            case DHCP6_MESSAGE_TYPE_SOLICIT:
+                newPacket = new Dhcp6SolicitPacket(transId, elapsedTime, clientDuid, iapd,
+                        rapidCommit);
+                break;
+            case DHCP6_MESSAGE_TYPE_ADVERTISE:
+                newPacket = new Dhcp6AdvertisePacket(transId, clientDuid, serverDuid, iapd);
+                break;
+            case DHCP6_MESSAGE_TYPE_REQUEST:
+                newPacket = new Dhcp6RequestPacket(transId, elapsedTime, clientDuid, serverDuid,
+                        iapd);
+                break;
+            case DHCP6_MESSAGE_TYPE_REPLY:
+                newPacket = new Dhcp6ReplyPacket(transId, clientDuid, serverDuid, iapd,
+                        rapidCommit);
+                break;
+            case DHCP6_MESSAGE_TYPE_RENEW:
+                newPacket = new Dhcp6RenewPacket(transId, elapsedTime, clientDuid, serverDuid,
+                        iapd);
+                break;
+            case DHCP6_MESSAGE_TYPE_REBIND:
+                newPacket = new Dhcp6RebindPacket(transId, elapsedTime, clientDuid, iapd);
+                break;
+            default:
+                throw new ParseException("Unimplemented DHCP6 message type %d" + messageType);
+        }
+
+        if (pd != null) {
+            newPacket.mPrefixDelegation = pd;
+            newPacket.mIaId = pd.iaid;
+        }
+        newPacket.mStatusCode = statusCode;
+        newPacket.mRapidCommit = rapidCommit;
+        newPacket.mSolMaxRt =
+                (solMaxRt >= 60 && solMaxRt <= 86400)
+                        ? OptionalInt.of(solMaxRt * 1000)
+                        : OptionalInt.empty();
+
+        return newPacket;
+    }
+
+    /**
+     * Parse a packet from an array of bytes, stopping at the given length.
+     */
+    public static Dhcp6Packet decode(@NonNull final byte[] packet, int length)
+            throws ParseException {
+        final ByteBuffer buffer = ByteBuffer.wrap(packet, 0, length).order(ByteOrder.BIG_ENDIAN);
+        return decode(buffer);
+    }
+
+    /**
+     * Follow RFC8415 section 18.2.9 and 18.2.10 to check if the received DHCPv6 message is valid.
+     */
+    public boolean isValid(int transId, @NonNull final byte[] clientDuid) {
+        if (mClientDuid == null) {
+            Log.e(TAG, "DHCPv6 message without Client DUID option");
+            return false;
+        }
+        if (!Arrays.equals(mClientDuid, clientDuid)) {
+            Log.e(TAG, "Unexpected client DUID " + HexDump.toHexString(mClientDuid)
+                    + ", expected " + HexDump.toHexString(clientDuid));
+            return false;
+        }
+        if (mTransId != transId) {
+            Log.e(TAG, "Unexpected transaction ID " + mTransId + ", expected " + transId);
+            return false;
+        }
+        if (mPrefixDelegation == null) {
+            Log.e(TAG, "DHCPv6 message without IA_PD option, ignoring");
+            return false;
+        }
+        if (!mPrefixDelegation.isValid()) {
+            Log.e(TAG, "DHCPv6 message takes invalid IA_PD option, ignoring");
+            return false;
+        }
+        //TODO: check if the status code is success or not.
+        return true;
+    }
+
+    /**
+     * Returns the client DUID, follows RFC 8415 and creates a client DUID
+     * based on the link-layer address(DUID-LL).
+     *
+     * TODO: use Struct to build and parse DUID.
+     *
+     * 0                   1                   2                   3
+     * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+     * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+     * |         DUID-Type (3)         |    hardware type (16 bits)    |
+     * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+     * .                                                               .
+     * .             link-layer address (variable length)              .
+     * .                                                               .
+     * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+     */
+    public static byte[] createClientDuid(@NonNull final MacAddress macAddress) {
+        final byte[] duid = new byte[10];
+        // type: Link-layer address(3)
+        duid[0] = (byte) 0x00;
+        duid[1] = (byte) 0x03;
+        // hardware type: Ethernet(1)
+        duid[2] = (byte) 0x00;
+        duid[3] = (byte) 0x01;
+        System.arraycopy(macAddress.toByteArray() /* src */, 0 /* srcPos */, duid /* dest */,
+                4 /* destPos */, 6 /* length */);
+        return duid;
+    }
+
+    /**
+     * Adds an optional parameter containing an array of bytes.
+     */
+    protected static void addTlv(ByteBuffer buf, short type, @NonNull byte[] payload) {
+        if (payload.length > DHCP_MAX_OPTION_LEN) {
+            throw new IllegalArgumentException("DHCP option too long: "
+                    + payload.length + " vs. " + DHCP_MAX_OPTION_LEN);
+        }
+        buf.putShort(type);
+        buf.putShort((short) payload.length);
+        buf.put(payload);
+    }
+
+    /**
+     * Adds an optional parameter containing a short integer.
+     */
+    protected static void addTlv(ByteBuffer buf, short type, short value) {
+        buf.putShort(type);
+        buf.putShort((short) 2);
+        buf.putShort(value);
+    }
+
+    /**
+     * Adds an optional parameter containing zero-length value.
+     */
+    protected static void addTlv(ByteBuffer buf, short type) {
+        buf.putShort(type);
+        buf.putShort((short) 0);
+    }
+
+    /**
+     * Builds a DHCPv6 SOLICIT packet from the required specified parameters.
+     */
+    public static ByteBuffer buildSolicitPacket(int transId, long millisecs,
+            @NonNull final byte[] iapd, @NonNull final byte[] clientDuid, boolean rapidCommit) {
+        final Dhcp6SolicitPacket pkt =
+                new Dhcp6SolicitPacket(transId, (int) (millisecs / 10) /* elapsed time */,
+                        clientDuid, iapd, rapidCommit);
+        return pkt.buildPacket();
+    }
+
+    /**
+     * Builds a DHCPv6 ADVERTISE packet from the required specified parameters.
+     */
+    public static ByteBuffer buildAdvertisePacket(int transId, @NonNull final byte[] iapd,
+            @NonNull final byte[] clientDuid, @NonNull final byte[] serverDuid) {
+        final Dhcp6AdvertisePacket pkt =
+                new Dhcp6AdvertisePacket(transId, clientDuid, serverDuid, iapd);
+        return pkt.buildPacket();
+    }
+
+    /**
+     * Builds a DHCPv6 REPLY packet from the required specified parameters.
+     */
+    public static ByteBuffer buildReplyPacket(int transId, @NonNull final byte[] iapd,
+            @NonNull final byte[] clientDuid, @NonNull final byte[] serverDuid,
+            boolean rapidCommit) {
+        final Dhcp6ReplyPacket pkt =
+                new Dhcp6ReplyPacket(transId, clientDuid, serverDuid, iapd, rapidCommit);
+        return pkt.buildPacket();
+    }
+
+    /**
+     * Builds a DHCPv6 REQUEST packet from the required specified parameters.
+     */
+    public static ByteBuffer buildRequestPacket(int transId, long millisecs,
+            @NonNull final byte[] iapd, @NonNull final byte[] clientDuid,
+            @NonNull final byte[] serverDuid) {
+        final Dhcp6RequestPacket pkt =
+                new Dhcp6RequestPacket(transId, (int) (millisecs / 10) /* elapsed time */,
+                        clientDuid, serverDuid, iapd);
+        return pkt.buildPacket();
+    }
+
+    /**
+     * Builds a DHCPv6 RENEW packet from the required specified parameters.
+     */
+    public static ByteBuffer buildRenewPacket(int transId, long millisecs,
+            @NonNull final byte[] iapd, @NonNull final byte[] clientDuid,
+            @NonNull final byte[] serverDuid) {
+        final Dhcp6RenewPacket pkt =
+                new Dhcp6RenewPacket(transId, (int) (millisecs / 10) /* elapsed time */, clientDuid,
+                        serverDuid, iapd);
+        return pkt.buildPacket();
+    }
+
+    /**
+     * Builds a DHCPv6 REBIND packet from the required specified parameters.
+     */
+    public static ByteBuffer buildRebindPacket(int transId, long millisecs,
+            @NonNull final byte[] iapd, @NonNull final byte[] clientDuid) {
+        final Dhcp6RebindPacket pkt = new Dhcp6RebindPacket(transId,
+                (int) (millisecs / 10) /* elapsed time */, clientDuid, iapd);
+        return pkt.buildPacket();
+    }
+}
diff --git a/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6RebindPacket.java b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6RebindPacket.java
new file mode 100644
index 0000000000..87f2f45b0a
--- /dev/null
+++ b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6RebindPacket.java
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.net.dhcp6;
+
+import static com.android.net.module.util.NetworkStackConstants.DHCP_MAX_LENGTH;
+
+import androidx.annotation.NonNull;
+
+import java.nio.ByteBuffer;
+
+/**
+ * DHCPv6 REBIND packet class, a client sends a Rebind message to any available server to extend
+ * the lifetimes on the leases assigned to the client and to update other configuration parameters.
+ * This message is sent after a client receives no response to a Renew message.
+ *
+ * https://tools.ietf.org/html/rfc8415#page-24
+ */
+public class Dhcp6RebindPacket extends Dhcp6Packet {
+    /**
+     * Generates a rebind packet with the specified parameters.
+     */
+    Dhcp6RebindPacket(int transId, int elapsedTime, @NonNull final byte[] clientDuid,
+            @NonNull final byte[] iapd) {
+        super(transId, elapsedTime, clientDuid, null /* serverDuid */, iapd);
+    }
+
+    /**
+     * Build a DHCPv6 Rebind message with the specific parameters.
+     */
+    public ByteBuffer buildPacket() {
+        final ByteBuffer packet = ByteBuffer.allocate(DHCP_MAX_LENGTH);
+        final int msgTypeAndTransId = (DHCP6_MESSAGE_TYPE_REBIND << 24) | mTransId;
+        packet.putInt(msgTypeAndTransId);
+
+        addTlv(packet, DHCP6_CLIENT_IDENTIFIER, getClientDuid());
+        addTlv(packet, DHCP6_ELAPSED_TIME, (short) (mElapsedTime & 0xFFFF));
+        addTlv(packet, DHCP6_IA_PD, mIaPd);
+
+        packet.flip();
+        return packet;
+    }
+}
diff --git a/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6RenewPacket.java b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6RenewPacket.java
new file mode 100644
index 0000000000..8c6686c7f6
--- /dev/null
+++ b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6RenewPacket.java
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.net.dhcp6;
+
+import static com.android.net.module.util.NetworkStackConstants.DHCP_MAX_LENGTH;
+
+import androidx.annotation.NonNull;
+
+import java.nio.ByteBuffer;
+
+/**
+ * DHCPv6 RENEW packet class, a client sends an Renew message to the server that originally
+ * provided the client's leases and configuration parameters to extend the lifetimes on the
+ * leases assigned to the client and to update other configuration parameters.
+ *
+ * https://tools.ietf.org/html/rfc8415#page-24
+ */
+public class Dhcp6RenewPacket extends Dhcp6Packet {
+    /**
+     * Generates a renew packet with the specified parameters.
+     */
+    Dhcp6RenewPacket(int transId, int elapsedTime, @NonNull final byte[] clientDuid,
+            @NonNull final byte[] serverDuid, final byte[] iapd) {
+        super(transId, elapsedTime, clientDuid, serverDuid, iapd);
+    }
+
+    /**
+     * Build a DHCPv6 Renew message with the specific parameters.
+     */
+    public ByteBuffer buildPacket() {
+        final ByteBuffer packet = ByteBuffer.allocate(DHCP_MAX_LENGTH);
+        final int msgTypeAndTransId = (DHCP6_MESSAGE_TYPE_RENEW << 24) | mTransId;
+        packet.putInt(msgTypeAndTransId);
+
+        addTlv(packet, DHCP6_SERVER_IDENTIFIER, mServerDuid);
+        addTlv(packet, DHCP6_CLIENT_IDENTIFIER, mClientDuid);
+        addTlv(packet, DHCP6_ELAPSED_TIME, (short) (mElapsedTime & 0xFFFF));
+        addTlv(packet, DHCP6_IA_PD, mIaPd);
+
+        packet.flip();
+        return packet;
+    }
+}
diff --git a/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6ReplyPacket.java b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6ReplyPacket.java
new file mode 100644
index 0000000000..d68fbdb733
--- /dev/null
+++ b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6ReplyPacket.java
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.net.dhcp6;
+
+import static com.android.net.module.util.NetworkStackConstants.DHCP_MAX_LENGTH;
+
+import androidx.annotation.NonNull;
+
+import java.nio.ByteBuffer;
+
+/**
+ * DHCPv6 REPLY packet class, a server sends an Reply message containing assigned leases
+ * and configuration parameters in response to a Solicit, Request, Renew or Rebind messages
+ * received from a client.
+ *
+ * https://tools.ietf.org/html/rfc8415#page-24
+ */
+public class Dhcp6ReplyPacket extends Dhcp6Packet {
+    /**
+     * Generates a reply packet with the specified parameters.
+     */
+    Dhcp6ReplyPacket(int transId, @NonNull final byte[] clientDuid,
+            @NonNull final byte[] serverDuid, final byte[] iapd, boolean rapidCommit) {
+        super(transId, 0 /* elapsedTime */, clientDuid, serverDuid, iapd);
+        mRapidCommit = rapidCommit;
+    }
+
+    /**
+     * Build a DHCPv6 Reply message with the specific parameters.
+     */
+    public ByteBuffer buildPacket() {
+        final ByteBuffer packet = ByteBuffer.allocate(DHCP_MAX_LENGTH);
+        final int msgTypeAndTransId = (DHCP6_MESSAGE_TYPE_REPLY << 24) | mTransId;
+        packet.putInt(msgTypeAndTransId);
+
+        addTlv(packet, DHCP6_CLIENT_IDENTIFIER, mClientDuid);
+        addTlv(packet, DHCP6_SERVER_IDENTIFIER, mServerDuid);
+        addTlv(packet, DHCP6_IA_PD, mIaPd);
+        if (mRapidCommit) {
+            addTlv(packet, DHCP6_RAPID_COMMIT);
+        }
+
+        packet.flip();
+        return packet;
+    }
+}
diff --git a/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6RequestPacket.java b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6RequestPacket.java
new file mode 100644
index 0000000000..6d4dfdf1d9
--- /dev/null
+++ b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6RequestPacket.java
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.net.dhcp6;
+
+import static com.android.net.module.util.NetworkStackConstants.DHCP_MAX_LENGTH;
+
+import androidx.annotation.NonNull;
+
+import java.nio.ByteBuffer;
+
+/**
+ * DHCPv6 REQUEST packet class, a client sends a Request message to request configuration
+ * parameters, including addresses and/or delegated prefixes from a specific server.
+ *
+ * https://tools.ietf.org/html/rfc8415#page-24
+ */
+public class Dhcp6RequestPacket extends Dhcp6Packet {
+    /**
+     * Generates a request packet with the specified parameters.
+     */
+    Dhcp6RequestPacket(int transId, int elapsedTime, @NonNull final byte[] clientDuid,
+            @NonNull final byte[] serverDuid, final byte[] iapd) {
+        super(transId, elapsedTime, clientDuid, serverDuid, iapd);
+    }
+
+    /**
+     * Build a DHCPv6 Request message with the specific parameters.
+     */
+    public ByteBuffer buildPacket() {
+        final ByteBuffer packet = ByteBuffer.allocate(DHCP_MAX_LENGTH);
+        final int msgTypeAndTransId = (DHCP6_MESSAGE_TYPE_REQUEST << 24) | mTransId;
+        packet.putInt(msgTypeAndTransId);
+
+        addTlv(packet, DHCP6_SERVER_IDENTIFIER, mServerDuid);
+        addTlv(packet, DHCP6_CLIENT_IDENTIFIER, mClientDuid);
+        addTlv(packet, DHCP6_ELAPSED_TIME, (short) (mElapsedTime & 0xFFFF));
+        addTlv(packet, DHCP6_IA_PD, mIaPd);
+        addTlv(packet, DHCP6_OPTION_REQUEST_OPTION, DHCP6_SOL_MAX_RT);
+
+        packet.flip();
+        return packet;
+    }
+}
diff --git a/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6SolicitPacket.java b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6SolicitPacket.java
new file mode 100644
index 0000000000..5cf5d01375
--- /dev/null
+++ b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6SolicitPacket.java
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.net.dhcp6;
+
+import static com.android.net.module.util.NetworkStackConstants.DHCP_MAX_LENGTH;
+
+import androidx.annotation.NonNull;
+
+import java.nio.ByteBuffer;
+
+/**
+ * DHCPv6 SOLICIT packet class, a client sends a Solicit message to locate DHCPv6 servers.
+ *
+ * https://tools.ietf.org/html/rfc8415#page-24
+ */
+public class Dhcp6SolicitPacket extends Dhcp6Packet {
+    /**
+     * Generates a solicit packet with the specified parameters.
+     */
+    Dhcp6SolicitPacket(int transId, int elapsedTime, @NonNull final byte[] clientDuid,
+            final byte[] iapd, boolean rapidCommit) {
+        super(transId, elapsedTime, clientDuid, null /* serverDuid */, iapd);
+        mRapidCommit = rapidCommit;
+    }
+
+    /**
+     * Build a DHCPv6 Solicit message with the specific parameters.
+     */
+    public ByteBuffer buildPacket() {
+        final ByteBuffer packet = ByteBuffer.allocate(DHCP_MAX_LENGTH);
+        final int msgTypeAndTransId = (DHCP6_MESSAGE_TYPE_SOLICIT << 24) | mTransId;
+        packet.putInt(msgTypeAndTransId);
+
+        addTlv(packet, DHCP6_ELAPSED_TIME, (short) (mElapsedTime & 0xFFFF));
+        addTlv(packet, DHCP6_CLIENT_IDENTIFIER, mClientDuid);
+        addTlv(packet, DHCP6_IA_PD, mIaPd);
+        addTlv(packet, DHCP6_OPTION_REQUEST_OPTION, DHCP6_SOL_MAX_RT);
+        if (mRapidCommit) {
+            addTlv(packet, DHCP6_RAPID_COMMIT);
+        }
+
+        packet.flip();
+        return packet;
+    }
+}

From f5e80bfb70ad50b0b91101be927ba9262541674f Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Thu, 1 May 2025 10:47:02 -0700
Subject: [PATCH 188/377] Add Dhcp6*Packet classes to net-utils-networkstack

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: Ica554c27a648095a23331a9d93cc6bbbcf572cec
---
 staticlibs/Android.bp                                  |  3 +++
 .../net/module/util/dhcp6/Dhcp6AdvertisePacket.java    |  4 +---
 .../com/android/net/module/util/dhcp6/Dhcp6Packet.java | 10 ++++++----
 .../net/module/util/dhcp6/Dhcp6RebindPacket.java       |  4 +---
 .../net/module/util/dhcp6/Dhcp6RenewPacket.java        |  4 +---
 .../net/module/util/dhcp6/Dhcp6ReplyPacket.java        |  4 +---
 .../net/module/util/dhcp6/Dhcp6RequestPacket.java      |  4 +---
 .../net/module/util/dhcp6/Dhcp6SolicitPacket.java      |  4 +---
 8 files changed, 15 insertions(+), 22 deletions(-)

diff --git a/staticlibs/Android.bp b/staticlibs/Android.bp
index 5e01efaa96..00f2f9b338 100644
--- a/staticlibs/Android.bp
+++ b/staticlibs/Android.bp
@@ -86,6 +86,7 @@ java_library {
     name: "net-utils-networkstack",
     srcs: [
         "device/com/android/net/module/util/ProcfsParsingUtils.java",
+        "device/com/android/net/module/util/dhcp6/*.java",
         "framework/com/android/net/module/util/HexDump.java",
     ],
     sdk_version: "module_current",
@@ -99,6 +100,8 @@ java_library {
         "androidx.annotation_annotation",
         "framework-annotations-lib",
         "framework-connectivity.stubs.module_lib",
+        "net-utils-device-common-struct",
+        "net-utils-device-common-struct-base",
     ],
 }
 
diff --git a/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6AdvertisePacket.java b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6AdvertisePacket.java
index 263ab5ff04..57dfb07c3c 100644
--- a/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6AdvertisePacket.java
+++ b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6AdvertisePacket.java
@@ -14,9 +14,7 @@
  * limitations under the License.
  */
 
-package android.net.dhcp6;
-
-import static com.android.net.module.util.NetworkStackConstants.DHCP_MAX_LENGTH;
+package com.android.net.module.util.dhcp6;
 
 import androidx.annotation.NonNull;
 
diff --git a/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java
index ff7b036d61..29c25556ff 100644
--- a/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java
+++ b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java
@@ -14,9 +14,7 @@
  * limitations under the License.
  */
 
-package android.net.dhcp6;
-
-import static com.android.net.module.util.NetworkStackConstants.DHCP_MAX_OPTION_LEN;
+package com.android.net.module.util.dhcp6;
 
 import android.net.MacAddress;
 import android.util.Log;
@@ -24,7 +22,7 @@ import android.util.Log;
 import androidx.annotation.NonNull;
 
 import com.android.internal.annotations.VisibleForTesting;
-import com.android.internal.util.HexDump;
+import com.android.net.module.util.HexDump;
 import com.android.net.module.util.Struct;
 import com.android.net.module.util.structs.IaPdOption;
 import com.android.net.module.util.structs.IaPrefixOption;
@@ -47,6 +45,10 @@ import java.util.OptionalInt;
  */
 public class Dhcp6Packet {
     private static final String TAG = Dhcp6Packet.class.getSimpleName();
+    /** DHCP constants copied from NetworkStackConstants.java */
+    protected static final int DHCP_MAX_LENGTH = 1500;
+    protected static final int DHCP_MAX_OPTION_LEN = 255;
+
     /**
      * DHCPv6 Message Type.
      */
diff --git a/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6RebindPacket.java b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6RebindPacket.java
index 87f2f45b0a..5f795fe37a 100644
--- a/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6RebindPacket.java
+++ b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6RebindPacket.java
@@ -14,9 +14,7 @@
  * limitations under the License.
  */
 
-package android.net.dhcp6;
-
-import static com.android.net.module.util.NetworkStackConstants.DHCP_MAX_LENGTH;
+package com.android.net.module.util.dhcp6;
 
 import androidx.annotation.NonNull;
 
diff --git a/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6RenewPacket.java b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6RenewPacket.java
index 8c6686c7f6..7dc7267959 100644
--- a/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6RenewPacket.java
+++ b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6RenewPacket.java
@@ -14,9 +14,7 @@
  * limitations under the License.
  */
 
-package android.net.dhcp6;
-
-import static com.android.net.module.util.NetworkStackConstants.DHCP_MAX_LENGTH;
+package com.android.net.module.util.dhcp6;
 
 import androidx.annotation.NonNull;
 
diff --git a/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6ReplyPacket.java b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6ReplyPacket.java
index d68fbdb733..74ccee2a60 100644
--- a/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6ReplyPacket.java
+++ b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6ReplyPacket.java
@@ -14,9 +14,7 @@
  * limitations under the License.
  */
 
-package android.net.dhcp6;
-
-import static com.android.net.module.util.NetworkStackConstants.DHCP_MAX_LENGTH;
+package com.android.net.module.util.dhcp6;
 
 import androidx.annotation.NonNull;
 
diff --git a/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6RequestPacket.java b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6RequestPacket.java
index 6d4dfdf1d9..cfb16437db 100644
--- a/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6RequestPacket.java
+++ b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6RequestPacket.java
@@ -14,9 +14,7 @@
  * limitations under the License.
  */
 
-package android.net.dhcp6;
-
-import static com.android.net.module.util.NetworkStackConstants.DHCP_MAX_LENGTH;
+package com.android.net.module.util.dhcp6;
 
 import androidx.annotation.NonNull;
 
diff --git a/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6SolicitPacket.java b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6SolicitPacket.java
index 5cf5d01375..ff86052f64 100644
--- a/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6SolicitPacket.java
+++ b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6SolicitPacket.java
@@ -14,9 +14,7 @@
  * limitations under the License.
  */
 
-package android.net.dhcp6;
-
-import static com.android.net.module.util.NetworkStackConstants.DHCP_MAX_LENGTH;
+package com.android.net.module.util.dhcp6;
 
 import androidx.annotation.NonNull;
 

From a2a1295adca24082525a06042ee63d05a66f3ad7 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Thu, 1 May 2025 11:11:40 -0700
Subject: [PATCH 189/377] Expose a getter for mStatusCode

So it is accessible by the test.

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: Ibc30ede2e6a21e33ad3b4d7f21d03aba54a121ba
---
 .../com/android/net/module/util/dhcp6/Dhcp6Packet.java       | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java
index 29c25556ff..559e8319f9 100644
--- a/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java
+++ b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java
@@ -200,6 +200,11 @@ public class Dhcp6Packet {
         return mSolMaxRt;
     }
 
+    /** Returns the OPTION_STATUS_CODE value as defined in rfc8415#section-21.13 */
+    public Short getStatusCode() {
+        return mStatusCode;
+    }
+
     /**
      * A class to take DHCPv6 IA_PD option allocated from server.
      * https://www.rfc-editor.org/rfc/rfc8415.html#section-21.21

From 00625abeda5d9c903a04ea18215bea1cdfb5f597 Mon Sep 17 00:00:00 2001
From: Junyu Lai <junyulai@google.com>
Date: Tue, 29 Apr 2025 18:25:05 +0800
Subject: [PATCH 190/377] Enforce run on handler thread for
 SatelliteAccessController

This is a no-op refactoring that ensures events are handled
on the handler thread. While this is already the case in
production code, it's not consistently true in the tests.

This change adds the necessary methods for faking events
on the handler thread while maintaining readability in the
tests.

Flag: EXEMPT refactor
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.connectivity.SatelliteAccessControllerTest \
      --update-device
Bug: 410731080
Change-Id: I816233a823314c4c276138438bbaf33f781eccfe
---
 .../SatelliteAccessController.java            |  12 ++
 .../SatelliteAccessControllerTest.kt          | 130 ++++++++++--------
 2 files changed, 82 insertions(+), 60 deletions(-)

diff --git a/service/src/com/android/server/connectivity/SatelliteAccessController.java b/service/src/com/android/server/connectivity/SatelliteAccessController.java
index 3055b27eab..bbbd4aabea 100644
--- a/service/src/com/android/server/connectivity/SatelliteAccessController.java
+++ b/service/src/com/android/server/connectivity/SatelliteAccessController.java
@@ -39,6 +39,7 @@ import com.android.internal.annotations.VisibleForTesting;
 import com.android.internal.util.IndentingPrintWriter;
 import com.android.net.module.util.CollectionUtils;
 import com.android.net.module.util.DeviceConfigUtils;
+import com.android.net.module.util.HandlerUtils;
 import com.android.net.module.util.SharedLog;
 
 import java.util.List;
@@ -52,10 +53,14 @@ import javax.annotation.CheckReturnValue;
  * Tracks the uid of all the default messaging application which are role_sms role and
  * satellite_communication permission complaint and requests ConnectivityService to create multi
  * layer request with satellite internet access support for the default message application.
+ *
+ * Note that this class is not thread safe and should only be accessed on the handler
+ * thread, except {@link #start()}.
  */
 public class SatelliteAccessController {
     private static final String TAG = SatelliteAccessController.class.getSimpleName();
     // Shamelessly copied from telephony/satellite/SatelliteManager.java.
+    // TODO: Import from SatelliteManager when it is available.
     @VisibleForTesting
     public static final String PROPERTY_SATELLITE_DATA_OPTIMIZED =
             "android.telephony.PROPERTY_SATELLITE_DATA_OPTIMIZED";
@@ -93,6 +98,7 @@ public class SatelliteAccessController {
             implements OnRoleHoldersChangedListener {
         @Override
         public void onRoleHoldersChanged(String role, UserHandle userHandle) {
+            HandlerUtils.ensureRunningOnHandlerThread(mConnectivityServiceHandler);
             if (RoleManager.ROLE_SMS.equals(role) && updateSatelliteRoleSmsUids(userHandle)) {
                 mLog.i("ROLE_SMS Change detected ");
                 reportSatelliteNetworkFallbackUids();
@@ -267,6 +273,7 @@ public class SatelliteAccessController {
      */
     public void onUserAddedWithInstalledPackageList(@NonNull UserHandle userHandle,
             @NonNull List<PackageInfo> apps) {
+        HandlerUtils.ensureRunningOnHandlerThread(mConnectivityServiceHandler);
         // Obtain uids with role sms and satellite communication permission for the added user.
         final boolean roleSmsUidsChanged = updateSatelliteRoleSmsUids(userHandle);
 
@@ -297,6 +304,7 @@ public class SatelliteAccessController {
      * @param userHandle The integer userHandle of the removed user. See {@link #EXTRA_USER_HANDLE}.
      */
     public void onUserRemoved(@NonNull UserHandle userHandle) {
+        HandlerUtils.ensureRunningOnHandlerThread(mConnectivityServiceHandler);
         final boolean smsRoleUidsChanged =
                 updateSatelliteRoleSmsUidListOnUserRemoval(userHandle.getIdentifier());
         final boolean satelliteOptInUidsChanged;
@@ -319,6 +327,7 @@ public class SatelliteAccessController {
      * @param uid The uid of the new package.
      */
     public void onPackageAdded(@NonNull final String packageName, final int uid) {
+        HandlerUtils.ensureRunningOnHandlerThread(mConnectivityServiceHandler);
         if (!mSupportConstrainedDataSatelliteOptIn) return;
         if (addSatelliteDataOptInUid(packageName, uid)) {
             reportSatelliteNetworkFallbackUids();
@@ -340,6 +349,7 @@ public class SatelliteAccessController {
      * @param pkgList An array of package names that have become available.
      */
     public void onExternalApplicationsAvailable(String[] pkgList) {
+        HandlerUtils.ensureRunningOnHandlerThread(mConnectivityServiceHandler);
         if (!mSupportConstrainedDataSatelliteOptIn) return;
         if (CollectionUtils.isEmpty(pkgList)) {
             mLog.e("No available external application.");
@@ -367,6 +377,7 @@ public class SatelliteAccessController {
      * @param uid containing the integer uid previously assigned to the package.
      */
     public void onPackageRemoved(@NonNull final String packageName, final int uid) {
+        HandlerUtils.ensureRunningOnHandlerThread(mConnectivityServiceHandler);
         if (!mSupportConstrainedDataSatelliteOptIn) return;
 
         // Scan for all apps sharing the same uid.
@@ -414,6 +425,7 @@ public class SatelliteAccessController {
 
     /** Dump info to dumpsys */
     public void dump(@NonNull IndentingPrintWriter pw) {
+        HandlerUtils.ensureRunningOnHandlerThread(mConnectivityServiceHandler);
         pw.println("SatelliteAccessController:");
         pw.increaseIndent();
         pw.println("SupportConstrainedDataSatelliteOptIn: "
diff --git a/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt b/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt
index 4c157d4370..3bb1c92bf3 100644
--- a/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt
+++ b/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt
@@ -159,13 +159,13 @@ class SatelliteAccessControllerTest {
             RoleManager.ROLE_SMS,
             PRIMARY_USER_HANDLE
         )
-        roleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
         verify(callback, never()).accept(any(), any())
 
         // check DEFAULT_MESSAGING_APP1 is available as satellite network fallback uid
         doReturn(listOf(SMS_APP1))
             .`when`(deps).getRoleHoldersAsUser(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
-        roleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
         verify(callback).accept(setOf(SMS_APP_ID1.toUid(PRIMARY_USER)), emptySet())
 
         // check SMS_APP2 is available as satellite network Fallback uid
@@ -173,7 +173,7 @@ class SatelliteAccessControllerTest {
             RoleManager.ROLE_SMS,
             PRIMARY_USER_HANDLE
         )
-        roleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
         verify(callback).accept(setOf(SMS_APP_ID2.toUid(PRIMARY_USER)), emptySet())
 
         // check no uid is available as satellite network fallback uid
@@ -181,7 +181,7 @@ class SatelliteAccessControllerTest {
             RoleManager.ROLE_SMS,
             PRIMARY_USER_HANDLE
         )
-        roleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
         verify(callback).accept(emptySet(), emptySet())
     }
 
@@ -192,7 +192,7 @@ class SatelliteAccessControllerTest {
             RoleManager.ROLE_SMS,
             PRIMARY_USER_HANDLE
         )
-        roleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
         verify(callback, never()).accept(any(), any())
 
         // Check DEFAULT_MESSAGING_APP1 is not available as satellite network fallback uid
@@ -202,7 +202,7 @@ class SatelliteAccessControllerTest {
             .checkPermission(Manifest.permission.SATELLITE_COMMUNICATION, SMS_APP1)
         doReturn(listOf(SMS_APP1))
             .`when`(deps).getRoleHoldersAsUser(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
-        roleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
         verify(callback, never()).accept(any(), any())
     }
 
@@ -211,10 +211,7 @@ class SatelliteAccessControllerTest {
         startSatelliteAccessController()
         doReturn(listOf(SMS_APP1))
             .`when`(deps).getRoleHoldersAsUser(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
-        roleHolderChangedListener.onRoleHoldersChanged(
-            RoleManager.ROLE_BROWSER,
-            PRIMARY_USER_HANDLE
-        )
+        onRoleHoldersChanged(RoleManager.ROLE_BROWSER, PRIMARY_USER_HANDLE)
         verify(callback, never()).accept(any(), any())
     }
 
@@ -225,13 +222,13 @@ class SatelliteAccessControllerTest {
             RoleManager.ROLE_SMS,
             PRIMARY_USER_HANDLE
         )
-        roleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
         verify(callback, never()).accept(any(), any())
 
         // check SMS_APP1 is available as satellite network fallback uid at primary user
         doReturn(listOf(SMS_APP1))
             .`when`(deps).getRoleHoldersAsUser(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
-        roleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
         verify(callback).accept(setOf(SMS_APP_ID1.toUid(PRIMARY_USER)), emptySet())
 
         // check SMS_APP2 is available as satellite network fallback uid at primary user
@@ -239,7 +236,7 @@ class SatelliteAccessControllerTest {
             RoleManager.ROLE_SMS,
             PRIMARY_USER_HANDLE
         )
-        roleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
         verify(callback).accept(setOf(SMS_APP_ID2.toUid(PRIMARY_USER)), emptySet())
 
         // check SMS_APP1 is available as satellite network fallback uid at secondary user
@@ -247,7 +244,7 @@ class SatelliteAccessControllerTest {
             RoleManager.ROLE_SMS,
             SECONDARY_USER_HANDLE
         )
-        roleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, SECONDARY_USER_HANDLE)
+        onRoleHoldersChanged(RoleManager.ROLE_SMS, SECONDARY_USER_HANDLE)
         verify(callback).accept(
             setOf(SMS_APP_ID2.toUid(PRIMARY_USER), SMS_APP_ID1.toUid(SECONDARY_USER)),
             emptySet()
@@ -258,16 +255,13 @@ class SatelliteAccessControllerTest {
             RoleManager.ROLE_SMS,
             PRIMARY_USER_HANDLE
         )
-        roleHolderChangedListener.onRoleHoldersChanged(
-            RoleManager.ROLE_SMS,
-            PRIMARY_USER_HANDLE
-        )
+        onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
         verify(callback).accept(setOf(SMS_APP_ID1.toUid(SECONDARY_USER)), emptySet())
 
         // check SMS_APP2 is available as satellite network fallback uid at secondary user
         doReturn(listOf(SMS_APP2))
             .`when`(deps).getRoleHoldersAsUser(RoleManager.ROLE_SMS, SECONDARY_USER_HANDLE)
-        roleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, SECONDARY_USER_HANDLE)
+        onRoleHoldersChanged(RoleManager.ROLE_SMS, SECONDARY_USER_HANDLE)
         verify(callback).accept(setOf(SMS_APP_ID2.toUid(SECONDARY_USER)), emptySet())
 
         // check no uid is available as satellite network fallback uid at secondary user
@@ -275,7 +269,7 @@ class SatelliteAccessControllerTest {
             RoleManager.ROLE_SMS,
             SECONDARY_USER_HANDLE
         )
-        roleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, SECONDARY_USER_HANDLE)
+        onRoleHoldersChanged(RoleManager.ROLE_SMS, SECONDARY_USER_HANDLE)
         verify(callback).accept(emptySet(), emptySet())
     }
 
@@ -287,7 +281,7 @@ class SatelliteAccessControllerTest {
             RoleManager.ROLE_SMS,
             PRIMARY_USER_HANDLE
         )
-        roleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
         verify(callback).accept(setOf(SMS_APP_ID2.toUid(PRIMARY_USER)), emptySet())
 
         // check SMS_APP1 is available as satellite network fallback uid at secondary user
@@ -295,14 +289,12 @@ class SatelliteAccessControllerTest {
             RoleManager.ROLE_SMS,
             SECONDARY_USER_HANDLE
         )
-        roleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, SECONDARY_USER_HANDLE)
+        onRoleHoldersChanged(RoleManager.ROLE_SMS, SECONDARY_USER_HANDLE)
         verify(callback).accept(
             setOf(SMS_APP_ID2.toUid(PRIMARY_USER), SMS_APP_ID1.toUid(SECONDARY_USER)),
             emptySet()
         )
-        processOnHandlerThread {
-            satelliteAccessController.onUserRemoved(SECONDARY_USER_HANDLE)
-        }
+        onUserRemoved(SECONDARY_USER_HANDLE)
         verify(callback, times(2)).accept(
             setOf(SMS_APP_ID2.toUid(PRIMARY_USER)),
             emptySet()
@@ -315,6 +307,33 @@ class SatelliteAccessControllerTest {
         return future.get()
     }
 
+    private fun onRoleHoldersChanged(roleName: String, userHandle: UserHandle) =
+        processOnHandlerThread {
+            roleHolderChangedListener.onRoleHoldersChanged(roleName, userHandle)
+        }
+
+    private fun onUserAddedWithInstalledPackageList(
+            userHandle: UserHandle,
+            apps: List<PackageInfo>
+    ) = processOnHandlerThread {
+        satelliteAccessController.onUserAddedWithInstalledPackageList(userHandle, apps)
+    }
+
+    private fun onUserRemoved(userHandle: UserHandle) = processOnHandlerThread {
+        satelliteAccessController.onUserRemoved(userHandle)
+    }
+
+    private fun onPackageAdded(packageName: String, uid: Int) =
+            processOnHandlerThread { satelliteAccessController.onPackageAdded(packageName, uid) }
+
+    private fun onPackageRemoved(packageName: String, uid: Int) =
+            processOnHandlerThread { satelliteAccessController.onPackageRemoved(packageName, uid) }
+
+    private fun onExternalApplicationsAvailable(pkgList: Array<String>) =
+            processOnHandlerThread {
+                satelliteAccessController.onExternalApplicationsAvailable(pkgList)
+            }
+
     private fun startSatelliteAccessController() {
         satelliteAccessController.start()
         // Get registered listener using captor
@@ -352,7 +371,7 @@ class SatelliteAccessControllerTest {
     @Test
     fun testSatelliteOptInUids_onPackageAdded() {
         mockIsSatelliteDataOptimizedApp(TEST_PACKAGE1, true)
-        satelliteAccessController.onPackageAdded(TEST_PACKAGE1, TEST_UID1)
+        onPackageAdded(TEST_PACKAGE1, TEST_UID1)
         verify(callback).accept(emptySet(), setOf(TEST_UID1))
     }
 
@@ -360,7 +379,7 @@ class SatelliteAccessControllerTest {
     @Test
     fun testSatelliteOptInUids_onPackageAdded_ignoresIfNotSatelliteOptimized() {
         mockIsSatelliteDataOptimizedApp(TEST_PACKAGE1, false)
-        satelliteAccessController.onPackageAdded(TEST_PACKAGE1, TEST_UID1)
+        onPackageAdded(TEST_PACKAGE1, TEST_UID1)
         verify(callback, never()).accept(any(), any())
     }
 
@@ -370,9 +389,9 @@ class SatelliteAccessControllerTest {
         mockIsSatelliteDataOptimizedApp(TEST_PACKAGE1, true)
         mockGetPackagesForUid(TEST_UID1, arrayOf(TEST_PACKAGE1))
 
-        satelliteAccessController.onPackageAdded(TEST_PACKAGE1, TEST_UID1)
+        onPackageAdded(TEST_PACKAGE1, TEST_UID1)
         verify(callback).accept(emptySet(), setOf(TEST_UID1))
-        satelliteAccessController.onPackageRemoved(TEST_PACKAGE1, TEST_UID1)
+        onPackageRemoved(TEST_PACKAGE1, TEST_UID1)
         verify(callback).accept(emptySet(), emptySet())
     }
 
@@ -385,14 +404,14 @@ class SatelliteAccessControllerTest {
 
         // Verify uid is not removed if there is still another package shares the same uid.
         val inOrder = inOrder(callback)
-        satelliteAccessController.onPackageAdded(TEST_PACKAGE1, TEST_UID1)
+        onPackageAdded(TEST_PACKAGE1, TEST_UID1)
         inOrder.verify(callback).accept(emptySet(), setOf(TEST_UID1))
-        satelliteAccessController.onPackageRemoved(TEST_PACKAGE1, TEST_UID1)
+        onPackageRemoved(TEST_PACKAGE1, TEST_UID1)
         inOrder.verifyNoMoreInteractions()
 
         // Verify uid is removed if there is no other package with shared uid.
         mockGetPackagesForUid(TEST_UID1, null)
-        satelliteAccessController.onPackageRemoved(TEST_PACKAGE2, TEST_UID1)
+        onPackageRemoved(TEST_PACKAGE2, TEST_UID1)
         inOrder.verify(callback).accept(emptySet(), emptySet())
     }
 
@@ -405,18 +424,16 @@ class SatelliteAccessControllerTest {
         val packageInfo2 = makePackageInfo(TEST_PACKAGE2, TEST_UID2)
 
         val inOrder = inOrder(callback)
-        satelliteAccessController
-                .onUserAddedWithInstalledPackageList(PRIMARY_USER_HANDLE, listOf(packageInfo1))
-        satelliteAccessController
-                .onUserAddedWithInstalledPackageList(SECONDARY_USER_HANDLE, listOf(packageInfo2))
+        onUserAddedWithInstalledPackageList(PRIMARY_USER_HANDLE, listOf(packageInfo1))
+        onUserAddedWithInstalledPackageList(SECONDARY_USER_HANDLE, listOf(packageInfo2))
         inOrder.verify(callback).accept(emptySet(), setOf(TEST_UID1))
         inOrder.verify(callback).accept(emptySet(), setOf(TEST_UID1, TEST_UID2))
 
-        satelliteAccessController.onUserRemoved(SECONDARY_USER_HANDLE)
+        onUserRemoved(SECONDARY_USER_HANDLE)
         // Verify that the app associated with the non-removed user is not removed.
         inOrder.verify(callback).accept(emptySet(), setOf(TEST_UID1))
 
-        satelliteAccessController.onUserRemoved(PRIMARY_USER_HANDLE)
+        onUserRemoved(PRIMARY_USER_HANDLE)
         // Verify everything is removed.
         inOrder.verify(callback).accept(emptySet(), emptySet())
         inOrder.verifyNoMoreInteractions()
@@ -429,12 +446,11 @@ class SatelliteAccessControllerTest {
         val packageInfo1 = makePackageInfo(TEST_PACKAGE1, TEST_UID1)
 
         // Verify nothing changes and nothing crashes.
-        satelliteAccessController
-                .onUserAddedWithInstalledPackageList(PRIMARY_USER_HANDLE, listOf(packageInfo1))
-        satelliteAccessController.onPackageAdded(TEST_PACKAGE1, TEST_UID1)
-        satelliteAccessController.onPackageRemoved(TEST_PACKAGE1, TEST_UID1)
-        satelliteAccessController.onExternalApplicationsAvailable(arrayOf(SMS_APP1, SMS_APP2))
-        satelliteAccessController.onUserRemoved(PRIMARY_USER_HANDLE)
+        onUserAddedWithInstalledPackageList(PRIMARY_USER_HANDLE, listOf(packageInfo1))
+        onPackageAdded(TEST_PACKAGE1, TEST_UID1)
+        onPackageRemoved(TEST_PACKAGE1, TEST_UID1)
+        onExternalApplicationsAvailable(arrayOf(SMS_APP1, SMS_APP2))
+        onUserRemoved(PRIMARY_USER_HANDLE)
         verify(callback, never()).accept(any(), any())
     }
 
@@ -445,12 +461,12 @@ class SatelliteAccessControllerTest {
         // Set SMS_APP1 under primary user as a role-sms Uid.
         doReturn(listOf(SMS_APP1))
                 .`when`(deps).getRoleHoldersAsUser(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
-        roleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
         verify(callback).accept(setOf(SMS_APP_ID1.toUid(PRIMARY_USER)), emptySet())
 
         // Mock another opt-in uid, verify they both reported via the callback.
         mockIsSatelliteDataOptimizedApp(TEST_PACKAGE1, true)
-        satelliteAccessController.onPackageAdded(TEST_PACKAGE1, TEST_UID1)
+        onPackageAdded(TEST_PACKAGE1, TEST_UID1)
         verify(callback).accept(setOf(SMS_APP_ID1.toUid(PRIMARY_USER)), setOf(TEST_UID1))
     }
 
@@ -463,8 +479,7 @@ class SatelliteAccessControllerTest {
                 .`when`(deps).getRoleHoldersAsUser(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
 
         val inOrder = inOrder(callback)
-        satelliteAccessController
-                .onUserAddedWithInstalledPackageList(PRIMARY_USER_HANDLE, listOf(packageInfo1))
+        onUserAddedWithInstalledPackageList(PRIMARY_USER_HANDLE, listOf(packageInfo1))
         // Verify the callback only fired once after both lists are ready.
         inOrder.verify(callback, never())
                 .accept(setOf(SMS_APP_ID1.toUid(PRIMARY_USER)), emptySet())
@@ -483,23 +498,23 @@ class SatelliteAccessControllerTest {
         // However, one opt-in uid is a messaging app and will surprise us later.
         mockIsSatelliteDataOptimizedApp(TEST_PACKAGE1, true)
         mockIsSatelliteDataOptimizedApp(SMS_APP1, true)
-        satelliteAccessController.onPackageAdded(TEST_PACKAGE1, TEST_UID1)
+        onPackageAdded(TEST_PACKAGE1, TEST_UID1)
         inOrder.verify(callback).accept(emptySet(), setOf(TEST_UID1))
-        satelliteAccessController.onPackageAdded(SMS_APP1, smsUid)
+        onPackageAdded(SMS_APP1, smsUid)
         inOrder.verify(callback).accept(emptySet(), setOf(TEST_UID1, smsUid))
 
         // Set SMS_APP1 as a role-sms Uid.
         // Verify the role-sms Uid is excluded from the opt-in Uid list.
         doReturn(listOf(SMS_APP1))
                 .`when`(deps).getRoleHoldersAsUser(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
-        roleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
         inOrder.verify(callback).accept(setOf(smsUid), setOf(TEST_UID1))
 
         // Unset SMS_APP1 as the role-sms Uid.
         // Verify the role-sms Uid is included to the opt-in Uid list again.
         doReturn(emptyList<String>())
                 .`when`(deps).getRoleHoldersAsUser(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
-        roleHolderChangedListener.onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
+        onRoleHoldersChanged(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
         inOrder.verify(callback).accept(emptySet(), setOf(TEST_UID1, smsUid))
     }
 
@@ -511,14 +526,9 @@ class SatelliteAccessControllerTest {
         mockIsSatelliteDataOptimizedApp(SMS_APP2, true)
 
         val inOrder = inOrder(callback)
-        satelliteAccessController
-                .onUserAddedWithInstalledPackageList(PRIMARY_USER_HANDLE, emptyList<PackageInfo>())
-        satelliteAccessController
-                .onUserAddedWithInstalledPackageList(
-                        SECONDARY_USER_HANDLE,
-                    emptyList<PackageInfo>()
-                )
-        satelliteAccessController.onExternalApplicationsAvailable(arrayOf(SMS_APP1, SMS_APP2))
+        onUserAddedWithInstalledPackageList(PRIMARY_USER_HANDLE, emptyList<PackageInfo>())
+        onUserAddedWithInstalledPackageList(SECONDARY_USER_HANDLE, emptyList<PackageInfo>())
+        onExternalApplicationsAvailable(arrayOf(SMS_APP1, SMS_APP2))
         inOrder.verify(callback).accept(emptySet(), setOf(
                 SMS_APP_ID1.toUid(PRIMARY_USER),
                 SMS_APP_ID1.toUid(SECONDARY_USER),

From 0beea1e992197ca52cb871d27ccccc2f2857f907 Mon Sep 17 00:00:00 2001
From: Junyu Lai <junyulai@google.com>
Date: Wed, 30 Apr 2025 16:03:04 +0800
Subject: [PATCH 191/377] Read meta-data instead of property

Currently, the SatelliteAccessController checks if apps are
opt-in via a property tag under the application. This is
incorrect because PROPERTY_SATELLITE_DATA_OPTIMIZED is an
existing, released meta-data usage for Android B and needs
to be preserved.

Flag: EXEMPT flagged with a kill switch
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.connectivity.SatelliteAccessControllerTest \
  --update-device
Bug: 410731080
Change-Id: If09890faf5d208d007179ecc29b7cf16f6fe6ebb
---
 .../SatelliteAccessController.java            | 19 ++++++++++++++-----
 .../SatelliteAccessControllerTest.kt          | 13 ++++++-------
 2 files changed, 20 insertions(+), 12 deletions(-)

diff --git a/service/src/com/android/server/connectivity/SatelliteAccessController.java b/service/src/com/android/server/connectivity/SatelliteAccessController.java
index bbbd4aabea..10f61da088 100644
--- a/service/src/com/android/server/connectivity/SatelliteAccessController.java
+++ b/service/src/com/android/server/connectivity/SatelliteAccessController.java
@@ -28,6 +28,7 @@ import android.content.Context;
 import android.content.pm.ApplicationInfo;
 import android.content.pm.PackageInfo;
 import android.content.pm.PackageManager;
+import android.os.Bundle;
 import android.os.Handler;
 import android.os.UserHandle;
 import android.text.TextUtils;
@@ -82,9 +83,10 @@ public class SatelliteAccessController {
     private final SparseArray<Set<Integer>> mSatelliteRoleSmsUids = new SparseArray<>();
 
     // Set of UIDs that have declared the
-    // {@code android.telephony.PROPERTY_SATELLITE_DATA_OPTIMIZED} property
+    // {@code android.telephony.PROPERTY_SATELLITE_DATA_OPTIMIZED} meta-data
     // with a value of package name in their manifest file. This variable will only be
     // accessed on the handler thread.
+    // See {@link SatelliteManager#PROPERTY_SATELLITE_DATA_OPTIMIZED}.
     private final Set<Integer> mSatelliteDataOptInUids = new ArraySet<>();
 
     private final ArrayMap<UserHandle, PackageManager> mUserPackageManagers = new ArrayMap<>();
@@ -402,16 +404,23 @@ public class SatelliteAccessController {
         final ArraySet<Integer> uids = new ArraySet<>();
         for (PackageInfo app : apps) {
             if (null == app.applicationInfo || app.applicationInfo.uid < 0) continue;
-            if (isSatelliteDataOptimizedApp(app.packageName)) uids.add(app.applicationInfo.uid);
+            if (isSatelliteDataOptimizedApp(app.packageName)) {
+                uids.add(app.applicationInfo.uid);
+            }
         }
         return uids;
     }
 
     private boolean isSatelliteDataOptimizedApp(@NonNull String packageName) {
         try {
-            final PackageManager.Property property = mPackageManager
-                    .getProperty(PROPERTY_SATELLITE_DATA_OPTIMIZED, packageName);
-            return property.isString() && TextUtils.equals(property.getString(), packageName);
+            final ApplicationInfo applicationInfo = mPackageManager.getApplicationInfo(
+                    packageName, PackageManager.GET_META_DATA);
+            final Bundle metaData = applicationInfo.metaData;
+            if (metaData != null) {
+                final String value = metaData.getString(PROPERTY_SATELLITE_DATA_OPTIMIZED);
+                return TextUtils.equals(value, packageName);
+            }
+            return false;
         } catch (PackageManager.NameNotFoundException e) {
             return false;
         }
diff --git a/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt b/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt
index 3bb1c92bf3..0b2e77f633 100644
--- a/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt
+++ b/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt
@@ -24,6 +24,7 @@ import android.content.pm.ApplicationInfo
 import android.content.pm.PackageInfo
 import android.content.pm.PackageManager
 import android.os.Build
+import android.os.Bundle
 import android.os.Handler
 import android.os.Looper
 import android.os.UserHandle
@@ -356,15 +357,13 @@ class SatelliteAccessControllerTest {
     }
 
     private fun mockIsSatelliteDataOptimizedApp(packageName: String, isOptimized: Boolean) {
-        val property = mock(PackageManager.Property::class.java)
-        `when`(property.isString).thenReturn(isOptimized)
+        val appInfo = ApplicationInfo()
         if (isOptimized) {
-            `when`(property.string).thenReturn(packageName)
+            appInfo.metaData = Bundle()
+            appInfo.metaData.putString(PROPERTY_SATELLITE_DATA_OPTIMIZED, packageName)
         }
-        `when`(packageManager.getProperty(
-                eq(PROPERTY_SATELLITE_DATA_OPTIMIZED),
-                eq(packageName)
-        )).thenReturn(property)
+        doReturn(appInfo).`when`(packageManager)
+                .getApplicationInfo(packageName, PackageManager.GET_META_DATA)
     }
 
     @FeatureFlag(name = CONSTRAINED_DATA_SATELLITE_OPTIN)

From 9e74d41f3d3d2b545889274e114ae0f89c35562d Mon Sep 17 00:00:00 2001
From: Yuyang Huang <yuyanghuang@google.com>
Date: Wed, 30 Apr 2025 14:58:03 +0900
Subject: [PATCH 192/377] Make NsdManager.registerService() public API

This commit makes the NsdManager.registerService() API public. This
change will enable developers to implement more customizable mDNS
advertising behavior in their applications.

Bug: 373270045
Test: atest CtsNetTestCases:NsdManagerTest
Flag: com.android.net.flags.mdns_advertising_improvement
API-Coverage-Bug: 415202964
Change-Id: I32359f7265b3597defd57123ecff0deaef0011f8
---
 common/flags.aconfig                            | 8 ++++++++
 framework-t/api/current.txt                     | 1 +
 framework-t/src/android/net/nsd/NsdManager.java | 5 +----
 3 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/common/flags.aconfig b/common/flags.aconfig
index 9589f216ad..af3236cdd9 100644
--- a/common/flags.aconfig
+++ b/common/flags.aconfig
@@ -175,3 +175,11 @@ flag {
   bug: "388774939"
   is_fixed_read_only: true
 }
+
+flag {
+  name: "mdns_advertising_improvement"
+  is_exported: true
+  namespace: "android_core_networking"
+  description: "Flag for MDNS advertising quality, reliability and performance improvement"
+  bug: "373270045"
+}
diff --git a/framework-t/api/current.txt b/framework-t/api/current.txt
index d66482cb16..610ec28d6f 100644
--- a/framework-t/api/current.txt
+++ b/framework-t/api/current.txt
@@ -250,6 +250,7 @@ package android.net.nsd {
     method @RequiresPermission(android.Manifest.permission.ACCESS_NETWORK_STATE) public void discoverServices(@NonNull String, int, @NonNull android.net.NetworkRequest, @NonNull java.util.concurrent.Executor, @NonNull android.net.nsd.NsdManager.DiscoveryListener);
     method public void registerService(android.net.nsd.NsdServiceInfo, int, android.net.nsd.NsdManager.RegistrationListener);
     method public void registerService(@NonNull android.net.nsd.NsdServiceInfo, int, @NonNull java.util.concurrent.Executor, @NonNull android.net.nsd.NsdManager.RegistrationListener);
+    method @FlaggedApi("com.android.net.flags.mdns_advertising_improvement") public void registerService(@NonNull android.net.nsd.AdvertisingRequest, @NonNull java.util.concurrent.Executor, @NonNull android.net.nsd.NsdManager.RegistrationListener);
     method public void registerServiceInfoCallback(@NonNull android.net.nsd.NsdServiceInfo, @NonNull java.util.concurrent.Executor, @NonNull android.net.nsd.NsdManager.ServiceInfoCallback);
     method @Deprecated public void resolveService(android.net.nsd.NsdServiceInfo, android.net.nsd.NsdManager.ResolveListener);
     method @Deprecated public void resolveService(@NonNull android.net.nsd.NsdServiceInfo, @NonNull java.util.concurrent.Executor, @NonNull android.net.nsd.NsdManager.ResolveListener);
diff --git a/framework-t/src/android/net/nsd/NsdManager.java b/framework-t/src/android/net/nsd/NsdManager.java
index 7ba4f91819..d5fa1deabe 100644
--- a/framework-t/src/android/net/nsd/NsdManager.java
+++ b/framework-t/src/android/net/nsd/NsdManager.java
@@ -32,7 +32,6 @@ import android.annotation.SdkConstant.SdkConstantType;
 import android.annotation.SystemApi;
 import android.annotation.SystemService;
 import android.app.compat.CompatChanges;
-import android.compat.annotation.UnsupportedAppUsage;
 import android.content.Context;
 import android.net.ConnectivityManager;
 import android.net.ConnectivityManager.NetworkCallback;
@@ -1354,10 +1353,8 @@ public final class NsdManager {
      * @param listener The listener notifies of a successful registration and is used to
      * unregister this service through a call on {@link #unregisterService}. Cannot be null.
      *
-     * @hide
      */
-//    @FlaggedApi(Flags.ADVERTISE_REQUEST_API)
-    @UnsupportedAppUsage
+    @FlaggedApi(Flags.FLAG_MDNS_ADVERTISING_IMPROVEMENT)
     public void registerService(@NonNull AdvertisingRequest advertisingRequest,
             @NonNull Executor executor,
             @NonNull RegistrationListener listener) {

From 9796d817a8ef94223671ffe9dfe59ba19358cab6 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Thu, 1 May 2025 14:20:46 -0700
Subject: [PATCH 193/377] Remove spurious VisibleForTesting annotation

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I5104b4875159bb9df6a380c846ec01be67a82d2c
---
 .../device/com/android/net/module/util/dhcp6/Dhcp6Packet.java    | 1 -
 1 file changed, 1 deletion(-)

diff --git a/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java
index 559e8319f9..39545a7f7e 100644
--- a/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java
+++ b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java
@@ -166,7 +166,6 @@ public class Dhcp6Packet {
     /**
      * Returns decoded IA_PD options associated with IA_ID.
      */
-    @VisibleForTesting
     public PrefixDelegation getPrefixDelegation() {
         return mPrefixDelegation;
     }

From d69ad204c8ba8b36441b5a0f817ca9fa7269b7a7 Mon Sep 17 00:00:00 2001
From: Android Network Security <noreply@google.com>
Date: Sat, 3 May 2025 10:13:31 -0700
Subject: [PATCH 194/377] Automated log_list.json generation version 53.32

Bug: N/A
Test: N/A
Flag: NONE automatic key rotation
PiperOrigin-RevId: 754379882
Change-Id: Ibbf0d85b70e9f949a37fffe4239ba6a0d93c984f
---
 .../res/raw/ct_public_keys.pem                     | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/service/ServiceConnectivityResources/res/raw/ct_public_keys.pem b/service/ServiceConnectivityResources/res/raw/ct_public_keys.pem
index 40eac2c0d0..50c3802737 100644
--- a/service/ServiceConnectivityResources/res/raw/ct_public_keys.pem
+++ b/service/ServiceConnectivityResources/res/raw/ct_public_keys.pem
@@ -68,3 +68,17 @@ hkTFodvF5ajCQ5maHeIjDkS/Bc/s9CB+/fbSkstDsPMRp/ExyQcEYjKTG5o9Ewyo
 +KGGXS2dSS10Ibl0Zx/S/0ZuZx8ZAxMOIIPpugdkWqHU9thh71dR8zM4KMkEfB8C
 sWLGB1yMuztn9nRUcpiEZTECAwEAAQ==
 -----END PUBLIC KEY-----
+-----BEGIN PUBLIC KEY-----
+MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAwucG90WrpdFHXkJscOBx
+qRMcwfFv8V0+EwTkCK8vIL0t1zRcQNhHD4/vFPxSZoCLMWLy8L0MOI9XWaiKU5Ja
+3bgCk2C1ztzjxUd/CtgDV0T1Cp8Bm+3VUEWaijqRiRhtxlLBqR+b6mng8WnRCyj/
+8bWElFUcdxNOMj1SAtokd9lYsw+XMBZ5G6ajbk7V4Bsh6jSjzdg/Cw8YTVjsWv3V
+M4fkHm9DZJxZEhuXAnuVhbxt3sdNO1cwECk54+lOo4+SH7AN35MdGZnLXWbhku9t
+YtCKMnFvYyKALYakWaHXSTZqi+aoUxU660oEBuDSVXPTKf8GMi/2CWAJE9QYNveV
+M5ws7LXRMssvMkBMN8LX+pQDo34i2d1hZDCfOHnfU2HOeSAzLoiSZSWUZ0ugv+nM
+1mL1zUSxjDmZfQnv8g4L8AuHHQd3wihY0nRjfQUgR/z3efI9fAA3OCEtD7m7byKd
+QsRphXykzPS1O6VuSmm2LyUH2CX5LnQzLhThiwTuoitI0zNotQYRf2B/6pKtpiCs
+Knhj05nsjyuTTIZsSkGrmYLmjU0iKW9GFOy9qGrd4+l222VnZ3tPCKZa57+EehNn
+Tje/6yTk5yCVprVzUzFxFbihRP80X3dgUSkToIWUeeuY76JebbvXJ1z64On77IK0
+eW5XLa/a7tGKzi46iihOp3MCAwEAAQ==
+-----END PUBLIC KEY-----

From 21a4193c7b138c785bf43a8f2a004ef6cb3f383f Mon Sep 17 00:00:00 2001
From: Yuyang Huang <yuyanghuang@google.com>
Date: Sun, 4 May 2025 14:35:44 +0900
Subject: [PATCH 195/377] Format MdnsInterfaceAdvertiserTest with ktlint

Test: TH
Flag: EXEMPT test only change
Change-Id: I1f278dfebb17836ff0a928c08b68a7266ac4d90a
---
 .../mdns/MdnsInterfaceAdvertiserTest.kt       | 105 +++++++++++++-----
 1 file changed, 78 insertions(+), 27 deletions(-)

diff --git a/tests/unit/java/com/android/server/connectivity/mdns/MdnsInterfaceAdvertiserTest.kt b/tests/unit/java/com/android/server/connectivity/mdns/MdnsInterfaceAdvertiserTest.kt
index 629ac6714a..dc62c8474b 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/MdnsInterfaceAdvertiserTest.kt
+++ b/tests/unit/java/com/android/server/connectivity/mdns/MdnsInterfaceAdvertiserTest.kt
@@ -50,11 +50,11 @@ import org.mockito.Mockito.argThat
 import org.mockito.Mockito.doAnswer
 import org.mockito.Mockito.doReturn
 import org.mockito.Mockito.eq
+import org.mockito.Mockito.inOrder
 import org.mockito.Mockito.mock
 import org.mockito.Mockito.never
 import org.mockito.Mockito.times
 import org.mockito.Mockito.verify
-import org.mockito.Mockito.inOrder
 
 private const val LOG_TAG = "testlogtag"
 private const val TIMEOUT_MS = 10_000L
@@ -107,7 +107,8 @@ class MdnsInterfaceAdvertiserTest {
     private val announceCbCaptor = ArgumentCaptor.forClass(PacketRepeaterCallback::class.java)
             as ArgumentCaptor<PacketRepeaterCallback<BaseAnnouncementInfo>>
     private val packetHandlerCaptor = ArgumentCaptor.forClass(
-            MulticastPacketReader.PacketHandler::class.java)
+            MulticastPacketReader.PacketHandler::class.java
+    )
 
     private val probeCb get() = probeCbCaptor.value
     private val announceCb get() = announceCbCaptor.value
@@ -131,14 +132,19 @@ class MdnsInterfaceAdvertiserTest {
     fun setUp() {
         doReturn(repository).`when`(deps).makeRecordRepository(any(), eq(TEST_HOSTNAME), any())
         doReturn(replySender).`when`(deps).makeReplySender(
-                anyString(), any(), any(), any(), any(), any())
+            anyString(),
+            any(),
+            any(),
+            any(),
+            any(),
+            any()
+        )
         doReturn(announcer).`when`(deps).makeMdnsAnnouncer(anyString(), any(), any(), any(), any())
         doReturn(prober).`when`(deps).makeMdnsProber(anyString(), any(), any(), any(), any())
 
         val knownServices = mutableSetOf<Int>()
         doAnswer { inv ->
             knownServices.add(inv.getArgument(0))
-
             -1
         }.`when`(repository).addService(anyInt(), any(), any())
         doAnswer { inv ->
@@ -169,8 +175,11 @@ class MdnsInterfaceAdvertiserTest {
     fun testAddRemoveService() {
         val testAnnouncementInfo = addServiceAndFinishProbing(TEST_SERVICE_ID_1, TEST_SERVICE_1)
 
-        verify(announcer).startSending(TEST_SERVICE_ID_1, testAnnouncementInfo,
-                0L /* initialDelayMs */)
+        verify(announcer).startSending(
+            TEST_SERVICE_ID_1,
+            testAnnouncementInfo,
+            0L /* initialDelayMs */
+        )
 
         thread.waitForIdle(TIMEOUT_MS)
         verify(cb).onServiceProbingSucceeded(advertiser, TEST_SERVICE_ID_1)
@@ -243,7 +252,9 @@ class MdnsInterfaceAdvertiserTest {
         inOrder.verify(prober).stop(TEST_SERVICE_ID_1)
         inOrder.verify(announcer).stop(TEST_SERVICE_ID_1)
         inOrder.verify(announcer).stop(TEST_SERVICE_ID_2)
-        inOrder.verify(announcer).startSending(TEST_SERVICE_ID_2, announcementInfo, 0L /* initialDelayMs */)
+        inOrder.verify(
+            announcer
+        ).startSending(TEST_SERVICE_ID_2, announcementInfo, 0L /* initialDelayMs */)
     }
 
     @Test
@@ -300,8 +311,14 @@ class MdnsInterfaceAdvertiserTest {
     fun testReplyToQuery() {
         addServiceAndFinishProbing(TEST_SERVICE_ID_1, TEST_SERVICE_1)
 
-        val testReply = MdnsReplyInfo(emptyList(), emptyList(), 0, InetSocketAddress(0),
-                InetSocketAddress(0), emptyList())
+        val testReply = MdnsReplyInfo(
+            emptyList(),
+            emptyList(),
+            0,
+            InetSocketAddress(0),
+            InetSocketAddress(0),
+            emptyList()
+        )
         doReturn(testReply).`when`(repository).getReply(any(), any())
 
         // Query obtained with:
@@ -319,8 +336,12 @@ class MdnsInterfaceAdvertiserTest {
         verify(repository).getReply(packetCaptor.capture(), srcCaptor.capture())
 
         assertEquals(src, srcCaptor.value)
-        assertNotSame(src, srcCaptor.value, "src will be reused by the packetHandler, references " +
-                "to it should not be used outside of handlePacket.")
+        assertNotSame(
+            src,
+            srcCaptor.value,
+            "src will be reused by the packetHandler, references " +
+            "to it should not be used outside of handlePacket."
+        )
 
         packetCaptor.value.let {
             assertEquals(1, it.questions.size)
@@ -339,24 +360,45 @@ class MdnsInterfaceAdvertiserTest {
     fun testReplyToQuery_TruncatedBitSet() {
         addServiceAndFinishProbing(TEST_SERVICE_ID_1, TEST_SERVICE_1)
         val src = InetSocketAddress(parseNumericAddress("2001:db8::456"), MdnsConstants.MDNS_PORT)
-        val testReply = MdnsReplyInfo(emptyList(), emptyList(), 400L, InetSocketAddress(0), src,
-                emptyList())
-        val knownAnswersReply = MdnsReplyInfo(emptyList(), emptyList(), 400L, InetSocketAddress(0),
-                src, emptyList())
-        val knownAnswersReply2 = MdnsReplyInfo(emptyList(), emptyList(), 0L, InetSocketAddress(0),
-                src, emptyList())
+        val testReply = MdnsReplyInfo(
+            emptyList(),
+            emptyList(),
+            400L,
+            InetSocketAddress(0),
+            src,
+            emptyList()
+        )
+        val knownAnswersReply = MdnsReplyInfo(
+            emptyList(),
+            emptyList(),
+            400L,
+            InetSocketAddress(0),
+            src,
+            emptyList()
+        )
+        val knownAnswersReply2 = MdnsReplyInfo(
+            emptyList(),
+            emptyList(),
+            0L,
+            InetSocketAddress(0),
+            src,
+            emptyList()
+        )
         doReturn(testReply).`when`(repository).getReply(
                 argThat { pkg -> pkg.questions.size != 0 && pkg.answers.size == 0 &&
                         (pkg.flags and MdnsConstants.FLAG_TRUNCATED) != 0},
-                eq(src))
+                eq(src)
+        )
         doReturn(knownAnswersReply).`when`(repository).getReply(
                 argThat { pkg -> pkg.questions.size == 0 && pkg.answers.size != 0 &&
                         (pkg.flags and MdnsConstants.FLAG_TRUNCATED) != 0},
-                eq(src))
+                eq(src)
+        )
         doReturn(knownAnswersReply2).`when`(repository).getReply(
                 argThat { pkg -> pkg.questions.size == 0 && pkg.answers.size != 0 &&
                         (pkg.flags and MdnsConstants.FLAG_TRUNCATED) == 0},
-                eq(src))
+                eq(src)
+        )
 
         // Query obtained with:
         // scapy.raw(scapy.DNS(
@@ -452,8 +494,10 @@ class MdnsInterfaceAdvertiserTest {
         //    qd = None,
         //    an = scapy.DNSRR(type='TXT', rrname='_testservice._tcp.local'))
         // ).hex().upper()
-        val query = HexDump.hexStringToByteArray("0000010000000001000000000C5F7465737473657276696" +
-                "365045F746370056C6F63616C0000100001000000000000")
+        val query = HexDump.hexStringToByteArray(
+            "0000010000000001000000000C5F7465737473657276696" +
+                "365045F746370056C6F63616C0000100001000000000000"
+        )
         val src = InetSocketAddress(parseNumericAddress("2001:db8::456"), MdnsConstants.MDNS_PORT)
         packetHandler.handlePacket(query, query.size, src)
 
@@ -488,7 +532,9 @@ class MdnsInterfaceAdvertiserTest {
     fun testRenameServiceForConflict() {
         val mockProbingInfo = mock(ProbingInfo::class.java)
         doReturn(mockProbingInfo).`when`(repository).renameServiceForConflict(
-                TEST_SERVICE_ID_1, TEST_SERVICE_1)
+            TEST_SERVICE_ID_1,
+            TEST_SERVICE_1
+        )
 
         advertiser.renameServiceForConflict(TEST_SERVICE_ID_1, TEST_SERVICE_1)
 
@@ -499,8 +545,11 @@ class MdnsInterfaceAdvertiserTest {
     fun testReplaceExitingService() {
         doReturn(TEST_SERVICE_ID_DUPLICATE).`when`(repository)
                 .addService(eq(TEST_SERVICE_ID_DUPLICATE), any(), any())
-        advertiser.addService(TEST_SERVICE_ID_DUPLICATE, TEST_SERVICE_1_SUBTYPE,
-                MdnsAdvertisingOptions.getDefaultOptions())
+        advertiser.addService(
+            TEST_SERVICE_ID_DUPLICATE,
+            TEST_SERVICE_1_SUBTYPE,
+            MdnsAdvertisingOptions.getDefaultOptions()
+        )
         verify(repository).addService(eq(TEST_SERVICE_ID_DUPLICATE), any(), any())
         verify(announcer).stop(TEST_SERVICE_ID_DUPLICATE)
         verify(prober).startProbing(any())
@@ -517,8 +566,10 @@ class MdnsInterfaceAdvertiserTest {
         verify(prober, never()).startProbing(any())
     }
 
-    private fun addServiceAndStartProbing(serviceId: Int, serviceInfo: NsdServiceInfo):
-            ProbingInfo {
+    private fun addServiceAndStartProbing(
+        serviceId: Int,
+        serviceInfo: NsdServiceInfo
+    ): ProbingInfo {
         val testProbingInfo = mock(ProbingInfo::class.java)
         doReturn(serviceId).`when`(testProbingInfo).serviceId
         doReturn(testProbingInfo).`when`(repository).setServiceProbing(serviceId)

From 86b2aed4f4a7412d30ef385acf89ee0b30919cff Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Fri, 2 May 2025 10:14:13 -0700
Subject: [PATCH 196/377] Make NdResponder thread-safe

Note that a new neighbor can still be added while processing a packet,
which may influence the result, though this shouldn't affect tests.

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: If6860f3a52a406bbbbdd323061bfb918f1fb866c
---
 .../com/android/testutils/NdResponder.kt           | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/NdResponder.kt b/staticlibs/testutils/devicetests/com/android/testutils/NdResponder.kt
index a4912f5092..3fae993354 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/NdResponder.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/NdResponder.kt
@@ -19,7 +19,6 @@ package com.android.testutils
 import android.net.IpPrefix
 import android.net.MacAddress
 import android.system.OsConstants.IPPROTO_ICMPV6
-import android.util.ArrayMap
 import android.util.Log
 import com.android.net.module.util.NetworkStackConstants.ETHER_TYPE_IPV6
 import com.android.net.module.util.NetworkStackConstants.ICMPV6_NEIGHBOR_SOLICITATION
@@ -33,6 +32,7 @@ import java.io.FileOutputStream
 import java.io.IOException
 import java.net.Inet6Address
 import java.nio.ByteBuffer
+import java.util.concurrent.ConcurrentHashMap
 import kotlin.random.Random
 
 private const val TAG = "NdResponder"
@@ -67,7 +67,7 @@ class NdResponder(
         val ipAddr: Inet6Address,
         val ra: RaPkt?, // null if neighbor is not a router.
     )
-    private val neighborMap: MutableMap<Inet6Address, NeighborEntry> = ArrayMap()
+    private val neighborMap: ConcurrentHashMap<Inet6Address, NeighborEntry> = ConcurrentHashMap()
 
     constructor(packetReader: PollPacketReader) : this(packetReader, makeRandomPrefix())
 
@@ -84,7 +84,7 @@ class NdResponder(
     }
 
     fun addRouterEntry(mac: MacAddress, ip: Inet6Address, ra: RaPkt) {
-        neighborMap[ip] = NeighborEntry(mac, ip, ra)
+        neighborMap.put(ip, NeighborEntry(mac, ip, ra))
     }
 
     /**
@@ -93,7 +93,7 @@ class NdResponder(
      * @param ip the link-local address of the neighbor.
      */
     fun addNeighborEntry(mac: MacAddress, ip: Inet6Address) {
-        neighborMap[ip] = NeighborEntry(mac, ip, null)
+        neighborMap.put(ip, NeighborEntry(mac, ip, null))
     }
 
     private fun sendPacket(reader: PollPacketReader, packet: ByteArray) {
@@ -107,9 +107,9 @@ class NdResponder(
     }
 
     private fun replyToRouterSolicitation(reader: PollPacketReader, dstMac: MacAddress) {
-        for ((ip, neigh) in neighborMap) {
+        neighborMap.forEach { (ip, neigh) ->
             val ra = neigh.ra
-            if (ra == null) continue
+            if (ra == null) return@forEach // continue
             // TODO: add prefix to neighborMap
             val ether = EtherPkt(src = neigh.macAddr, dst = dstMac)
             val ip6 = Ip6Pkt(src = neigh.ipAddr.hostAddress, dst = "ff02::1")
@@ -124,7 +124,7 @@ class NdResponder(
         dstIp: Inet6Address,
         targetIp: Inet6Address
     ) {
-        val neighbor = neighborMap[targetIp]
+        val neighbor = neighborMap.get(targetIp)
         if (neighbor == null) return
 
         val ether = EtherPkt(dst = dstMac, src = neighbor.macAddr)

From 7f6b86822451acb0756084f1eb32ebc26560bedf Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Fri, 2 May 2025 10:17:09 -0700
Subject: [PATCH 197/377] Add end-to-end test for DHCPv6-PD

This adds the basic structure for a full end-to-end test for DHCPv6-PD
using a tap interface. This tests the interaction between the DHCPv6-PD
client, IpClient, and Netlink callbacks, and the kernel.

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I6e56703187310ceaf6462b41f2e1ab3690faff01
---
 .../src/android/net/Dhcp6PdTest.kt            | 155 ++++++++++++++++++
 1 file changed, 155 insertions(+)
 create mode 100644 tests/integration/src/android/net/Dhcp6PdTest.kt

diff --git a/tests/integration/src/android/net/Dhcp6PdTest.kt b/tests/integration/src/android/net/Dhcp6PdTest.kt
new file mode 100644
index 0000000000..ba7edebbfa
--- /dev/null
+++ b/tests/integration/src/android/net/Dhcp6PdTest.kt
@@ -0,0 +1,155 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License
+ */
+
+package android.net
+
+import android.Manifest.permission.CHANGE_NETWORK_STATE
+import android.net.NetworkCapabilities.NET_CAPABILITY_INTERNET
+import android.net.NetworkCapabilities.NET_CAPABILITY_TRUSTED
+import android.net.NetworkCapabilities.TRANSPORT_ETHERNET
+import android.net.NetworkCapabilities.TRANSPORT_TEST
+import android.net.TestNetworkManager.TestInterfaceRequest
+import android.os.Build
+import android.os.Handler
+import android.os.HandlerThread
+import android.platform.test.annotations.AppModeFull
+import android.provider.DeviceConfig.NAMESPACE_CONNECTIVITY
+import androidx.test.platform.app.InstrumentationRegistry
+import com.android.net.module.util.dhcp6.Dhcp6Packet
+import com.android.net.module.util.dhcp6.Dhcp6SolicitPacket
+import com.android.testutils.AutoCloseTestInterfaceRule
+import com.android.testutils.DevSdkIgnoreRule
+import com.android.testutils.DevSdkIgnoreRunner
+import com.android.testutils.DeviceConfigRule
+import com.android.testutils.EthernetTestInterface
+import com.android.testutils.NdResponder
+import com.android.testutils.RaPkt
+import com.android.testutils.TestableNetworkCallback
+import com.android.testutils.runAsShell
+import java.net.Inet6Address
+import java.net.InetAddress
+import java.nio.ByteBuffer
+import kotlin.test.assertIs
+import kotlin.test.assertNotNull
+import org.junit.After
+import org.junit.Rule
+import org.junit.Test
+import org.junit.runner.RunWith
+
+private const val TAG = "Dhcp6PdTest"
+private const val SHORT_TIMEOUT_MS = 200L
+private const val TIMEOUT_MS = 2000L
+
+private const val DHCP6_PFLAG_CONFIG = "ipclient_dhcpv6_pd_preferred_flag_version"
+
+private val REQUEST: NetworkRequest = NetworkRequest.Builder()
+        .addTransportType(TRANSPORT_ETHERNET)
+        .addTransportType(TRANSPORT_TEST)
+        .removeCapability(NET_CAPABILITY_INTERNET)
+        .removeCapability(NET_CAPABILITY_TRUSTED)
+        .build()
+private val ROUTER_MAC = MacAddress.fromString("01:02:03:04:05:06")
+private val ROUTER_V6 = InetAddress.getByName("fe80::0102:03ff:fe04:0506") as Inet6Address
+
+@AppModeFull(reason = "Instant apps can't access EthernetManager")
+@RunWith(DevSdkIgnoreRunner::class)
+@DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.S_V2)
+class Dhcp6PdTest {
+    private val context = InstrumentationRegistry.getInstrumentation().context
+    private val cm = context.getSystemService(ConnectivityManager::class.java)!!
+    private val handlerThread = HandlerThread("$TAG thread").apply { start() }
+    private val handler = Handler(handlerThread.looper)
+    private val networkCallback = TestableNetworkCallback().also {
+        runAsShell(CHANGE_NETWORK_STATE) {
+            val request = NetworkRequest.Builder()
+                    .addTransportType(TRANSPORT_ETHERNET)
+                    .addTransportType(TRANSPORT_TEST)
+                    .removeCapability(NET_CAPABILITY_INTERNET)
+                    .removeCapability(NET_CAPABILITY_TRUSTED)
+                    .build()
+            cm.requestNetwork(request, it, handler)
+        }
+    }
+
+    @get:Rule(order = 1)
+    val deviceConfigRule = DeviceConfigRule().apply {
+        setConfig(NAMESPACE_CONNECTIVITY, DHCP6_PFLAG_CONFIG, "1")
+    }
+
+    @get:Rule(order = 2)
+    val testInterfaceRule = AutoCloseTestInterfaceRule(context)
+
+    private val iface: EthernetTestInterface
+    init {
+        val req = TestInterfaceRequest.Builder().setTap().build()
+        val tap = testInterfaceRule.createTestInterface(req)
+        iface = EthernetTestInterface(context, handler, tap)
+    }
+    private val localMac = iface.testIface.macAddress!!
+    private val ndResponder = NdResponder(iface.packetReader).apply { start() }
+
+    @After
+    fun tearDown() {
+        cm.unregisterNetworkCallback(networkCallback)
+        // TODO: AutoCloseTestInterfaceRule should destroy associated EthernetTestInterface.
+        iface.destroy()
+        handlerThread.quitSafely()
+        handlerThread.join()
+    }
+
+    private fun eventuallyExpectPacket(predicate: (ByteArray) -> Boolean): ByteArray {
+        val p = iface.packetReader.poll(TIMEOUT_MS) {
+            it != null && predicate(it)
+        }
+        assertNotNull(p)
+        return p
+    }
+
+    private fun isDhcp6Packet(p: ByteArray): Boolean {
+        val bb = ByteBuffer.wrap(p)
+        bb.position(6 + 6)
+        val etherType = bb.getShort()
+        if ((etherType.toInt() and 0xffff) != 0x86dd) return false
+
+        bb.position(14 + 6)
+        val nextHeader = bb.get()
+        if (nextHeader.toInt() != 17) return false
+
+        bb.position(14 + 40 + 2)
+        val dport = bb.getShort()
+        if (dport.toInt() != 547) return false
+
+        return true
+    }
+
+    private inline fun <reified T : Dhcp6Packet> expectDhcp6Packet(): T {
+        val l2bytes = eventuallyExpectPacket(::isDhcp6Packet)
+        val dhcp6bytes = l2bytes.drop(14 + 40 + 8).toByteArray()
+        val packet = Dhcp6Packet.decode(dhcp6bytes, dhcp6bytes.size)
+        assertIs<T>(packet)
+        return packet as T
+    }
+
+    @Test
+    fun testSolicit_triggeredByPflag() {
+        val ra = RaPkt()
+            .addPioOption(prefix = "2001:db8::/64", flags = "LAP")
+            .addRdnssOption(dns = "2001:4860:4860::8888,2001:4860:4860::8844")
+            .addSllaOption("1:2:3:4:5:6")
+        ndResponder.addRouterEntry(ROUTER_MAC, ROUTER_V6, ra)
+        expectDhcp6Packet<Dhcp6SolicitPacket>()
+    }
+}

From 3b88b3cec5c105cd5bd492571814ff380ca87e6e Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Wed, 30 Apr 2025 16:06:26 -0700
Subject: [PATCH 198/377] Add Dhcp6Pkt PacketBuilder support

This adds support for building the Dhcp6Pkt header. Options are added
later.

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I588d8fc6ba68d1132a3beb1b436d8175ac0ae577
---
 .../android/testutils/PacketBuilderUtils.kt   | 42 +++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
index ad9a25cb16..f9173d6e1d 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
@@ -460,6 +460,48 @@ class DataPkt(data: ByteArray) : Packet {
     }
 }
 
+/** Class that facilitates the creation of DHCPv6 packets. */
+class Dhcp6Pkt(
+        private val type: Type,
+        private val transId: Int,
+) : Packet {
+    enum class Type(val value: Byte) {
+        SOLICIT(1),
+        ADVERTISE(2),
+        REQUEST(3),
+        CONFIRM(4),
+        RENEW(5),
+        REBIND(6),
+        REPLY(7),
+        RELEASE(8),
+        DECLINE(9),
+        RECONFIGURE(10),
+        INFORMATION_REQUEST(11), // INFORMATION-REQUEST
+        RELAY_FORW(12),          // RELAY-FORW
+        RELAY_REPL(13);          // RELAY-REPL
+
+        companion object {
+            fun fromString(str: String) = valueOf(str.replace('-', '_'))
+        }
+    }
+
+    constructor(type: String, transId: Int) : this(Type.fromString(type), transId)
+
+    init {
+        require(transId <= 0xffffff)
+    }
+
+    override fun build(payload: FinalizedPacket?, pseudo: PseudoHeaderPacket?): FinalizedPacket {
+        val dhcp6Header = ByteBuffer.allocate(4)
+            .putInt((type.value.toInt() shl 24) or transId)
+        dhcp6Header.flip()
+
+        return object : FinalizedPacket {
+            override val bytes = dhcp6Header.array()
+        }
+    }
+}
+
 /**
  * Class that facilitates the creation of UDP packets.
  *

From 684c48afb0461e87371b934c3c1f2dcf7421ccf1 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Fri, 2 May 2025 11:06:38 -0700
Subject: [PATCH 199/377] Add packet builder support for commonly used DCHPv6
 options

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I38f3250279c85177fc4ce8f44a35ae3883e7a8ae
---
 .../android/testutils/PacketBuilderUtils.kt   | 41 +++++++++++++++++--
 1 file changed, 37 insertions(+), 4 deletions(-)

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
index f9173d6e1d..d65ef8ce9c 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
@@ -487,17 +487,50 @@ class Dhcp6Pkt(
 
     constructor(type: String, transId: Int) : this(Type.fromString(type), transId)
 
+    private val outputStream = ByteArrayOutputStream()
     init {
         require(transId <= 0xffffff)
-    }
-
-    override fun build(payload: FinalizedPacket?, pseudo: PseudoHeaderPacket?): FinalizedPacket {
         val dhcp6Header = ByteBuffer.allocate(4)
             .putInt((type.value.toInt() shl 24) or transId)
         dhcp6Header.flip()
+        outputStream.write(dhcp6Header.array())
+    }
 
+    fun addClientIdentifierOption(duid: ByteArray): Dhcp6Pkt {
+        require(duid.size <= 0xffff)
+        val bb = ByteBuffer.allocate(4 + duid.size)
+                .putShort(1) // OPTION_CLIENTID
+                .putShort(duid.size.toShort())
+                .put(duid)
+        bb.flip()
+        outputStream.write(bb.array())
+        return this
+    }
+
+    fun addServerIdentifierOption(duid: ByteArray): Dhcp6Pkt {
+        require(duid.size <= 0xffff)
+        val bb = ByteBuffer.allocate(4 + duid.size)
+                .putShort(2) // OPTION_SERVERID
+                .putShort(duid.size.toShort())
+                .put(duid)
+        bb.flip()
+        outputStream.write(bb.array())
+        return this
+    }
+
+    fun addSolMaxRtOption(solMaxRt: Int): Dhcp6Pkt {
+        val bb = ByteBuffer.allocate(8)
+                .putShort(82) // OPTION_SOL_MAX_RT
+                .putShort(4)
+                .putInt(solMaxRt)
+        bb.flip()
+        outputStream.write(bb.array())
+        return this
+    }
+
+    override fun build(payload: FinalizedPacket?, pseudo: PseudoHeaderPacket?): FinalizedPacket {
         return object : FinalizedPacket {
-            override val bytes = dhcp6Header.array()
+            override val bytes = outputStream.toByteArray()
         }
     }
 }

From ea3f8b0fb1ebdb7ac3a79450b4cce1035f8bff30 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Fri, 2 May 2025 11:14:54 -0700
Subject: [PATCH 200/377] Add payload support for Dhcp6Pkt

IA_PD options will be modeled as separate packets

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I2841b1d2283fa50bdc664ab865e64f92aba3ce0c
---
 .../devicetests/com/android/testutils/PacketBuilderUtils.kt      | 1 +
 1 file changed, 1 insertion(+)

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
index d65ef8ce9c..a6774013c1 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
@@ -529,6 +529,7 @@ class Dhcp6Pkt(
     }
 
     override fun build(payload: FinalizedPacket?, pseudo: PseudoHeaderPacket?): FinalizedPacket {
+        if (payload != null) outputStream.write(payload.bytes)
         return object : FinalizedPacket {
             override val bytes = outputStream.toByteArray()
         }

From 424655f4975394a9228a7a71ee43b714c0e28a32 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Fri, 2 May 2025 12:15:00 -0700
Subject: [PATCH 201/377] Add IA_PD Option support to packet builder

The IA_PD Option is modeled as a separate "packet", because it can
contain various options itself. It turns out that with the current
packet builder architecture, building nested packets (of which DHCPv6 is
an extreme example) is actually quite difficult. We would encounter
similar problems if we ever were to try and build netlink packets.

One thing that could be done is to add another overload for
PacketBuilder#div that takes another PacketBuilder object, allowing an
syntax such as:

dhcp6_header / dhcp6_rt_sol_max / (dhcp6_ia_pd / dhcp6_ia_prefix)

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I35694627285759dd17d8a8bf5994aaa96e6b391d
---
 .../android/testutils/PacketBuilderUtils.kt   | 53 +++++++++++++++++++
 1 file changed, 53 insertions(+)

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
index a6774013c1..8bbd74a1e2 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
@@ -460,6 +460,59 @@ class DataPkt(data: ByteArray) : Packet {
     }
 }
 
+class Dhcp6IaPdOpt(
+    private val iaid: Int,
+    private val t1: Int = 0,
+    private val t2: Int = 0,
+) : Packet {
+
+    private val outputStream = ByteArrayOutputStream()
+    init {
+        val bb = ByteBuffer.allocate(16)
+                .putShort(25) // OPTION_IA_PD
+                .putShort(0) // Length filled in later
+                .putInt(iaid)
+                .putInt(t1)
+                .putInt(t2)
+        bb.flip()
+        outputStream.write(bb.array())
+    }
+
+    fun addIaPrefixOption(prefix: IpPrefix, preferred: Int, valid: Int): Dhcp6IaPdOpt {
+        val bb = ByteBuffer.allocate(29)
+                .putShort(26) // OPTION_IAPREFIX
+                .putShort(25) // Length without IAprefix-options
+                .putInt(preferred)
+                .putInt(valid)
+                .put(prefix.prefixLength.toByte())
+                .put(prefix.rawAddress)
+        bb.flip()
+        outputStream.write(bb.array())
+        return this
+    }
+
+    fun addIaPrefixOption(prefix: String, preferred: Int = 900, valid: Int = 1800): Dhcp6IaPdOpt {
+        return addIaPrefixOption(IpPrefix(prefix), preferred, valid)
+    }
+
+    override fun build(payload: FinalizedPacket?, pseudo: PseudoHeaderPacket?): FinalizedPacket {
+        // Fix up the length *before* appending payload.
+        val bytes = outputStream.toByteArray()
+        val bb = ByteBuffer.wrap(bytes)
+        bb.position(2)
+        // Note that option-len does not include the type (2 bytes) and len (2 bytes) fields
+        bb.putShort((bytes.size - 4).toShort())
+
+        val tempStream = ByteArrayOutputStream()
+        tempStream.write(bytes)
+        if (payload != null) tempStream.write(payload.bytes)
+
+        return object : FinalizedPacket {
+            override val bytes = tempStream.toByteArray()
+        }
+    }
+}
+
 /** Class that facilitates the creation of DHCPv6 packets. */
 class Dhcp6Pkt(
         private val type: Type,

From bde43b8a72a6ab9cf94d027b181fe7bf1e32995b Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Fri, 2 May 2025 14:21:12 -0700
Subject: [PATCH 202/377] Add packet builder support for rapid commit option

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I4fde592fca440d08f5d07f090d3c9ad45c2c10a1
---
 .../com/android/testutils/PacketBuilderUtils.kt          | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
index 8bbd74a1e2..1c7c50e118 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/PacketBuilderUtils.kt
@@ -581,6 +581,15 @@ class Dhcp6Pkt(
         return this
     }
 
+    fun addRapidCommitOption(): Dhcp6Pkt {
+        val bb = ByteBuffer.allocate(4)
+                .putShort(14) // OPTION_RAPID_COMMIT
+                .putShort(0)
+        bb.flip()
+        outputStream.write(bb.array())
+        return this
+    }
+
     override fun build(payload: FinalizedPacket?, pseudo: PseudoHeaderPacket?): FinalizedPacket {
         if (payload != null) outputStream.write(payload.bytes)
         return object : FinalizedPacket {

From 297945d6612a887db57bf8c64346a7bf7fac7956 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Mon, 5 May 2025 12:22:51 -0700
Subject: [PATCH 203/377] s/IaId/Iaid/ for consistency

rfc8415 calls it IAID, not IA_ID.

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I449ef74e279a832f974d1780e10f3636e7bdaf34
---
 .../com/android/net/module/util/dhcp6/Dhcp6Packet.java | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java
index 39545a7f7e..728106b578 100644
--- a/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java
+++ b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java
@@ -142,7 +142,7 @@ public class Dhcp6Packet {
     /**
      * The unique identifier for IA_NA, IA_TA, IA_PD used in this particular DHCPv6 negotiation
      */
-    protected int mIaId;
+    protected int mIaid;
     // Per rfc8415#section-12, the IAID MUST be consistent across restarts.
     // Since currently only one IAID is supported, a well-known value can be used (0).
     public static final int IAID = 0;
@@ -171,10 +171,10 @@ public class Dhcp6Packet {
     }
 
     /**
-     * Returns IA_ID associated to IA_PD.
+     * Returns IAID associated to IA_PD.
      */
-    public int getIaId() {
-        return mIaId;
+    public int getIaid() {
+        return mIaid;
     }
 
     /**
@@ -566,7 +566,7 @@ public class Dhcp6Packet {
 
         if (pd != null) {
             newPacket.mPrefixDelegation = pd;
-            newPacket.mIaId = pd.iaid;
+            newPacket.mIaid = pd.iaid;
         }
         newPacket.mStatusCode = statusCode;
         newPacket.mRapidCommit = rapidCommit;

From 3db76bdfbc11da0472ce53d4036648d10cee885c Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Mon, 5 May 2025 14:51:43 -0700
Subject: [PATCH 204/377] Test that DHCPv6 provisioning succeeds

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I88421058cd4bf0b982ccb6ae5362e4f037130114
---
 .../src/android/net/Dhcp6PdTest.kt            | 56 ++++++++++++++++---
 1 file changed, 48 insertions(+), 8 deletions(-)

diff --git a/tests/integration/src/android/net/Dhcp6PdTest.kt b/tests/integration/src/android/net/Dhcp6PdTest.kt
index ba7edebbfa..894c3a091d 100644
--- a/tests/integration/src/android/net/Dhcp6PdTest.kt
+++ b/tests/integration/src/android/net/Dhcp6PdTest.kt
@@ -34,10 +34,17 @@ import com.android.testutils.AutoCloseTestInterfaceRule
 import com.android.testutils.DevSdkIgnoreRule
 import com.android.testutils.DevSdkIgnoreRunner
 import com.android.testutils.DeviceConfigRule
+import com.android.testutils.Dhcp6IaPdOpt
+import com.android.testutils.Dhcp6Pkt
+import com.android.testutils.EtherPkt
 import com.android.testutils.EthernetTestInterface
+import com.android.testutils.Ip6Pkt
 import com.android.testutils.NdResponder
+import com.android.testutils.PacketBuilder
 import com.android.testutils.RaPkt
+import com.android.testutils.RecorderCallback.CallbackEntry.Available
 import com.android.testutils.TestableNetworkCallback
+import com.android.testutils.UdpPkt
 import com.android.testutils.runAsShell
 import java.net.Inet6Address
 import java.net.InetAddress
@@ -62,7 +69,11 @@ private val REQUEST: NetworkRequest = NetworkRequest.Builder()
         .removeCapability(NET_CAPABILITY_TRUSTED)
         .build()
 private val ROUTER_MAC = MacAddress.fromString("01:02:03:04:05:06")
-private val ROUTER_V6 = InetAddress.getByName("fe80::0102:03ff:fe04:0506") as Inet6Address
+private val ROUTER_V6 = InetAddress.getByName("fe80::1") as Inet6Address
+private val RA_WITH_PFLAG = RaPkt()
+            .addPioOption(prefix = "2001:db8::/64", flags = "LAP")
+            .addRdnssOption(dns = "2001:4860:4860::8888,2001:4860:4860::8844")
+            .addSllaOption("1:2:3:4:5:6")
 
 @AppModeFull(reason = "Instant apps can't access EthernetManager")
 @RunWith(DevSdkIgnoreRunner::class)
@@ -135,21 +146,50 @@ class Dhcp6PdTest {
         return true
     }
 
-    private inline fun <reified T : Dhcp6Packet> expectDhcp6Packet(): T {
+    private inline fun <reified T : Dhcp6Packet> expectDhcp6Packet(): Pair<Inet6Address, T> {
         val l2bytes = eventuallyExpectPacket(::isDhcp6Packet)
+
+        // Read src v6 address from byte array.
+        val arr = ByteArray(16)
+        val bb = ByteBuffer.wrap(l2bytes)
+        bb.position(14 + 8)
+        bb.get(arr)
+        val srcAddr = InetAddress.getByAddress(arr) as Inet6Address
+
         val dhcp6bytes = l2bytes.drop(14 + 40 + 8).toByteArray()
         val packet = Dhcp6Packet.decode(dhcp6bytes, dhcp6bytes.size)
         assertIs<T>(packet)
-        return packet as T
+        return Pair(srcAddr, packet as T)
+    }
+
+    private fun EthernetTestInterface.sendPacket(p: PacketBuilder) {
+        packetReader.sendResponse(ByteBuffer.wrap(p.build()))
     }
 
     @Test
     fun testSolicit_triggeredByPflag() {
-        val ra = RaPkt()
-            .addPioOption(prefix = "2001:db8::/64", flags = "LAP")
-            .addRdnssOption(dns = "2001:4860:4860::8888,2001:4860:4860::8844")
-            .addSllaOption("1:2:3:4:5:6")
-        ndResponder.addRouterEntry(ROUTER_MAC, ROUTER_V6, ra)
+        ndResponder.addRouterEntry(ROUTER_MAC, ROUTER_V6, RA_WITH_PFLAG)
         expectDhcp6Packet<Dhcp6SolicitPacket>()
+        networkCallback.assertNoCallback()
+    }
+
+    @Test
+    fun testProvisioning_triggeredByPflag() {
+        ndResponder.addRouterEntry(ROUTER_MAC, ROUTER_V6, RA_WITH_PFLAG)
+        val (srcAddr, solicit) = expectDhcp6Packet<Dhcp6SolicitPacket>()
+
+        val ether = EtherPkt(src = ROUTER_MAC, dst = localMac)
+        val ipv6 = Ip6Pkt(src = ROUTER_V6, dst = srcAddr)
+        val udp = UdpPkt(sport = 547, dport = 546)
+        val dhcp6 = Dhcp6Pkt(type = "REPLY", transId = solicit.transactionId)
+                .addRapidCommitOption()
+                .addClientIdentifierOption(solicit.clientDuid)
+                .addServerIdentifierOption(byteArrayOf(1, 2, 3, 4, 5, 6))
+        val dhcp6_pd = Dhcp6IaPdOpt(iaid = solicit.iaid)
+                .addIaPrefixOption(prefix = "2001:db8:1234::/64")
+        val pkt = ether / ipv6 / udp / dhcp6 / dhcp6_pd
+        iface.sendPacket(pkt)
+
+        networkCallback.expect<Available>()
     }
 }

From cfe398a5534d5b286e35dab3fdbaf854ba00af6e Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Fri, 2 May 2025 09:05:29 -0700
Subject: [PATCH 205/377] Clean eventuallyExpect invocations

b/233534110 was fixed, so eventuallyExpect<T>() now also advances the
read head.

Test: TH
Flag: EXEMPT mainline
Bug: 233534110
Change-Id: I5ef830185e58bd30ae4655a2b981e463865298b6
---
 .../net/src/android/net/cts/EthernetManagerTest.kt  | 13 ++++---------
 tests/integration/src/android/net/ClatTest.kt       |  4 +---
 2 files changed, 5 insertions(+), 12 deletions(-)

diff --git a/tests/cts/net/src/android/net/cts/EthernetManagerTest.kt b/tests/cts/net/src/android/net/cts/EthernetManagerTest.kt
index 9065b4e1f9..59e830f648 100644
--- a/tests/cts/net/src/android/net/cts/EthernetManagerTest.kt
+++ b/tests/cts/net/src/android/net/cts/EthernetManagerTest.kt
@@ -535,10 +535,8 @@ class EthernetManagerTest {
         NetworkRequest.Builder(NetworkRequest(ETH_REQUEST))
             .setNetworkSpecifier(EthernetNetworkSpecifier(ifaceName)).build()
 
-    // b/233534110: eventuallyExpect<Lost>() does not advance ReadHead, use
-    // eventuallyExpect(Lost::class) instead.
     private fun TestableNetworkCallback.eventuallyExpectLost(n: Network? = null) =
-        eventuallyExpect(Lost::class) { n?.equals(it.network) ?: true }
+        eventuallyExpect<Lost> { n?.equals(it.network) ?: true }
 
     private fun TestableNetworkCallback.assertNeverLost(n: Network? = null) =
         assertNoCallback { it is Lost && (n?.equals(it.network) ?: true) }
@@ -550,8 +548,7 @@ class EthernetManagerTest {
         expect<CapabilitiesChanged> { it.caps.networkSpecifier == EthernetNetworkSpecifier(name) }
 
     private fun TestableNetworkCallback.eventuallyExpectCapabilities(nc: NetworkCapabilities) {
-        // b/233534110: eventuallyExpect<CapabilitiesChanged>() does not advance ReadHead.
-        eventuallyExpect(CapabilitiesChanged::class) {
+        eventuallyExpect<CapabilitiesChanged> {
             // CS may mix in additional capabilities, so NetworkCapabilities#equals cannot be used.
             // Check if all expected capabilities are present instead.
             it is CapabilitiesChanged && nc.capabilities.all { c -> it.caps.hasCapability(c) }
@@ -561,8 +558,7 @@ class EthernetManagerTest {
     private fun TestableNetworkCallback.eventuallyExpectLpForStaticConfig(
         config: StaticIpConfiguration
     ) {
-        // b/233534110: eventuallyExpect<LinkPropertiesChanged>() does not advance ReadHead.
-        eventuallyExpect(LinkPropertiesChanged::class) {
+        eventuallyExpect<LinkPropertiesChanged> {
             it is LinkPropertiesChanged && it.lp.linkAddresses.any { la ->
                 la.isSameAddressAs(config.ipAddress)
             }
@@ -821,8 +817,7 @@ class EthernetManagerTest {
     fun testNetworkRequest_linkPropertiesUpdate() {
         val iface = createInterface()
         val cb = requestNetwork(ETH_REQUEST)
-        // b/233534110: eventuallyExpect<LinkPropertiesChanged>() does not advance ReadHead
-        cb.eventuallyExpect(LinkPropertiesChanged::class) {
+        cb.eventuallyExpect<LinkPropertiesChanged> {
             it is LinkPropertiesChanged && it.lp.addresses.any {
                 address -> iface.onLinkPrefix.contains(address)
             }
diff --git a/tests/integration/src/android/net/ClatTest.kt b/tests/integration/src/android/net/ClatTest.kt
index 1c279b24ee..5bb67575b6 100644
--- a/tests/integration/src/android/net/ClatTest.kt
+++ b/tests/integration/src/android/net/ClatTest.kt
@@ -129,9 +129,7 @@ class ClatTest {
         // Wait for the clat interface to be created.
         var linkPropertiesChanged: LinkPropertiesChanged
         do {
-            // b/233534110: eventuallyExpect<LinkPropertiesChanged>() does not advance ReadHead, use
-            // eventuallyExpect(LinkProperties::class) instead.
-            linkPropertiesChanged = cb.eventuallyExpect(LinkPropertiesChanged::class)
+            linkPropertiesChanged = cb.eventuallyExpect<LinkPropertiesChanged>()
         } while (linkPropertiesChanged.lp.stackedLinks.isEmpty())
 
         network = linkPropertiesChanged.network

From 37c39d0af6ce631b521d8f53eb1c328c7a7f4b41 Mon Sep 17 00:00:00 2001
From: Paul Hu <paulhu@google.com>
Date: Tue, 6 May 2025 02:39:52 +0000
Subject: [PATCH 206/377] Skip network requests in MultinetworkApiTest for
 instant mode

MultinetworkApiTest would attempt to request cellular and Wi-Fi
network connections in test setup. This requires the
CHANGE_NETWORK_STATE permission, which is not granted to
the instant app. Therefore, skip the network requests if the
tests are running in instant mode.

Bug: 413261962
Test: atest android.net.cts.MultinetworkApiTest --instant
Flag: EXEMPT bug fix
Change-Id: I64366a4f2528402d3050adb54bb0aea352c53088
---
 .../cts/net/src/android/net/cts/MultinetworkApiTest.java  | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/tests/cts/net/src/android/net/cts/MultinetworkApiTest.java b/tests/cts/net/src/android/net/cts/MultinetworkApiTest.java
index 6ae9f1dc5c..14ef98a401 100644
--- a/tests/cts/net/src/android/net/cts/MultinetworkApiTest.java
+++ b/tests/cts/net/src/android/net/cts/MultinetworkApiTest.java
@@ -112,8 +112,12 @@ public class MultinetworkApiTest {
         final Context context = InstrumentationRegistry.getInstrumentation().getContext();
         mCM = context.getSystemService(ConnectivityManager.class);
         mCtsNetUtils = new CtsNetUtils(context);
-        mNetworkCallbackRule.requestCellIfSupported();
-        mNetworkCallbackRule.requestWifiIfSupported();
+        // In instant mode, do not request cell or Wi-Fi connection, as this requires the
+        // CHANGE_NETWORK_STATE permission which cannot be granted.
+        if (!context.getApplicationInfo().isInstantApp()) {
+            mNetworkCallbackRule.requestCellIfSupported();
+            mNetworkCallbackRule.requestWifiIfSupported();
+        }
     }
 
     @Test

From 988d00e57b71d803c517e00836937e0d356e6dc1 Mon Sep 17 00:00:00 2001
From: Junyu Lai <junyulai@google.com>
Date: Mon, 5 May 2025 11:28:56 +0800
Subject: [PATCH 207/377] Use the corresponding PackageManager for different
 users

Currently, isSatelliteDataOptimizedApp utilizes the PackageManager
from the primary user's context. However, if the added package is
not visible to the primary user, the satellite controller will
fail to parse the required information from the AndroidManifest.

Therefore, the corresponding PackageManager should be used when
a package is being checked.

Flag: EXEMPT flagged with a kill switch
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.connectivity.SatelliteAccessControllerTest \
      --update-device
Test: Manual:
      1. Create and setup 2nd user.
      2. adb install --user 10 CtsHostsideSatelliteDataOptimizedWithMetaData.apk
      3. adb shell dumpsys connectivity
      4. adb uninstall com.android.cts.net.hostside.satellitedataoptin.testapp
Bug: 410731080

Change-Id: I7adadb3449ec2ff984e6672ffb97919a2418e9b7
---
 .../SatelliteAccessController.java            | 47 ++++++----
 .../SatelliteAccessControllerTest.kt          | 85 +++++++++++--------
 2 files changed, 80 insertions(+), 52 deletions(-)

diff --git a/service/src/com/android/server/connectivity/SatelliteAccessController.java b/service/src/com/android/server/connectivity/SatelliteAccessController.java
index 10f61da088..6cc7a77592 100644
--- a/service/src/com/android/server/connectivity/SatelliteAccessController.java
+++ b/service/src/com/android/server/connectivity/SatelliteAccessController.java
@@ -74,7 +74,6 @@ public class SatelliteAccessController {
     private final DefaultMessageRoleListener mDefaultMessageRoleListener;
     private final BiConsumer<Set<Integer>, Set<Integer>> mCallback;
     private final Handler mConnectivityServiceHandler;
-    private final PackageManager mPackageManager;
     private final boolean mSupportConstrainedDataSatelliteOptIn;
     private final SharedLog mLog = new SharedLog(MAX_LOG_ENTRIES, TAG);
 
@@ -157,7 +156,6 @@ public class SatelliteAccessController {
         mDefaultMessageRoleListener = new DefaultMessageRoleListener();
         mCallback = callback;
         mConnectivityServiceHandler = connectivityServiceInternalHandler;
-        mPackageManager = mContext.getPackageManager();
         mSupportConstrainedDataSatelliteOptIn = mDeps.supportConstrainedDataSatelliteOptIn(c);
     }
 
@@ -165,7 +163,7 @@ public class SatelliteAccessController {
     private Set<Integer> getRoleSmsUidsWithSatellitePermission(List<String> packageNames,
             @NonNull UserHandle userHandle) {
         final Set<Integer> roleSmsUids = new ArraySet<>();
-        final PackageManager pm = mContext.createContextAsUser(userHandle, 0).getPackageManager();
+        final PackageManager pm = getPackageManagerForUser(userHandle);
         if (pm != null) {
             for (String packageName : packageNames) {
                 // Check if SATELLITE_COMMUNICATION permission is enabled for default sms
@@ -276,18 +274,16 @@ public class SatelliteAccessController {
     public void onUserAddedWithInstalledPackageList(@NonNull UserHandle userHandle,
             @NonNull List<PackageInfo> apps) {
         HandlerUtils.ensureRunningOnHandlerThread(mConnectivityServiceHandler);
+        // Store PackageManager for user for later use.
+        final PackageManager pmForUser = getPackageManagerForUser(userHandle);
+
         // Obtain uids with role sms and satellite communication permission for the added user.
         final boolean roleSmsUidsChanged = updateSatelliteRoleSmsUids(userHandle);
 
-        // Store PackageManager for user for later use.
-        final PackageManager pmForUser =
-                mContext.createContextAsUser(userHandle, 0 /* flag */).getPackageManager();
-        mUserPackageManagers.put(userHandle, pmForUser);
-
         boolean optInUidsChanged = false;
         if (mSupportConstrainedDataSatelliteOptIn) {
             final Set<Integer> satelliteDataOptInUidsForUser =
-                    getSatelliteDataOptInUidsForUser(apps);
+                    getSatelliteDataOptInUidsForUser(pmForUser, apps);
             if (satelliteDataOptInUidsForUser.size() > 0) {
                 mLog.i("Add SatelliteDataOptInUids for user " + userHandle + ": "
                         + satelliteDataOptInUidsForUser);
@@ -338,7 +334,8 @@ public class SatelliteAccessController {
 
     @CheckReturnValue
     private boolean addSatelliteDataOptInUid(@NonNull final String packageName, final int uid) {
-        if (mSupportConstrainedDataSatelliteOptIn && isSatelliteDataOptimizedApp(packageName)) {
+        if (mSupportConstrainedDataSatelliteOptIn
+                && isSatelliteDataOptimizedApp(getPackageManagerForUid(uid), packageName)) {
             mSatelliteDataOptInUids.add(uid);
             return true;
         }
@@ -372,6 +369,11 @@ public class SatelliteAccessController {
         }
     }
 
+    @NonNull
+    private PackageManager getPackageManagerForUid(int uid) {
+        return getPackageManagerForUser(UserHandle.getUserHandleForUid(uid));
+    }
+
     /**
      * Called when a package is removed.
      *
@@ -383,10 +385,11 @@ public class SatelliteAccessController {
         if (!mSupportConstrainedDataSatelliteOptIn) return;
 
         // Scan for all apps sharing the same uid.
-        final String [] pkgs = mPackageManager.getPackagesForUid(uid);
+        final PackageManager pmForUser = getPackageManagerForUid(uid);
+        final String [] pkgs = pmForUser.getPackagesForUid(uid);
         if (pkgs != null) {
             for (String pkg : pkgs) {
-                if (!pkg.equals(packageName) && isSatelliteDataOptimizedApp(pkg)) {
+                if (!pkg.equals(packageName) && isSatelliteDataOptimizedApp(pmForUser, pkg)) {
                     return; // Early return if another satellite-optimized app shares the UID
                 }
             }
@@ -400,20 +403,22 @@ public class SatelliteAccessController {
     }
 
     @NonNull
-    private Set<Integer> getSatelliteDataOptInUidsForUser(@NonNull List<PackageInfo> apps) {
+    private Set<Integer> getSatelliteDataOptInUidsForUser(@NonNull PackageManager pmForUser,
+            @NonNull List<PackageInfo> apps) {
         final ArraySet<Integer> uids = new ArraySet<>();
         for (PackageInfo app : apps) {
             if (null == app.applicationInfo || app.applicationInfo.uid < 0) continue;
-            if (isSatelliteDataOptimizedApp(app.packageName)) {
+            if (isSatelliteDataOptimizedApp(pmForUser, app.packageName)) {
                 uids.add(app.applicationInfo.uid);
             }
         }
         return uids;
     }
 
-    private boolean isSatelliteDataOptimizedApp(@NonNull String packageName) {
+    private boolean isSatelliteDataOptimizedApp(@NonNull PackageManager pmForUser,
+            @NonNull String packageName) {
         try {
-            final ApplicationInfo applicationInfo = mPackageManager.getApplicationInfo(
+            final ApplicationInfo applicationInfo = pmForUser.getApplicationInfo(
                     packageName, PackageManager.GET_META_DATA);
             final Bundle metaData = applicationInfo.metaData;
             if (metaData != null) {
@@ -432,6 +437,16 @@ public class SatelliteAccessController {
         return mSatelliteDataOptInUids.removeIf(uid -> uid / PER_USER_RANGE == userIdToRemove);
     }
 
+    @NonNull
+    private PackageManager getPackageManagerForUser(UserHandle user) {
+        PackageManager pm = mUserPackageManagers.get(user);
+        if (pm == null) {
+            pm = mContext.createContextAsUser(user, 0 /* flag */).getPackageManager();
+            mUserPackageManagers.put(user, pm);
+        }
+        return pm;
+    }
+
     /** Dump info to dumpsys */
     public void dump(@NonNull IndentingPrintWriter pw) {
         HandlerUtils.ensureRunningOnHandlerThread(mConnectivityServiceHandler);
diff --git a/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt b/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt
index 0b2e77f633..0230128eaf 100644
--- a/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt
+++ b/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt
@@ -29,6 +29,7 @@ import android.os.Handler
 import android.os.Looper
 import android.os.UserHandle
 import android.os.UserManager
+import android.util.ArrayMap
 import com.android.server.connectivity.ConnectivityFlags.CONSTRAINED_DATA_SATELLITE_OPTIN
 import com.android.server.connectivity.SatelliteAccessController.PER_USER_RANGE
 import com.android.server.connectivity.SatelliteAccessController.PROPERTY_SATELLITE_DATA_OPTIMIZED
@@ -69,6 +70,7 @@ private const val SMS_APP_ID1 = 100
 private const val SMS_APP_ID2 = 101
 
 private fun Int.toUid(userId: Int) = UserHandle.getUid(userId, this)
+private fun Int.getUserId() = this / PER_USER_RANGE
 
 private const val TEST_PACKAGE1 = "com.android.package1"
 private const val TEST_PACKAGE2 = "com.android.package2"
@@ -80,17 +82,13 @@ private const val TEST_UID2 = 2002 + SECONDARY_USER * PER_USER_RANGE // Under 2n
 @IgnoreUpTo(Build.VERSION_CODES.TIRAMISU)
 class SatelliteAccessControllerTest {
     private val context = mock(Context::class.java)
-    private val primaryUserContext = mock(Context::class.java)
-    private val secondaryUserContext = mock(Context::class.java)
-    private val packageManager = mock(PackageManager::class.java)
-    private val packageManagerPrimaryUser = mock(PackageManager::class.java)
-    private val packageManagerSecondaryUser = mock(PackageManager::class.java)
     private val deps = mock(SatelliteAccessController.Dependencies::class.java)
     private val callback = mock(BiConsumer::class.java) as BiConsumer<Set<Int>, Set<Int>>
     private val userManager = mock(UserManager::class.java)
     private val handler = Handler(Looper.getMainLooper())
     private lateinit var satelliteAccessController: SatelliteAccessController
     private lateinit var roleHolderChangedListener: OnRoleHoldersChangedListener
+    private val mockedPackageManagerForUser = ArrayMap<Int, PackageManager>()
 
     private val featureFlags = HashSet<String>()
 
@@ -112,27 +110,35 @@ class SatelliteAccessControllerTest {
         }
     }
 
+    private fun mockPackageManagerForUser(userId: Int): PackageManager =
+            mockedPackageManagerForUser.getOrPut(userId) {
+                val userHandle = UserHandle.of(userId)
+                val contextAsUser = mock(Context::class.java)
+                val packageManager = mock(PackageManager::class.java)
+                doReturn(contextAsUser).`when`(context).createContextAsUser(userHandle, 0)
+                doReturn(packageManager).`when`(contextAsUser).packageManager
+                packageManager
+            }
+
+    private fun getMockedPackageManagerForUser(userId: Int) = mockedPackageManagerForUser[userId]!!
+
     @Before
     fun setup() {
         doReturn(emptyList<UserHandle>()).`when`(userManager).getUserHandles(true)
         mockService(Context.USER_SERVICE, UserManager::class.java, userManager)
-        doReturn(packageManager).`when`(context).packageManager
         doReturn(featureFlags.contains(CONSTRAINED_DATA_SATELLITE_OPTIN))
                 .`when`(deps).supportConstrainedDataSatelliteOptIn(any())
         satelliteAccessController = SatelliteAccessController(context, deps, callback, handler)
 
-        doReturn(primaryUserContext).`when`(context).createContextAsUser(PRIMARY_USER_HANDLE, 0)
-        doReturn(packageManagerPrimaryUser).`when`(primaryUserContext).packageManager
-
-        doReturn(secondaryUserContext).`when`(context).createContextAsUser(SECONDARY_USER_HANDLE, 0)
-        doReturn(packageManagerSecondaryUser).`when`(secondaryUserContext).packageManager
+        mockPackageManagerForUser(PRIMARY_USER)
+        mockPackageManagerForUser(SECONDARY_USER)
 
         for (app in listOf(SMS_APP1, SMS_APP2)) {
             doReturn(PackageManager.PERMISSION_GRANTED)
-                .`when`(packageManagerPrimaryUser)
+                .`when`(getMockedPackageManagerForUser(PRIMARY_USER))
                 .checkPermission(Manifest.permission.SATELLITE_COMMUNICATION, app)
             doReturn(PackageManager.PERMISSION_GRANTED)
-                .`when`(packageManagerSecondaryUser)
+                .`when`(getMockedPackageManagerForUser(SECONDARY_USER))
                 .checkPermission(Manifest.permission.SATELLITE_COMMUNICATION, app)
         }
 
@@ -143,12 +149,12 @@ class SatelliteAccessControllerTest {
             val primaryUid = appId.toUid(PRIMARY_USER)
             val primaryAppInfo = ApplicationInfo().apply { uid = primaryUid }
             doReturn(primaryAppInfo)
-                    .`when`(packageManagerPrimaryUser)
+                    .`when`(getMockedPackageManagerForUser(PRIMARY_USER))
                     .getApplicationInfo(eq(appName), anyInt())
             val secondaryUid = appId.toUid(SECONDARY_USER)
             val secondaryAppInfo = ApplicationInfo().apply { uid = secondaryUid }
             doReturn(secondaryAppInfo)
-                    .`when`(packageManagerSecondaryUser)
+                    .`when`(getMockedPackageManagerForUser(SECONDARY_USER))
                     .getApplicationInfo(eq(appName), anyInt())
         }
     }
@@ -199,7 +205,7 @@ class SatelliteAccessControllerTest {
         // Check DEFAULT_MESSAGING_APP1 is not available as satellite network fallback uid
         // since satellite communication permission not available.
         doReturn(PackageManager.PERMISSION_DENIED)
-            .`when`(packageManagerPrimaryUser)
+            .`when`(getMockedPackageManagerForUser(PRIMARY_USER))
             .checkPermission(Manifest.permission.SATELLITE_COMMUNICATION, SMS_APP1)
         doReturn(listOf(SMS_APP1))
             .`when`(deps).getRoleHoldersAsUser(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
@@ -353,23 +359,28 @@ class SatelliteAccessControllerTest {
     }
 
     private fun mockGetPackagesForUid(uid: Int, pkgs: Array<String>?) {
-        `when`(packageManager.getPackagesForUid(uid)).thenReturn(pkgs)
+        val pm = mockPackageManagerForUser(uid.getUserId())
+        `when`(pm.getPackagesForUid(uid)).thenReturn(pkgs)
     }
 
-    private fun mockIsSatelliteDataOptimizedApp(packageName: String, isOptimized: Boolean) {
+    private fun mockIsSatelliteDataOptimizedAppForUser(
+            userId: Int,
+            packageName: String,
+            isOptimized: Boolean
+    ) {
         val appInfo = ApplicationInfo()
         if (isOptimized) {
             appInfo.metaData = Bundle()
             appInfo.metaData.putString(PROPERTY_SATELLITE_DATA_OPTIMIZED, packageName)
         }
-        doReturn(appInfo).`when`(packageManager)
-                .getApplicationInfo(packageName, PackageManager.GET_META_DATA)
+        val pm = mockPackageManagerForUser(userId)
+        doReturn(appInfo).`when`(pm).getApplicationInfo(packageName, PackageManager.GET_META_DATA)
     }
 
     @FeatureFlag(name = CONSTRAINED_DATA_SATELLITE_OPTIN)
     @Test
     fun testSatelliteOptInUids_onPackageAdded() {
-        mockIsSatelliteDataOptimizedApp(TEST_PACKAGE1, true)
+        mockIsSatelliteDataOptimizedAppForUser(TEST_UID1.getUserId(), TEST_PACKAGE1, true)
         onPackageAdded(TEST_PACKAGE1, TEST_UID1)
         verify(callback).accept(emptySet(), setOf(TEST_UID1))
     }
@@ -377,7 +388,7 @@ class SatelliteAccessControllerTest {
     @FeatureFlag(name = CONSTRAINED_DATA_SATELLITE_OPTIN)
     @Test
     fun testSatelliteOptInUids_onPackageAdded_ignoresIfNotSatelliteOptimized() {
-        mockIsSatelliteDataOptimizedApp(TEST_PACKAGE1, false)
+        mockIsSatelliteDataOptimizedAppForUser(TEST_UID1.getUserId(), TEST_PACKAGE1, false)
         onPackageAdded(TEST_PACKAGE1, TEST_UID1)
         verify(callback, never()).accept(any(), any())
     }
@@ -385,7 +396,7 @@ class SatelliteAccessControllerTest {
     @FeatureFlag(name = CONSTRAINED_DATA_SATELLITE_OPTIN)
     @Test
     fun testSatelliteOptInUids_onPackageRemoved_noOtherShareUid() {
-        mockIsSatelliteDataOptimizedApp(TEST_PACKAGE1, true)
+        mockIsSatelliteDataOptimizedAppForUser(TEST_UID1.getUserId(), TEST_PACKAGE1, true)
         mockGetPackagesForUid(TEST_UID1, arrayOf(TEST_PACKAGE1))
 
         onPackageAdded(TEST_PACKAGE1, TEST_UID1)
@@ -397,8 +408,8 @@ class SatelliteAccessControllerTest {
     @FeatureFlag(name = CONSTRAINED_DATA_SATELLITE_OPTIN)
     @Test
     fun testSatelliteOptInUids_onPackageRemoved_otherShareUid() {
-        mockIsSatelliteDataOptimizedApp(TEST_PACKAGE1, true)
-        mockIsSatelliteDataOptimizedApp(TEST_PACKAGE2, true)
+        mockIsSatelliteDataOptimizedAppForUser(TEST_UID1.getUserId(), TEST_PACKAGE1, true)
+        mockIsSatelliteDataOptimizedAppForUser(TEST_UID1.getUserId(), TEST_PACKAGE2, true)
         mockGetPackagesForUid(TEST_UID1, arrayOf(TEST_PACKAGE1, TEST_PACKAGE2))
 
         // Verify uid is not removed if there is still another package shares the same uid.
@@ -417,8 +428,8 @@ class SatelliteAccessControllerTest {
     @FeatureFlag(name = CONSTRAINED_DATA_SATELLITE_OPTIN)
     @Test
     fun testSatelliteOptInUids_onUserAddedRemoved() {
-        mockIsSatelliteDataOptimizedApp(TEST_PACKAGE1, true)
-        mockIsSatelliteDataOptimizedApp(TEST_PACKAGE2, true)
+        mockIsSatelliteDataOptimizedAppForUser(TEST_UID1.getUserId(), TEST_PACKAGE1, true)
+        mockIsSatelliteDataOptimizedAppForUser(TEST_UID2.getUserId(), TEST_PACKAGE2, true)
         val packageInfo1 = makePackageInfo(TEST_PACKAGE1, TEST_UID1)
         val packageInfo2 = makePackageInfo(TEST_PACKAGE2, TEST_UID2)
 
@@ -441,7 +452,7 @@ class SatelliteAccessControllerTest {
     @FeatureFlag(name = CONSTRAINED_DATA_SATELLITE_OPTIN, enabled = false)
     @Test
     fun testSatelliteOptInUids_featureDisabled() {
-        mockIsSatelliteDataOptimizedApp(TEST_PACKAGE1, true)
+        mockIsSatelliteDataOptimizedAppForUser(TEST_UID1.getUserId(), TEST_PACKAGE1, true)
         val packageInfo1 = makePackageInfo(TEST_PACKAGE1, TEST_UID1)
 
         // Verify nothing changes and nothing crashes.
@@ -464,7 +475,7 @@ class SatelliteAccessControllerTest {
         verify(callback).accept(setOf(SMS_APP_ID1.toUid(PRIMARY_USER)), emptySet())
 
         // Mock another opt-in uid, verify they both reported via the callback.
-        mockIsSatelliteDataOptimizedApp(TEST_PACKAGE1, true)
+        mockIsSatelliteDataOptimizedAppForUser(TEST_UID1.getUserId(), TEST_PACKAGE1, true)
         onPackageAdded(TEST_PACKAGE1, TEST_UID1)
         verify(callback).accept(setOf(SMS_APP_ID1.toUid(PRIMARY_USER)), setOf(TEST_UID1))
     }
@@ -472,7 +483,7 @@ class SatelliteAccessControllerTest {
     @FeatureFlag(name = CONSTRAINED_DATA_SATELLITE_OPTIN)
     @Test
     fun testSatelliteOptInUids_onUserAddedWithRoleSmsUids() {
-        mockIsSatelliteDataOptimizedApp(TEST_PACKAGE1, true)
+        mockIsSatelliteDataOptimizedAppForUser(TEST_UID1.getUserId(), TEST_PACKAGE1, true)
         val packageInfo1 = makePackageInfo(TEST_PACKAGE1, TEST_UID1)
         doReturn(listOf(SMS_APP1))
                 .`when`(deps).getRoleHoldersAsUser(RoleManager.ROLE_SMS, PRIMARY_USER_HANDLE)
@@ -495,8 +506,8 @@ class SatelliteAccessControllerTest {
         val inOrder = inOrder(callback)
         // Mock opt-in uids, verify they both reported via the callback.
         // However, one opt-in uid is a messaging app and will surprise us later.
-        mockIsSatelliteDataOptimizedApp(TEST_PACKAGE1, true)
-        mockIsSatelliteDataOptimizedApp(SMS_APP1, true)
+        mockIsSatelliteDataOptimizedAppForUser(TEST_UID1.getUserId(), TEST_PACKAGE1, true)
+        mockIsSatelliteDataOptimizedAppForUser(TEST_UID1.getUserId(), SMS_APP1, true)
         onPackageAdded(TEST_PACKAGE1, TEST_UID1)
         inOrder.verify(callback).accept(emptySet(), setOf(TEST_UID1))
         onPackageAdded(SMS_APP1, smsUid)
@@ -521,12 +532,14 @@ class SatelliteAccessControllerTest {
     @Test
     fun testSatelliteOptInUids_onExternalApplicationsAvailable() {
         // Mock the sms apps as general opt-in apps without setting role-sms.
-        mockIsSatelliteDataOptimizedApp(SMS_APP1, true)
-        mockIsSatelliteDataOptimizedApp(SMS_APP2, true)
+        mockIsSatelliteDataOptimizedAppForUser(PRIMARY_USER, SMS_APP1, true)
+        mockIsSatelliteDataOptimizedAppForUser(SECONDARY_USER, SMS_APP1, true)
+        mockIsSatelliteDataOptimizedAppForUser(PRIMARY_USER, SMS_APP2, true)
+        mockIsSatelliteDataOptimizedAppForUser(SECONDARY_USER, SMS_APP2, true)
 
         val inOrder = inOrder(callback)
-        onUserAddedWithInstalledPackageList(PRIMARY_USER_HANDLE, emptyList<PackageInfo>())
-        onUserAddedWithInstalledPackageList(SECONDARY_USER_HANDLE, emptyList<PackageInfo>())
+        onUserAddedWithInstalledPackageList(PRIMARY_USER_HANDLE, emptyList())
+        onUserAddedWithInstalledPackageList(SECONDARY_USER_HANDLE, emptyList())
         onExternalApplicationsAvailable(arrayOf(SMS_APP1, SMS_APP2))
         inOrder.verify(callback).accept(emptySet(), setOf(
                 SMS_APP_ID1.toUid(PRIMARY_USER),

From c5b9f5ee99fbd771053540f34c47333bdf474daf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Tue, 6 May 2025 02:35:27 -0700
Subject: [PATCH 208/377] bpf: Add new SDK versions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add 25Q3, 25Q4, 26Q1 and 26Q2 SDKs to the bpfloader helpers. The Q3 and
beyond versions are not finalized, so they are not being populated in
BpfUtils.h yet, but at least the logic is in place.

Test: TreeHugger
Flag: EXEMPT test code
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I6ea12e347462be2c8258a4fe5bc994b35d4065a5
---
 bpf/headers/include/bpf/BpfUtils.h |  6 +++++-
 bpf/headers/include/bpf_helpers.h  | 14 +++++++++++++-
 bpf/loader/NetBpfLoad.cpp          |  4 ++++
 3 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/bpf/headers/include/bpf/BpfUtils.h b/bpf/headers/include/bpf/BpfUtils.h
index ed08e1afe0..85502ecbd5 100644
--- a/bpf/headers/include/bpf/BpfUtils.h
+++ b/bpf/headers/include/bpf/BpfUtils.h
@@ -42,7 +42,11 @@ const bool isAtLeastS = (api_level >= 31);
 const bool isAtLeastT = (api_level >= 33);
 const bool isAtLeastU = (api_level >= 34);
 const bool isAtLeastV = (api_level >= 35);
-const bool isAtLeast25Q2 = (api_level >= 36);
+const bool isAtLeast25Q2 = (api_level >= 36); // 36.0
+const bool isAtLeast25Q3 = (api_level > 36);  // 36.0+ (TODO: fix this!)
+const bool isAtLeast25Q4 = false;  // 36.1
+const bool isAtLeast26Q1 = false;  // 36.1+
+const bool isAtLeast26Q2 = false;  // 37.0
 
 // See kernel's net/core/sock_diag.c __sock_gen_cookie()
 // the implementation of which guarantees 0 will never be returned,
diff --git a/bpf/headers/include/bpf_helpers.h b/bpf/headers/include/bpf_helpers.h
index e0c524fdff..fe64538e60 100644
--- a/bpf/headers/include/bpf_helpers.h
+++ b/bpf/headers/include/bpf_helpers.h
@@ -62,9 +62,21 @@
 // Android Mainline BpfLoader when running on Android V (sdk=35)
 #define BPFLOADER_MAINLINE_V_VERSION (BPFLOADER_MAINLINE_U_QPR3_VERSION + 1u)
 
-// Android Mainline BpfLoader when running on Android 25Q2 (sdk=36)
+// Android Mainline BpfLoader when running on Android 25Q2 (sdk=36 aka 36.0)
 #define BPFLOADER_MAINLINE_25Q2_VERSION (BPFLOADER_MAINLINE_V_VERSION + 1u)
 
+// Android Mainline BpfLoader when running on Android 25Q3 (sdk 36.0+)
+#define BPFLOADER_MAINLINE_25Q3_VERSION (BPFLOADER_MAINLINE_25Q2_VERSION + 1u)
+
+// Android Mainline BpfLoader when running on Android 25Q4 (sdk 36.1)
+#define BPFLOADER_MAINLINE_25Q4_VERSION (BPFLOADER_MAINLINE_25Q3_VERSION + 1u)
+
+// Android Mainline BpfLoader when running on Android 26Q1 (sdk 36.1+)
+#define BPFLOADER_MAINLINE_26Q1_VERSION (BPFLOADER_MAINLINE_25Q4_VERSION + 1u)
+
+// Android Mainline BpfLoader when running on Android 26Q2 (sdk 37.0)
+#define BPFLOADER_MAINLINE_26Q2_VERSION (BPFLOADER_MAINLINE_26Q1_VERSION + 1u)
+
 /* For mainline module use, you can #define BPFLOADER_{MIN/MAX}_VER
  * before #include "bpf_helpers.h" to change which bpfloaders will
  * process the resulting .o file.
diff --git a/bpf/loader/NetBpfLoad.cpp b/bpf/loader/NetBpfLoad.cpp
index 4a79a0fc1a..9e2aea6edd 100644
--- a/bpf/loader/NetBpfLoad.cpp
+++ b/bpf/loader/NetBpfLoad.cpp
@@ -1674,6 +1674,10 @@ static int doLoad(char** argv, char * const envp[]) {
     if (runningAsRoot) ++bpfloader_ver;  // [45] BPFLOADER_MAINLINE_U_QPR3_VERSION
     if (isAtLeastV) ++bpfloader_ver;     // [46] BPFLOADER_MAINLINE_V_VERSION
     if (isAtLeast25Q2) ++bpfloader_ver;  // [47] BPFLOADER_MAINLINE_25Q2_VERSION
+    if (isAtLeast25Q3) ++bpfloader_ver;  // [48] BPFLOADER_MAINLINE_25Q3_VERSION
+    if (isAtLeast25Q4) ++bpfloader_ver;  // [49] BPFLOADER_MAINLINE_25Q4_VERSION
+    if (isAtLeast26Q1) ++bpfloader_ver;  // [50] BPFLOADER_MAINLINE_26Q1_VERSION
+    if (isAtLeast26Q2) ++bpfloader_ver;  // [51] BPFLOADER_MAINLINE_26Q2_VERSION
 
     ALOGI("NetBpfLoad v0.%u (%s) api:%d/%d kver:%07x (%s) libbpf: v%u.%u "
           "uid:%d rc:%d%d",

From 66893bffe526ef6a8e6b361ad22c649f98d940f7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Tue, 6 May 2025 02:59:22 -0700
Subject: [PATCH 209/377] NetBpfLoad: remove spurious S+ check.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since all mainline bpf code is now loaded by NetBpfLoad, compatibility with platform bpfloader simply doesn't matter any more.

Test: TreeHugger
Flag: EXEMPT mainline
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Id96e3e6a4dac485f3e707cc9e6c4b05a4f9389d7
---
 bpf/loader/NetBpfLoad.cpp | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/bpf/loader/NetBpfLoad.cpp b/bpf/loader/NetBpfLoad.cpp
index 4a79a0fc1a..c12c2eab6c 100644
--- a/bpf/loader/NetBpfLoad.cpp
+++ b/bpf/loader/NetBpfLoad.cpp
@@ -1399,10 +1399,7 @@ int loadProg(const char* const elfPath, const unsigned int bpfloader_ver,
         ALOGV("map_fd found at %d is %d in %s", i, mapFds[i].get(), elfPath);
 
     ret = readCodeSections(elfFile, cs);
-    // BPF .o's with no programs are only supported by mainline netbpfload,
-    // make sure .o's targeting non-mainline (ie. S) bpfloader don't show up.
-    if (ret == -ENOENT && bpfLoaderMinVer >= BPFLOADER_MAINLINE_S_VERSION)
-        return 0;
+    if (ret == -ENOENT) return 0;
     if (ret) {
         ALOGE("Couldn't read all code sections in %s", elfPath);
         return ret;

From ec1115e46b0a643db319fdb3ad19ed7d892238fa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Tue, 6 May 2025 04:51:09 -0700
Subject: [PATCH 210/377] NetBpfLoad: Require Kernel 5.10 for Android 25Q4
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Netd bpf requires 5.10 at least in 25Q4.
This CL enforces that.

Test: TreeHugger
Flag: EXEMPT mainline
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I76e52b2a2702a2a6ce761a947a0749ea798778b6
---
 bpf/loader/NetBpfLoad.cpp            | 7 +++++++
 bpf/tests/mts/bpf_existence_test.cpp | 3 +++
 2 files changed, 10 insertions(+)

diff --git a/bpf/loader/NetBpfLoad.cpp b/bpf/loader/NetBpfLoad.cpp
index 9e2aea6edd..586c9dd406 100644
--- a/bpf/loader/NetBpfLoad.cpp
+++ b/bpf/loader/NetBpfLoad.cpp
@@ -1724,6 +1724,13 @@ static int doLoad(char** argv, char * const envp[]) {
         return 1;
     }
 
+    // 25Q4 bumps the kernel requirement up to 5.10
+    // see also: //system/netd/tests/kernel_test.cpp TestKernel510
+    if (isAtLeast25Q4 && !isAtLeastKernelVersion(5, 10, 0)) {
+        ALOGE("Android 25Q4 requires kernel 5.10.");
+        return 1;
+    }
+
     // Technically already required by U, but only enforce on V+
     // see also: //system/netd/tests/kernel_test.cpp TestKernel64Bit
     if (isAtLeastV && isKernel32Bit() && isAtLeastKernelVersion(5, 16, 0)) {
diff --git a/bpf/tests/mts/bpf_existence_test.cpp b/bpf/tests/mts/bpf_existence_test.cpp
index 4d5f9b54c7..a6c774f83a 100644
--- a/bpf/tests/mts/bpf_existence_test.cpp
+++ b/bpf/tests/mts/bpf_existence_test.cpp
@@ -37,6 +37,7 @@ using android::bpf::isAtLeastT;
 using android::bpf::isAtLeastU;
 using android::bpf::isAtLeastV;
 using android::bpf::isAtLeast25Q2;
+using android::bpf::isAtLeast25Q4;
 
 #define PLATFORM "/sys/fs/bpf/"
 #define TETHERING "/sys/fs/bpf/tethering/"
@@ -225,6 +226,8 @@ TEST_F(BpfExistenceTest, TestPrograms) {
     if (isAtLeast25Q2) ASSERT_TRUE(isAtLeastKernelVersion(5, 4, 0));
     DO_EXPECT(isAtLeast25Q2, MAINLINE_FOR_25Q2_PLUS);
 
+    if (isAtLeast25Q4) ASSERT_TRUE(isAtLeastKernelVersion(5, 10, 0));
+
     for (const auto& file : mustExist) {
         EXPECT_EQ(0, access(file.c_str(), R_OK)) << file << " does not exist";
     }

From 3a019692f004d31a387eea72e8821d0e1da58423 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Tue, 6 May 2025 08:17:23 -0700
Subject: [PATCH 211/377] Add a test for multiple prefixes with p flags

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: Iffa24fdfbf739b8135f94d6d3434a496de7f3f28
---
 .../src/android/net/Dhcp6PdTest.kt            | 32 ++++++++++++++++++-
 1 file changed, 31 insertions(+), 1 deletion(-)

diff --git a/tests/integration/src/android/net/Dhcp6PdTest.kt b/tests/integration/src/android/net/Dhcp6PdTest.kt
index 894c3a091d..2f40a8eddf 100644
--- a/tests/integration/src/android/net/Dhcp6PdTest.kt
+++ b/tests/integration/src/android/net/Dhcp6PdTest.kt
@@ -43,9 +43,11 @@ import com.android.testutils.NdResponder
 import com.android.testutils.PacketBuilder
 import com.android.testutils.RaPkt
 import com.android.testutils.RecorderCallback.CallbackEntry.Available
+import com.android.testutils.RecorderCallback.CallbackEntry.LinkPropertiesChanged
 import com.android.testutils.TestableNetworkCallback
 import com.android.testutils.UdpPkt
 import com.android.testutils.runAsShell
+import com.google.common.truth.Truth.assertThat
 import java.net.Inet6Address
 import java.net.InetAddress
 import java.nio.ByteBuffer
@@ -73,7 +75,7 @@ private val ROUTER_V6 = InetAddress.getByName("fe80::1") as Inet6Address
 private val RA_WITH_PFLAG = RaPkt()
             .addPioOption(prefix = "2001:db8::/64", flags = "LAP")
             .addRdnssOption(dns = "2001:4860:4860::8888,2001:4860:4860::8844")
-            .addSllaOption("1:2:3:4:5:6")
+            .addSllaOption(ROUTER_MAC)
 
 @AppModeFull(reason = "Instant apps can't access EthernetManager")
 @RunWith(DevSdkIgnoreRunner::class)
@@ -192,4 +194,32 @@ class Dhcp6PdTest {
 
         networkCallback.expect<Available>()
     }
+
+    @Test
+    fun testProvisioning_withTwoPrefixes() {
+        val ra = RaPkt()
+            .addPioOption(prefix = "2001:db8::/64", flags = "LAP")
+            .addPioOption(prefix = "fd00::/48", flags = "LAP")
+            .addRdnssOption(dns = "2001:4860:4860::8888,2001:4860:4860::8844")
+        ndResponder.addRouterEntry(ROUTER_MAC, ROUTER_V6, ra)
+        val (srcAddr, solicit) = expectDhcp6Packet<Dhcp6SolicitPacket>()
+
+        val ether = EtherPkt(src = ROUTER_MAC, dst = localMac)
+        val ipv6 = Ip6Pkt(src = ROUTER_V6, dst = srcAddr)
+        val udp = UdpPkt(sport = 547, dport = 546)
+        val dhcp6 = Dhcp6Pkt(type = "REPLY", transId = solicit.transactionId)
+                .addRapidCommitOption()
+                .addClientIdentifierOption(solicit.clientDuid)
+                .addServerIdentifierOption(byteArrayOf(5, 4, 3, 2, 1))
+        val dhcp6_pd = Dhcp6IaPdOpt(iaid = solicit.iaid)
+                .addIaPrefixOption(prefix = "fd00::/48")
+                .addIaPrefixOption(prefix = "2001:db8:1234::/64")
+        val pkt = ether / ipv6 / udp / dhcp6 / dhcp6_pd
+        iface.sendPacket(pkt)
+
+        val lp = networkCallback.eventuallyExpect<LinkPropertiesChanged>().lp
+        val prefixes = lp.linkAddresses.map { it -> IpPrefix(it.address, it.prefixLength) }
+        // TODO: Should the stack also derive an address from fd00::/48?
+        assertThat(prefixes).containsExactly(IpPrefix("fe80::/64"), IpPrefix("2001:db8:1234::/64"))
+    }
 }

From a48d4b8cdbf9865a013d181505d4bb771e0ad2d8 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Tue, 6 May 2025 09:43:08 -0700
Subject: [PATCH 212/377] Increase timeout to wait for Bluetooth to be enabled

Bug: 415541761
Flag: EXEMPT mainline
Test: yes
Change-Id: I2a9aa900802cd7801908cffe3fa801ff4c0bfb56
---
 tests/cts/net/src/android/net/cts/NetworkReservationTest.kt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/cts/net/src/android/net/cts/NetworkReservationTest.kt b/tests/cts/net/src/android/net/cts/NetworkReservationTest.kt
index f43b92799d..9afb0d3d71 100644
--- a/tests/cts/net/src/android/net/cts/NetworkReservationTest.kt
+++ b/tests/cts/net/src/android/net/cts/NetworkReservationTest.kt
@@ -83,7 +83,7 @@ private val ETHERNET_REQUEST = NetworkRequest.Builder()
         .addTransportType(TRANSPORT_TEST)
         .removeCapability(NET_CAPABILITY_TRUSTED)
         .build()
-private const val TIMEOUT_MS = 5_000L
+private const val TIMEOUT_MS = 30_000L
 private const val NO_CB_TIMEOUT_MS = 200L
 
 // TODO: integrate with CSNetworkReservationTest and move to common tests.

From c2bae6716c351e8d3d891aea3c64c369d3be6666 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Tue, 6 May 2025 12:22:54 -0700
Subject: [PATCH 213/377] Add a test for a multihoming configuration

Without rule 5.5 this won't work correctly anyway. However, this tests
the behavior of the DHCPv6-PD client.

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: Ibd84883391926f4e19c0e3d370d28fbcb68c0b8e
---
 .../src/android/net/Dhcp6PdTest.kt            | 41 +++++++++++++++++++
 1 file changed, 41 insertions(+)

diff --git a/tests/integration/src/android/net/Dhcp6PdTest.kt b/tests/integration/src/android/net/Dhcp6PdTest.kt
index 2f40a8eddf..e031ad5e07 100644
--- a/tests/integration/src/android/net/Dhcp6PdTest.kt
+++ b/tests/integration/src/android/net/Dhcp6PdTest.kt
@@ -222,4 +222,45 @@ class Dhcp6PdTest {
         // TODO: Should the stack also derive an address from fd00::/48?
         assertThat(prefixes).containsExactly(IpPrefix("fe80::/64"), IpPrefix("2001:db8:1234::/64"))
     }
+
+    @Test
+    fun testProvisioning_withMultihomingConfiguration() {
+        // Configure two routers.
+        run {
+            val ra = RaPkt()
+                .addPioOption(prefix = "2001:db8:1::/64", flags = "LAP")
+                .addRdnssOption(dns = "2001:4860:4860::8888,2001:4860:4860::8844")
+            ndResponder.addRouterEntry(ROUTER_MAC, ROUTER_V6, ra)
+        }
+        run {
+            val ra = RaPkt()
+                .addPioOption(prefix = "2001:db8:2::/64", flags = "LAP")
+                .addRdnssOption(dns = "2001:4860:4860::8888,2001:4860:4860::8844")
+            val mac = MacAddress.fromString("9:8:7:6:5:4")
+            val ip = InetAddress.getByName("fe80::2") as Inet6Address
+            ndResponder.addRouterEntry(mac, ip, ra)
+        }
+        val (srcAddr, solicit) = expectDhcp6Packet<Dhcp6SolicitPacket>()
+
+        val ether = EtherPkt(src = "42:42:42:42:42:42", dst = localMac.toString())
+        val ipv6 = Ip6Pkt(src = "fe80::42", dst = srcAddr.hostAddress!!)
+        val udp = UdpPkt(sport = 547, dport = 546)
+        val dhcp6 = Dhcp6Pkt(type = "REPLY", transId = solicit.transactionId)
+                .addRapidCommitOption()
+                .addClientIdentifierOption(solicit.clientDuid)
+                .addServerIdentifierOption(byteArrayOf(5, 4, 3, 2, 1))
+        val dhcp6_pd = Dhcp6IaPdOpt(iaid = solicit.iaid)
+                .addIaPrefixOption(prefix = "2001:db8:1:1234::/64")
+                .addIaPrefixOption(prefix = "2001:db8:2:1234::/64")
+        val pkt = ether / ipv6 / udp / dhcp6 / dhcp6_pd
+        iface.sendPacket(pkt)
+
+        val lp = networkCallback.eventuallyExpect<LinkPropertiesChanged>().lp
+        val prefixes = lp.linkAddresses.map { it -> IpPrefix(it.address, it.prefixLength) }
+        assertThat(prefixes).containsExactly(
+                IpPrefix("fe80::/64"),
+                IpPrefix("2001:db8:1:1234::/64"),
+                IpPrefix("2001:db8:2:1234::/64")
+        )
+    }
 }

From b59c829ff1da4594d42873d6b351e0f25e2fd5e1 Mon Sep 17 00:00:00 2001
From: Handa Wang <handaw@google.com>
Date: Mon, 28 Apr 2025 01:59:39 -0700
Subject: [PATCH 214/377] Ensure Thread network is never mDNS capable

Thread doesn't use mDNS and we should prevent NsdService from sending any mDNS traffic to Thread.

Bug: 414258735
Test: CI
Flag: EXEMPT bugfix
Change-Id: I62299769cd44d2984b81b273adea7ce459d3d773
---
 .../server/connectivity/mdns/MdnsSocketProvider.java |  4 +++-
 .../connectivity/mdns/MdnsSocketProviderTest.java    | 12 ++++++++++++
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/service-t/src/com/android/server/connectivity/mdns/MdnsSocketProvider.java b/service-t/src/com/android/server/connectivity/mdns/MdnsSocketProvider.java
index d91bd112b3..49e4e28d32 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MdnsSocketProvider.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MdnsSocketProvider.java
@@ -17,6 +17,7 @@
 package com.android.server.connectivity.mdns;
 
 import static android.net.NetworkCapabilities.TRANSPORT_CELLULAR;
+import static android.net.NetworkCapabilities.TRANSPORT_THREAD;
 import static android.net.NetworkCapabilities.TRANSPORT_VPN;
 import static android.net.NetworkCapabilities.TRANSPORT_WIFI;
 
@@ -561,8 +562,9 @@ public class MdnsSocketProvider {
     private boolean isMdnsCapableInterface(
             @NonNull NetworkInterfaceWrapper iface, @NonNull int[] transports) {
         try {
-            // Never try mDNS on cellular, or on interfaces with incompatible flags
+            // Never try mDNS on cellular, on Thread, or on interfaces with incompatible flags
             if (CollectionUtils.contains(transports, TRANSPORT_CELLULAR)
+                    || CollectionUtils.contains(transports, TRANSPORT_THREAD)
                     || iface.isLoopback()
                     || iface.isVirtual()
                     || !iface.isUp()) {
diff --git a/tests/unit/java/com/android/server/connectivity/mdns/MdnsSocketProviderTest.java b/tests/unit/java/com/android/server/connectivity/mdns/MdnsSocketProviderTest.java
index f763bae09a..6bcc4ed442 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/MdnsSocketProviderTest.java
+++ b/tests/unit/java/com/android/server/connectivity/mdns/MdnsSocketProviderTest.java
@@ -18,6 +18,7 @@ package com.android.server.connectivity.mdns;
 
 import static android.net.NetworkCapabilities.TRANSPORT_BLUETOOTH;
 import static android.net.NetworkCapabilities.TRANSPORT_CELLULAR;
+import static android.net.NetworkCapabilities.TRANSPORT_THREAD;
 import static android.net.NetworkCapabilities.TRANSPORT_VPN;
 import static android.net.NetworkCapabilities.TRANSPORT_WIFI;
 
@@ -596,6 +597,17 @@ public class MdnsSocketProviderTest {
         testCallback.expectedNoCallback();
     }
 
+    @Test
+    public void testNoSocketCreatedForThread() {
+        startMonitoringSockets();
+
+        final TestSocketCallback testCallback = new TestSocketCallback();
+        runOnHandler(() -> mSocketProvider.requestSocket(TEST_NETWORK, testCallback));
+
+        postNetworkAvailable(TRANSPORT_THREAD);
+        testCallback.expectedNoCallback();
+    }
+
     @Test
     public void testNoSocketCreatedForNonMulticastInterface() throws Exception {
         doReturn(false).when(mTestNetworkIfaceWrapper).supportsMulticast();

From c666f38532a4623b29f4b4c55734511640693cf0 Mon Sep 17 00:00:00 2001
From: Chuwei He <chuweih@google.com>
Date: Tue, 22 Apr 2025 10:57:12 +0900
Subject: [PATCH 215/377] Define the EthernetConfigStore API flag in
 Connectivity module

The com.android.net.flags.ethernet_config_store gates APIs exposed
by ethernet module, thus should also be included in
Connectivity/common/flags.aconfig

Bug: 397536853
Test: make
Flag: com.android.net.flags.ethernet_desktop_config

Change-Id: I158bc6298254e4075b594be90661e60b41d9930b
---
 common/flags.aconfig | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/common/flags.aconfig b/common/flags.aconfig
index af3236cdd9..17ddff8dc3 100644
--- a/common/flags.aconfig
+++ b/common/flags.aconfig
@@ -183,3 +183,11 @@ flag {
   description: "Flag for MDNS advertising quality, reliability and performance improvement"
   bug: "373270045"
 }
+
+flag {
+  name: "ethernet_desktop_config"
+  namespace: "android_core_networking"
+  description: "The flag controls support for ethernet configuration tracking and store by MAC address."
+  bug: "397536853"
+  is_fixed_read_only: true
+}

From 756adee79c995facf38605cbcffbed7906010b36 Mon Sep 17 00:00:00 2001
From: Rohit Kothari <r.kothari@samsung.corp-partner.google.com>
Date: Wed, 16 Apr 2025 10:31:56 -0700
Subject: [PATCH 216/377] Network name for Wi-Fi Direct group should have
 prefix DIRECT-xy.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Network name for Wi-Fi Direct group must starts with the prefix DIRECT-xy.
But CTS sometimes makes name with non-character in the position of “xy”.
To prevent issue, network name needs to be generated with the prefix DIRECT-xy.

Bug: 408245757
Test: atest CtsConnectivityMultiDevicesTestCases
Flag: EXEMPT bug fix
Change-Id: Ida07616b920b32dadd76f732ff2d87cc6ecc960d
Signed-off-by: Rohit Kothari <r.kothari@samsung.corp-partner.google.com>
---
 staticlibs/testutils/host/python/wifip2p_utils.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/staticlibs/testutils/host/python/wifip2p_utils.py b/staticlibs/testutils/host/python/wifip2p_utils.py
index ef6af75708..8192a6b4ea 100644
--- a/staticlibs/testutils/host/python/wifip2p_utils.py
+++ b/staticlibs/testutils/host/python/wifip2p_utils.py
@@ -51,7 +51,10 @@ def setup_wifi_p2p_server_and_client(
   client_name = client.getDeviceName()
 
   # Generate Wi-Fi P2P group passphrase with random characters.
-  group_name = "DIRECT-" + tether_utils.generate_uuid32_base64()
+  # network name must starts with prefix "DIRECT-", followed by any two
+  # random chars from the set ('A' - 'Z', 'a' - 'z', '0' - '9')
+  # This follows the documentation on WifiP2pConfig.Builder#setNetworkName.
+  group_name = "DIRECT-XY" + tether_utils.generate_uuid32_base64()
   group_passphrase = tether_utils.generate_uuid32_base64()
 
   # Server creates a Wi-Fi P2P group

From 145dc19675d23fefcbb1eb63504226fd609882ee Mon Sep 17 00:00:00 2001
From: Remi NGUYEN VAN <reminv@google.com>
Date: Tue, 22 Apr 2025 09:02:53 +0900
Subject: [PATCH 217/377] Remove SSLCertificateSocketFactoryTest @hide usage

Include verifyHostname in the test instead of calling the hidden API.

This removes a bit of coverage as verifyHostname itself is not tested
anymore, but it still verifies behavior of the verification and state of
the SSL session on socket creation.

verifyHostname is @hide API so it should not be exercised directly by
CTS.

Bug: 410435307
Flag: TEST_ONLY
Test: atest

Change-Id: I11f56e21ba242b7fcc5b84f6de992dc94d90ddee
---
 .../cts/SSLCertificateSocketFactoryTest.java  | 62 +++++++++++++------
 1 file changed, 44 insertions(+), 18 deletions(-)

diff --git a/tests/cts/net/src/android/net/cts/SSLCertificateSocketFactoryTest.java b/tests/cts/net/src/android/net/cts/SSLCertificateSocketFactoryTest.java
index 1a780a7eb5..2fda685ee6 100644
--- a/tests/cts/net/src/android/net/cts/SSLCertificateSocketFactoryTest.java
+++ b/tests/cts/net/src/android/net/cts/SSLCertificateSocketFactoryTest.java
@@ -22,6 +22,15 @@ import static org.junit.Assert.fail;
 
 import android.net.SSLCertificateSocketFactory;
 import android.platform.test.annotations.AppModeFull;
+
+import libcore.javax.net.ssl.SSLConfigurationAsserts;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
 import java.io.IOException;
 import java.net.InetAddress;
 import java.net.InetSocketAddress;
@@ -31,16 +40,13 @@ import java.net.UnknownHostException;
 import java.util.Arrays;
 import java.util.List;
 import java.util.stream.Collectors;
+
 import javax.net.ssl.HostnameVerifier;
 import javax.net.ssl.HttpsURLConnection;
+import javax.net.ssl.SSLException;
 import javax.net.ssl.SSLPeerUnverifiedException;
 import javax.net.ssl.SSLSession;
-import libcore.javax.net.ssl.SSLConfigurationAsserts;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.JUnit4;
+import javax.net.ssl.SSLSocket;
 
 @RunWith(JUnit4.class)
 public class SSLCertificateSocketFactoryTest {
@@ -151,8 +157,7 @@ public class SSLCertificateSocketFactoryTest {
      * {@link HttpsURLConnection#getDefaultHostnameVerifier}, so this test connects twice,
      * once with the system default {@link HostnameVerifier} which is expected to succeed,
      * and once after installing a {@link NegativeHostnameVerifier} which will cause
-     * {@link SSLCertificateSocketFactory#verifyHostname} to throw a
-     * {@link SSLPeerUnverifiedException}.
+     * {@link #verifyHostname} to throw a {@link SSLPeerUnverifiedException}.
      *
      * <p>These tests only test the hostname verification logic in SSLCertificateSocketFactory,
      * other TLS failure modes and the default HostnameVerifier are tested elsewhere, see
@@ -251,16 +256,16 @@ public class SSLCertificateSocketFactoryTest {
      *
      * <p>Behaviour is tested by installing a {@link NegativeHostnameVerifier} and by calling
      * {@link #assertConnectedSocket} to ensure TLS handshaking but no hostname verification takes
-     * place.  Next, {@link SSLCertificateSocketFactory#verifyHostname} is called to ensure
-     * that hostname verification is using the {@link HostnameVerifier} returned by
+     * place.  Next, {@link #verifyHostname} is called to ensure that hostname verification is using
+     * the {@link HostnameVerifier} returned by
      * {@link HttpsURLConnection#getDefaultHostnameVerifier} as documented.
      *
      * <p>Tests the following behaviour:-
      * <ul>
      * <li>TEST_SERVER is available and has a valid TLS certificate
      * <li>{@code createSocket()} does not verify the remote hostname
-     * <li>Calling {@link SSLCertificateSocketFactory#verifyHostname} on the returned socket
-     *     throws {@link SSLPeerUnverifiedException} if the remote hostname is invalid
+     * <li>Calling {@link #verifyHostname} on the returned socket throws
+     * {@link SSLPeerUnverifiedException} if the remote hostname is invalid
      * </ul>
      */
     @Test
@@ -272,13 +277,13 @@ public class SSLCertificateSocketFactoryTest {
         mSocketFactory.setHostname(socket, TEST_HOST);
         assertConnectedSocket(socket);
         try {
-          SSLCertificateSocketFactory.verifyHostname(socket, TEST_HOST);
-          fail();
+            verifyHostname(socket, TEST_HOST);
+            fail();
         } catch (SSLPeerUnverifiedException expected) {
             // expected
         }
         HttpsURLConnection.setDefaultHostnameVerifier(mDefaultVerifier);
-        SSLCertificateSocketFactory.verifyHostname(socket, TEST_HOST);
+        verifyHostname(socket, TEST_HOST);
         socket.close();
     }
 
@@ -306,16 +311,37 @@ public class SSLCertificateSocketFactoryTest {
         mSocketFactory.setHostname(socket, TEST_HOST);
         assertConnectedSocket(socket);
         try {
-          SSLCertificateSocketFactory.verifyHostname(socket, TEST_HOST);
-          fail();
+            verifyHostname(socket, TEST_HOST);
+            fail();
         } catch (SSLPeerUnverifiedException expected) {
             // expected
         }
         HttpsURLConnection.setDefaultHostnameVerifier(mDefaultVerifier);
-        SSLCertificateSocketFactory.verifyHostname(socket, TEST_HOST);
+        verifyHostname(socket, TEST_HOST);
         socket.close();
     }
 
+    // This is copied from SSLCertificateSocketFactory#verifyHostname given that
+    // the method is @hide.
+    private static void verifyHostname(Socket socket, String hostname) throws Exception {
+        if (!(socket instanceof SSLSocket)) {
+            throw new IllegalArgumentException("Attempt to verify non-SSL socket");
+        }
+
+        // The code at the start of OpenSSLSocketImpl.startHandshake()
+        // ensures that the call is idempotent, so we can safely call it.
+        SSLSocket ssl = (SSLSocket) socket;
+        ssl.startHandshake();
+
+        SSLSession session = ssl.getSession();
+        if (session == null) {
+            throw new SSLException("Cannot verify SSL socket without session");
+        }
+        if (!HttpsURLConnection.getDefaultHostnameVerifier().verify(hostname, session)) {
+            throw new SSLPeerUnverifiedException("Cannot verify hostname: " + hostname);
+        }
+    }
+
     /**
      * Asserts a socket is fully connected to the expected peer.
      *

From 50b479097d198e6d3e9bfbd1e6652897c807e99d Mon Sep 17 00:00:00 2001
From: Rohit Kothari <r.kothari@samsung.corp-partner.google.com>
Date: Wed, 16 Apr 2025 10:25:36 -0700
Subject: [PATCH 218/377] Fix for timing issue for handling user interaction
 addExternalApprover

If client knows network name and passphrase, it can connect to the
server (Group owner) without user interaction. In this case, it needs
to use interface address of group owner, not device address

Bug: 408245757
Test: atest CtsConnectivityMultiDevicesTestCases
Flag: EXEMPT bug fix
Change-Id: I47bc8609e63564f4226a4ef71ea9e382f5f919fe
Signed-off-by: Rohit Kothari <r.kothari@samsung.corp-partner.google.com>
---
 .../testutils/host/python/wifip2p_utils.py    |  23 +--
 .../snippet/Wifip2pMultiDevicesSnippet.kt     | 137 +-----------------
 2 files changed, 9 insertions(+), 151 deletions(-)

diff --git a/staticlibs/testutils/host/python/wifip2p_utils.py b/staticlibs/testutils/host/python/wifip2p_utils.py
index ef6af75708..f214e6d5e8 100644
--- a/staticlibs/testutils/host/python/wifip2p_utils.py
+++ b/staticlibs/testutils/host/python/wifip2p_utils.py
@@ -57,28 +57,11 @@ def setup_wifi_p2p_server_and_client(
   # Server creates a Wi-Fi P2P group
   server.createGroup(group_name, group_passphrase)
 
-  # Start Wi-Fi P2p peers discovery on both devices
-  server.startPeersDiscovery()
-  client.startPeersDiscovery()
-
-  # Ensure the target device has been discovered
-  server_address = client.ensureDeviceDiscovered(server_name)
-  client_address = server.ensureDeviceDiscovered(client_name)
-
-  # Server invites the device to the group
-  server.inviteDeviceToGroup(group_name, group_passphrase, client_address)
-
-  # Wait for a p2p connection changed intent to ensure the invitation has been
-  # received.
-  client.waitForP2pConnectionChanged(True, group_name)
-  # Accept the group invitation
-  client.acceptGroupInvitation(server_address)
-
-  # Server waits for connection request from client and accept joining
-  server.waitForPeerConnectionRequestAndAcceptJoining(client_address)
+  # Client connects to the group
+  client.connectToGroup(group_name, group_passphrase)
 
   # Wait for a p2p connection changed intent to ensure joining the group
-  client.waitForP2pConnectionChanged(False, group_name)
+  client.waitForP2pConnectionChanged(group_name)
 
   # Ensure Wi-Fi P2P connected on both devices
   client.ensureDeviceConnected(server_name)
diff --git a/tests/cts/multidevices/snippet/Wifip2pMultiDevicesSnippet.kt b/tests/cts/multidevices/snippet/Wifip2pMultiDevicesSnippet.kt
index 3816537a7d..c5af0b389b 100644
--- a/tests/cts/multidevices/snippet/Wifip2pMultiDevicesSnippet.kt
+++ b/tests/cts/multidevices/snippet/Wifip2pMultiDevicesSnippet.kt
@@ -16,25 +16,20 @@
 
 package com.google.snippet.connectivity
 
-import android.Manifest.permission.MANAGE_WIFI_NETWORK_SELECTION
 import android.content.BroadcastReceiver
 import android.content.Context
 import android.content.Intent
 import android.content.IntentFilter
 import android.content.pm.PackageManager.FEATURE_WIFI_DIRECT
-import android.net.MacAddress
 import android.net.wifi.p2p.WifiP2pConfig
 import android.net.wifi.p2p.WifiP2pDevice
-import android.net.wifi.p2p.WifiP2pDeviceList
 import android.net.wifi.p2p.WifiP2pGroup
 import android.net.wifi.p2p.WifiP2pManager
 import androidx.test.platform.app.InstrumentationRegistry
 import com.android.net.module.util.ArrayTrackRecord
-import com.android.testutils.runAsShell
 import com.google.android.mobly.snippet.Snippet
 import com.google.android.mobly.snippet.rpc.Rpc
 import com.google.snippet.connectivity.Wifip2pMultiDevicesSnippet.Wifip2pIntentReceiver.IntentReceivedEvent.ConnectionChanged
-import com.google.snippet.connectivity.Wifip2pMultiDevicesSnippet.Wifip2pIntentReceiver.IntentReceivedEvent.PeersChanged
 import java.util.concurrent.CompletableFuture
 import java.util.concurrent.TimeUnit
 import kotlin.test.assertNotNull
@@ -57,7 +52,6 @@ class Wifip2pMultiDevicesSnippet : Snippet {
         sealed class IntentReceivedEvent {
             abstract val intent: Intent
             data class ConnectionChanged(override val intent: Intent) : IntentReceivedEvent()
-            data class PeersChanged(override val intent: Intent) : IntentReceivedEvent()
         }
 
         override fun onReceive(context: Context, intent: Intent) {
@@ -65,9 +59,6 @@ class Wifip2pMultiDevicesSnippet : Snippet {
                 WifiP2pManager.WIFI_P2P_CONNECTION_CHANGED_ACTION -> {
                     history.add(ConnectionChanged(intent))
                 }
-                WifiP2pManager.WIFI_P2P_PEERS_CHANGED_ACTION -> {
-                    history.add(PeersChanged(intent))
-                }
             }
         }
 
@@ -126,12 +117,12 @@ class Wifip2pMultiDevicesSnippet : Snippet {
 
     @Rpc(description = "Wait for a p2p connection changed intent and check the group")
     @Suppress("DEPRECATION")
-    fun waitForP2pConnectionChanged(ignoreGroupCheck: Boolean, groupName: String) {
+    fun waitForP2pConnectionChanged(groupName: String) {
         wifip2pIntentReceiver.eventuallyExpectedIntent<ConnectionChanged>() {
             val p2pGroup: WifiP2pGroup? =
                     it.intent.getParcelableExtra(WifiP2pManager.EXTRA_WIFI_P2P_GROUP)
             val groupMatched = p2pGroup?.networkName == groupName
-            return@eventuallyExpectedIntent ignoreGroupCheck || groupMatched
+            return@eventuallyExpectedIntent groupMatched
         }
     }
 
@@ -154,61 +145,15 @@ class Wifip2pMultiDevicesSnippet : Snippet {
         createGroupFuture.get(TIMEOUT_MS, TimeUnit.MILLISECONDS)
 
         // Ensure the Wi-Fi P2P group is created.
-        waitForP2pConnectionChanged(false, groupName)
+        waitForP2pConnectionChanged(groupName)
     }
 
-    @Rpc(description = "Start Wi-Fi P2P peers discovery")
-    fun startPeersDiscovery() {
-        // Start discovery Wi-Fi P2P peers
-        wifip2pManager.discoverPeers(wifip2pChannel, null)
-
-        // Ensure the discovery is started
-        val p2pDiscoveryStartedFuture = CompletableFuture<Boolean>()
-        wifip2pManager.requestDiscoveryState(wifip2pChannel) { state ->
-            if (state == WifiP2pManager.WIFI_P2P_DISCOVERY_STARTED) {
-                p2pDiscoveryStartedFuture.complete(true)
-            }
-        }
-        p2pDiscoveryStartedFuture.get(TIMEOUT_MS, TimeUnit.MILLISECONDS)
-    }
-
-    /**
-     * Get the device address from the given intent that matches the given device name.
-     *
-     * @param peersChangedIntent the intent to get the device address from
-     * @param deviceName the target device name
-     * @return the address of the target device or null if no devices match.
-     */
-    @Suppress("DEPRECATION")
-    private fun getDeviceAddress(peersChangedIntent: Intent, deviceName: String): String? {
-        val peers: WifiP2pDeviceList? =
-                peersChangedIntent.getParcelableExtra(WifiP2pManager.EXTRA_P2P_DEVICE_LIST)
-        return peers?.deviceList?.firstOrNull { it.deviceName == deviceName }?.deviceAddress
-    }
-
-    /**
-     * Ensure the given device has been discovered and returns the associated device address for
-     * connection.
-     *
-     * @param deviceName the target device name
-     * @return the address of the target device.
-     */
-    @Rpc(description = "Ensure the target Wi-Fi P2P device is discovered")
-    fun ensureDeviceDiscovered(deviceName: String): String {
-        val changedEvent = wifip2pIntentReceiver.eventuallyExpectedIntent<PeersChanged>() {
-            return@eventuallyExpectedIntent getDeviceAddress(it.intent, deviceName) != null
-        }
-        return getDeviceAddress(changedEvent.intent, deviceName)
-                ?: fail("Missing device in filtered intent")
-    }
-
-    @Rpc(description = "Invite a Wi-Fi P2P device to the group")
-    fun inviteDeviceToGroup(groupName: String, groupPassphrase: String, deviceAddress: String) {
-        // Connect to the device to send invitation
+    @Rpc(description = "Connect to the group")
+    fun connectToGroup(groupName: String, groupPassphrase: String) {
+        // Connect to the p2p group with config
         val wifip2pConfig = WifiP2pConfig.Builder()
                 .setNetworkName(groupName)
                 .setPassphrase(groupPassphrase)
-                .setDeviceAddress(MacAddress.fromString(deviceAddress))
                 .build()
         val connectedFuture = CompletableFuture<Boolean>()
         wifip2pManager.connect(
@@ -224,76 +169,6 @@ class Wifip2pMultiDevicesSnippet : Snippet {
         connectedFuture.get(TIMEOUT_MS, TimeUnit.MILLISECONDS)
     }
 
-    private fun runExternalApproverForGroupProcess(
-            deviceAddress: String,
-            isGroupInvitation: Boolean
-    ) {
-        val peer = MacAddress.fromString(deviceAddress)
-        runAsShell(MANAGE_WIFI_NETWORK_SELECTION) {
-            val connectionRequestFuture = CompletableFuture<Boolean>()
-            val attachedFuture = CompletableFuture<Boolean>()
-            wifip2pManager.addExternalApprover(
-                    wifip2pChannel,
-                    peer,
-                    object : WifiP2pManager.ExternalApproverRequestListener {
-                        override fun onAttached(deviceAddress: MacAddress) {
-                            attachedFuture.complete(true)
-                        }
-                        override fun onDetached(deviceAddress: MacAddress, reason: Int) = Unit
-                        override fun onConnectionRequested(
-                                requestType: Int,
-                                config: WifiP2pConfig,
-                                device: WifiP2pDevice
-                        ) {
-                            connectionRequestFuture.complete(true)
-                        }
-                        override fun onPinGenerated(deviceAddress: MacAddress, pin: String) = Unit
-                    }
-            )
-            if (isGroupInvitation) attachedFuture.get(TIMEOUT_MS, TimeUnit.MILLISECONDS) else
-                connectionRequestFuture.get(TIMEOUT_MS, TimeUnit.MILLISECONDS)
-
-            val resultFuture = CompletableFuture<Boolean>()
-            wifip2pManager.setConnectionRequestResult(
-                    wifip2pChannel,
-                    peer,
-                    WifiP2pManager.CONNECTION_REQUEST_ACCEPT,
-                    object : WifiP2pManager.ActionListener {
-                        override fun onFailure(reason: Int) = Unit
-                        override fun onSuccess() {
-                            resultFuture.complete(true)
-                        }
-                    }
-            )
-            resultFuture.get(TIMEOUT_MS, TimeUnit.MILLISECONDS)
-
-            val removeFuture = CompletableFuture<Boolean>()
-            wifip2pManager.removeExternalApprover(
-                    wifip2pChannel,
-                    peer,
-                    object : WifiP2pManager.ActionListener {
-                        override fun onFailure(reason: Int) = Unit
-                        override fun onSuccess() {
-                            removeFuture.complete(true)
-                        }
-                    }
-            )
-            removeFuture.get(TIMEOUT_MS, TimeUnit.MILLISECONDS)
-        }
-    }
-
-    @Rpc(description = "Accept P2P group invitation from device")
-    fun acceptGroupInvitation(deviceAddress: String) {
-        // Accept the Wi-Fi P2P group invitation
-        runExternalApproverForGroupProcess(deviceAddress, true /* isGroupInvitation */)
-    }
-
-    @Rpc(description = "Wait for connection request from the peer and accept joining")
-    fun waitForPeerConnectionRequestAndAcceptJoining(deviceAddress: String) {
-        // Wait for connection request from the peer and accept joining
-        runExternalApproverForGroupProcess(deviceAddress, false /* isGroupInvitation */)
-    }
-
     @Rpc(description = "Ensure the target device is connected")
     fun ensureDeviceConnected(deviceName: String) {
         // Retrieve peers and ensure the target device is connected

From 0881fc0a7db523c3a4fa1e742525f5dd0b2255fd Mon Sep 17 00:00:00 2001
From: Jimi Chen <jimictw@google.com>
Date: Tue, 15 Apr 2025 05:35:21 +0000
Subject: [PATCH 219/377] Implement network avoid bad wifi from carrier config

Flag: android.net.platform.flags.avoid_bad_wifi_from_carrier_config
Bug: 410976315
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.connectivity.MultinetworkPolicyTrackerTest
Change-Id: I89c579a8d5c7299303278280c463aa4c7c5bea99
---
 service/Android.bp                            |   1 +
 .../android/server/ConnectivityService.java   |   2 +-
 .../MultinetworkPolicyTracker.java            | 244 +++++++++++++++--
 .../MultinetworkPolicyTrackerTest.kt          | 248 ++++++++++++++++--
 ...ltinetworkPolicyTrackerTestDependencies.kt |  49 +++-
 5 files changed, 495 insertions(+), 49 deletions(-)

diff --git a/service/Android.bp b/service/Android.bp
index 8b469e4e69..e71a6c176f 100644
--- a/service/Android.bp
+++ b/service/Android.bp
@@ -186,6 +186,7 @@ java_library {
     static_libs: [
         // Do not add libs here if they are already included
         // in framework-connectivity
+        "android.net.platform.flags-aconfig-java-export",
         "androidx.annotation_annotation",
         "connectivity-net-module-utils-bpf",
         "connectivity_native_aidl_interface-lateststable-java",
diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index 3b5f4030ab..97d67b5e08 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -6711,7 +6711,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
         pw.println("Config restrict:               " + configRestrict);
         pw.println("Actively prefer bad wifi:      " + activelyPreferBadWifi());
 
-        final String settingValue = mMultinetworkPolicyTracker.getAvoidBadWifiSetting();
+        final String settingValue = mMultinetworkPolicyTracker.readAvoidBadWifiFromSettings();
         String description;
         // Can't use a switch statement because strings are legal case labels, but null is not.
         if ("0".equals(settingValue)) {
diff --git a/service/src/com/android/server/connectivity/MultinetworkPolicyTracker.java b/service/src/com/android/server/connectivity/MultinetworkPolicyTracker.java
index 93018bb61a..60d27c353d 100644
--- a/service/src/com/android/server/connectivity/MultinetworkPolicyTracker.java
+++ b/service/src/com/android/server/connectivity/MultinetworkPolicyTracker.java
@@ -16,10 +16,12 @@
 
 package com.android.server.connectivity;
 
+import static android.content.pm.PackageManager.FEATURE_TELEPHONY_SUBSCRIPTION;
 import static android.net.ConnectivitySettingsManager.NETWORK_AVOID_BAD_WIFI;
 import static android.net.ConnectivitySettingsManager.NETWORK_METERED_MULTIPATH_PREFERENCE;
 
 import android.annotation.NonNull;
+import android.annotation.Nullable;
 import android.annotation.TargetApi;
 import android.content.BroadcastReceiver;
 import android.content.ContentResolver;
@@ -29,19 +31,26 @@ import android.content.IntentFilter;
 import android.content.res.Resources;
 import android.database.ContentObserver;
 import android.net.Uri;
+import android.net.platform.flags.Flags;
 import android.os.Build;
 import android.os.Handler;
+import android.os.PersistableBundle;
 import android.provider.DeviceConfig;
 import android.provider.Settings;
+import android.telephony.CarrierConfigManager;
 import android.telephony.SubscriptionManager;
 import android.telephony.TelephonyCallback;
 import android.telephony.TelephonyManager;
+import android.util.ArrayMap;
 import android.util.Log;
 
 import com.android.connectivity.resources.R;
+import com.android.internal.annotations.GuardedBy;
 import com.android.internal.annotations.VisibleForTesting;
+import com.android.modules.utils.BackgroundThread;
 import com.android.modules.utils.build.SdkLevel;
 import com.android.net.module.util.DeviceConfigUtils;
+import com.android.net.module.util.HandlerUtils;
 
 import java.util.Arrays;
 import java.util.List;
@@ -66,6 +75,23 @@ import java.util.concurrent.RejectedExecutionException;
  * @hide
  */
 public class MultinetworkPolicyTracker {
+    private class CarrierConfigChangeListener
+            implements CarrierConfigManager.CarrierConfigChangeListener {
+        /**
+         * Must be called on the background thread.
+         */
+        @Override
+        public void onCarrierConfigChanged(
+                    int slotIndex, int subId, int carrierId, int specificCarrierId) {
+            updateAvoidBadWifiFromCarrierConfigBackground(subId);
+        }
+    }
+
+    private enum AvoidBadWifiSource {
+        FROM_RESOURCE,
+        FROM_CARRIER_CONFIG,
+    }
+
     private static String TAG = MultinetworkPolicyTracker.class.getSimpleName();
 
     // See Dependencies#getConfigActivelyPreferBadWifi
@@ -79,7 +105,16 @@ public class MultinetworkPolicyTracker {
     private final ContentResolver mResolver;
     private final SettingObserver mSettingObserver;
     private final BroadcastReceiver mBroadcastReceiver;
+    private final boolean mAvoidBadWifiFromCarrierConfigFeature;
+    private final boolean mHasTelephonySubscription;
+    // This will be null if the FLAG_AVOID_BAD_WIFI_FROM_CARRIER_CONFIG is off
+    private final @Nullable CarrierConfigManager mCarrierConfigManager;
+    private final @Nullable CarrierConfigChangeListener mCarrierConfigChangeListener;
 
+    // This will be accessed by background and handler thread
+    @GuardedBy("mAvoidBadWifiCarrierConfigForSubIdMap")
+    private final ArrayMap<Integer, Boolean> mAvoidBadWifiCarrierConfigForSubIdMap =
+            new ArrayMap<>();
     private volatile boolean mAvoidBadWifi = true;
     private volatile int mMeteredMultipathPreference;
     private int mActiveSubId = SubscriptionManager.INVALID_SUBSCRIPTION_ID;
@@ -90,6 +125,11 @@ public class MultinetworkPolicyTracker {
      */
     @VisibleForTesting
     public static class Dependencies {
+        private boolean isCarrierConfigValid(PersistableBundle config) {
+            return config == null || config.isEmpty()
+                || !CarrierConfigManager.isConfigForIdentifiedCarrier(config);
+        }
+
         /**
          * @see DeviceConfigUtils#getDeviceConfigPropertyInt
          */
@@ -119,6 +159,44 @@ public class MultinetworkPolicyTracker {
             return SubscriptionManager.getResourcesForSubId(
                     resources.getResourcesContext(), activeSubId);
         }
+
+        @VisibleForTesting
+        protected boolean readAvoidBadWifiFromCarrierConfig(
+                @NonNull final Context context, final int subId) {
+            // Defaults to true to avoid potentially poor Wi-Fi and improve user experience.
+            final boolean defaultConfig = true;
+            if (subId == SubscriptionManager.INVALID_SUBSCRIPTION_ID) {
+                return defaultConfig;
+            }
+
+            PersistableBundle config = null;
+            final CarrierConfigManager ccm = context.getSystemService(CarrierConfigManager.class);
+
+            try {
+                config = ccm.getConfigForSubId(subId,
+                        CarrierConfigManager.KEY_AVOID_BAD_WIFI_BOOL
+                );
+            } catch (RuntimeException e) {
+                Log.e(TAG, "Failed to get config from carrier config", e);
+            }
+
+            if (isCarrierConfigValid(config)) {
+                // If the "avoid bad Wi-Fi" setting is not defined in the carrier-specific config,
+                // retrieve the default configuration.
+                config = CarrierConfigManager.getDefaultConfig();
+            }
+
+            return config.getBoolean(CarrierConfigManager.KEY_AVOID_BAD_WIFI_BOOL, defaultConfig);
+        }
+
+        protected boolean getAvoidBadWifiFromCarrierConfigFeature() {
+            return Flags.avoidBadWifiFromCarrierConfig();
+        }
+
+        protected Handler getBackgroundThreadHandler() {
+            return BackgroundThread.getHandler();
+        }
+
     }
     private final Dependencies mDeps;
 
@@ -164,7 +242,7 @@ public class MultinetworkPolicyTracker {
     protected class ActiveDataSubscriptionIdListener extends TelephonyCallback
             implements TelephonyCallback.ActiveDataSubscriptionIdListener {
         @Override
-        public void onActiveDataSubscriptionIdChanged(int subId) {
+        public void onActiveDataSubscriptionIdChanged(final int subId) {
             mActiveSubId = subId;
             reevaluateInternal();
         }
@@ -193,8 +271,21 @@ public class MultinetworkPolicyTracker {
             }
         };
 
-        updateAvoidBadWifi();
-        updateMeteredMultipathPreference();
+        mHasTelephonySubscription =
+            mContext.getPackageManager().hasSystemFeature(FEATURE_TELEPHONY_SUBSCRIPTION);
+        mAvoidBadWifiFromCarrierConfigFeature = mDeps.getAvoidBadWifiFromCarrierConfigFeature();
+        mCarrierConfigManager = mAvoidBadWifiFromCarrierConfigFeature
+            ? mContext.getSystemService(CarrierConfigManager.class)
+            : null;
+
+        mCarrierConfigChangeListener = mAvoidBadWifiFromCarrierConfigFeature
+            ? new CarrierConfigChangeListener()
+            : null;
+
+        if (!mAvoidBadWifiFromCarrierConfigFeature) {
+            updateAvoidBadWifi();
+            updateMeteredMultipathPreference();
+        }
     }
 
     // TODO: Set the mini sdk to 31 and remove @TargetApi annotation when b/205923322 is addressed.
@@ -212,8 +303,20 @@ public class MultinetworkPolicyTracker {
         final Executor handlerExecutor = new HandlerExecutor(mHandler);
         mContext.getSystemService(TelephonyManager.class).registerTelephonyCallback(
                 handlerExecutor, new ActiveDataSubscriptionIdListener());
-        mDeps.addOnDevicePropertiesChangedListener(handlerExecutor,
+
+        if (mAvoidBadWifiFromCarrierConfigFeature) {
+            mCarrierConfigManager.registerCarrierConfigChangeListener(
+                    BackgroundThread.getExecutor(), mCarrierConfigChangeListener
+            );
+
+            // This ensures the latest carrier configuration is read.
+            final int subId = mActiveSubId;
+            mDeps.getBackgroundThreadHandler().post(() ->
+                    updateAvoidBadWifiFromCarrierConfigBackground(subId));
+        } else {
+            mDeps.addOnDevicePropertiesChangedListener(handlerExecutor,
                 properties -> reevaluateInternal());
+        }
 
         reevaluate();
     }
@@ -222,6 +325,11 @@ public class MultinetworkPolicyTracker {
         mResolver.unregisterContentObserver(mSettingObserver);
 
         mContext.unregisterReceiver(mBroadcastReceiver);
+        if (mAvoidBadWifiFromCarrierConfigFeature) {
+            mCarrierConfigManager.unregisterCarrierConfigChangeListener(
+                    mCarrierConfigChangeListener
+            );
+        }
     }
 
     public boolean getAvoidBadWifi() {
@@ -287,10 +395,13 @@ public class MultinetworkPolicyTracker {
      * Whether we should display a notification when wifi becomes unvalidated.
      */
     public boolean shouldNotifyWifiUnvalidated() {
-        return configRestrictsAvoidBadWifi() && getAvoidBadWifiSetting() == null;
+        return configRestrictsAvoidBadWifi() && readAvoidBadWifiFromSettings() == null;
     }
 
-    public String getAvoidBadWifiSetting() {
+    /**
+     * Retrieves the "avoid bad Wi-Fi" setting from the global settings.
+     */
+    public String readAvoidBadWifiFromSettings() {
         return Settings.Global.getString(mResolver, NETWORK_AVOID_BAD_WIFI);
     }
 
@@ -332,20 +443,119 @@ public class MultinetworkPolicyTracker {
         updateMeteredMultipathPreference();
     }
 
-    public boolean updateAvoidBadWifi() {
-        final boolean settingAvoidBadWifi = "1".equals(getAvoidBadWifiSetting());
-        final boolean prevAvoid = mAvoidBadWifi;
-        mAvoidBadWifi = settingAvoidBadWifi || !configRestrictsAvoidBadWifi();
+    /**
+     * Reads the avoid bad Wi-Fi setting from the cache for a specific subscription ID.
+     * If no value is found for the given subId, it defaults to true.
+     */
+    private boolean readAvoidBadWifiFromCache(int subId) {
+        synchronized (mAvoidBadWifiCarrierConfigForSubIdMap) {
+            return mAvoidBadWifiCarrierConfigForSubIdMap.getOrDefault(subId, true);
+        }
+    }
 
-        final boolean prevActive = mActivelyPreferBadWifi;
-        final Boolean deviceConfigPreferBadWifi = deviceConfigActivelyPreferBadWifi();
-        if (null == deviceConfigPreferBadWifi) {
-            mActivelyPreferBadWifi = configActivelyPrefersBadWifi();
-        } else {
-            mActivelyPreferBadWifi = deviceConfigPreferBadWifi;
+    /**
+     * Updates the cached avoid bad Wi-Fi setting for a specific subscription ID.
+     */
+    private void updateAvoidBadWifiCache(int subId, boolean enable) {
+        synchronized (mAvoidBadWifiCarrierConfigForSubIdMap) {
+            mAvoidBadWifiCarrierConfigForSubIdMap.put(subId, enable);
+        }
+    }
+
+    /**
+     * Determines the source of the avoid bad Wi-Fi setting.
+     * It returns FROM_CARRIER_CONFIG if the carrier config feature is enabled,
+     * otherwise it returns FROM_RESOURCE.
+     *
+     */
+    private AvoidBadWifiSource getAvoidBadWifiSource() {
+        return mAvoidBadWifiFromCarrierConfigFeature
+            ? AvoidBadWifiSource.FROM_CARRIER_CONFIG
+            : AvoidBadWifiSource.FROM_RESOURCE;
+    }
+
+    /**
+     * Updates the local cache of the "avoid bad Wi-Fi" setting from the carrier config
+     * for a specific subscription ID.
+     * Must be called on the handler thread.
+     */
+    private void updateAvoidBadWifiFromCarrierConfig(int subId, boolean enable) {
+        updateAvoidBadWifiCache(subId, enable);
+
+        if (subId == mActiveSubId) {
+            reevaluateInternal();
+        }
+    }
+
+    /**
+     * Retrieves the "avoid bad Wi-Fi" setting from the carrier configuration for the given subId,
+     * and updates the local cache asynchronously on the handler thread.
+     * Must be called on the background thread, because it makes an IPC to the phone process.
+     * It must not be called on the CS handler thread.
+     */
+    private void updateAvoidBadWifiFromCarrierConfigBackground(int subId) {
+        HandlerUtils.ensureRunningOnHandlerThread(mDeps.getBackgroundThreadHandler());
+
+        if (subId == SubscriptionManager.INVALID_SUBSCRIPTION_ID) {
+            return;
         }
 
-        return mAvoidBadWifi != prevAvoid || mActivelyPreferBadWifi != prevActive;
+        // CarrierConfigManager#getConfigForSubId() is supported
+        // only when system has FEATURE_TELEPHONY_SUBSCRIPTION
+        final boolean config = !mHasTelephonySubscription
+                || mDeps.readAvoidBadWifiFromCarrierConfig(mContext, subId);
+        mHandler.post(() -> updateAvoidBadWifiFromCarrierConfig(subId, config));
+    }
+
+    /**
+     * Updates the "avoid bad Wi-Fi" setting.
+     * Depending on whether the carrier config feature is enabled, this method uses different logic:
+     *
+     * If carrier config feature is ON (Android U+ and 25Q4+):
+     * - Forces "actively prefer bad Wi-Fi" to true.
+     * - Checks a system setting first. If it is enabled, we should avoid bad Wi-Fi.
+     * - If the system setting isn't available, it uses a cached value from the carrier config
+     *   for the current subId.
+     *
+     * If carrier config feature is OFF:
+     * - "Avoid bad Wi-Fi" is true if the system setting is enabled OR
+     *    if the carrier doesn't restrict avoiding bad Wi-Fi.
+     * - "Actively prefer bad Wi-Fi" is based on a device-specific setting,
+     *    falling back to the carrier config if the device setting isn't available.
+     *
+     * Returns true if either the "avoid bad Wi-Fi" or "actively prefer bad Wi-Fi" setting changed,
+     * false otherwise.
+     */
+    public boolean updateAvoidBadWifi() {
+        final boolean prevAvoid = mAvoidBadWifi;
+        if (getAvoidBadWifiSource() == AvoidBadWifiSource.FROM_CARRIER_CONFIG) {
+            // Force update activelyPreferBadWifi since it will always be true in Android U+,
+            // and mAvoidBadWifiFromCarrierConfigFeature is a trunk stable flag
+            // that only exists in 25Q4+
+            mActivelyPreferBadWifi = true;
+
+            final String settingAvoidBadWifiStr = readAvoidBadWifiFromSettings();
+            if (settingAvoidBadWifiStr != null) {
+                mAvoidBadWifi = "1".equals(settingAvoidBadWifiStr);
+            } else {
+                // Retrieve the avoid bad Wi-Fi setting from the local cache to avoid potential
+                // issues or blocking from the IPC call getAvoidBadWifiCarrierConfigForSubId().
+                mAvoidBadWifi = readAvoidBadWifiFromCache(mActiveSubId);
+            }
+            return mAvoidBadWifi != prevAvoid;
+        } else {
+            final boolean settingAvoidBadWifi = "1".equals(readAvoidBadWifiFromSettings());
+            mAvoidBadWifi = settingAvoidBadWifi || !configRestrictsAvoidBadWifi();
+            final boolean prevActive = mActivelyPreferBadWifi;
+            final Boolean deviceConfigPreferBadWifi = deviceConfigActivelyPreferBadWifi();
+            if (null == deviceConfigPreferBadWifi) {
+                mActivelyPreferBadWifi = configActivelyPrefersBadWifi();
+            } else {
+                mActivelyPreferBadWifi = deviceConfigPreferBadWifi;
+            }
+
+            return mAvoidBadWifi != prevAvoid || mActivelyPreferBadWifi != prevActive;
+        }
     }
 
     /**
diff --git a/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTest.kt b/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTest.kt
index f19ba4f5c7..95a6d8c8bb 100644
--- a/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTest.kt
+++ b/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTest.kt
@@ -17,32 +17,40 @@
 package com.android.server.connectivity
 
 import android.content.Context
+import android.content.pm.PackageManager
 import android.content.res.Resources
 import android.net.ConnectivityManager.MULTIPATH_PREFERENCE_HANDOVER
 import android.net.ConnectivityManager.MULTIPATH_PREFERENCE_PERFORMANCE
 import android.net.ConnectivityManager.MULTIPATH_PREFERENCE_RELIABILITY
 import android.net.ConnectivitySettingsManager.NETWORK_AVOID_BAD_WIFI
 import android.net.ConnectivitySettingsManager.NETWORK_METERED_MULTIPATH_PREFERENCE
+import android.net.platform.flags.Flags.FLAG_AVOID_BAD_WIFI_FROM_CARRIER_CONFIG
 import android.os.Build
 import android.os.Handler
 import android.os.test.TestLooper
 import android.provider.Settings
+import android.telephony.CarrierConfigManager
 import android.telephony.SubscriptionInfo
 import android.telephony.SubscriptionManager
 import android.telephony.TelephonyManager
 import android.test.mock.MockContentResolver
 import androidx.test.filters.SmallTest
 import com.android.connectivity.resources.R
+import com.android.internal.os.BackgroundThread
 import com.android.internal.util.test.FakeSettingsProvider
 import com.android.modules.utils.build.SdkLevel
 import com.android.server.connectivity.MultinetworkPolicyTracker.ActiveDataSubscriptionIdListener
 import com.android.testutils.DevSdkIgnoreRule
 import com.android.testutils.DevSdkIgnoreRunner
+import com.android.testutils.com.android.testutils.SetFeatureFlagsRule
+import com.android.testutils.com.android.testutils.SetFeatureFlagsRule.FeatureFlag
+import com.android.testutils.postAndWait
 import org.junit.After
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertFalse
 import org.junit.Assert.assertTrue
 import org.junit.Before
+import org.junit.Rule
 import org.junit.Test
 import org.junit.runner.RunWith
 import org.mockito.ArgumentCaptor
@@ -66,56 +74,156 @@ const val HANDLER_TIMEOUT_MS = 400
 @SmallTest
 @DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.R)
 class MultinetworkPolicyTrackerTest {
+    // This wrapper class prevents JUnit from attempting to load unsupported system classes
+    // that are present in the System Test (S/T) image, which would otherwise cause test failures.
+    private class CarrierConfigChangeRunner(
+        val csLooper: TestLooper,
+        val bgHandler: Handler,
+        val listener: CarrierConfigManager.CarrierConfigChangeListener
+    ) {
+
+        fun runCarrierConfigChangeOnBackgroundThread(subId: Int) {
+            bgHandler.postAndWait {
+                    listener.onCarrierConfigChanged(
+                        0, /* logicalSlotIndex */
+                        subId, /* subscriptionId */
+                        0, /* carrierId */
+                        0 /* specificCarrierId */
+                    )
+                }
+                csLooper.dispatchNext()
+        }
+    }
+
+    private val featureFlags = HashSet<String>()
+
+    // This will set feature flags from @FeatureFlag annotations
+    // into the map before setUp() runs.
+    @get:Rule
+    val setFeatureFlagsRule = SetFeatureFlagsRule(
+        { name, enabled ->
+            if (enabled == true) featureFlags.add(name) else featureFlags.remove(name) },
+        { name -> featureFlags.contains(name) }
+    )
+
+    @get:Rule
+    val ignoreRule = DevSdkIgnoreRule()
+
     private val resources = mock(Resources::class.java).also {
         doReturn(0).`when`(it).getInteger(R.integer.config_networkAvoidBadWifi)
         doReturn(0).`when`(it).getInteger(R.integer.config_activelyPreferBadWifi)
     }
+
     private val telephonyManager = mock(TelephonyManager::class.java)
+    private val carrierConfigManager = mock(CarrierConfigManager::class.java)
     private val subscriptionManager = mock(SubscriptionManager::class.java).also {
         doReturn(null).`when`(it).getActiveSubscriptionInfo(anyInt())
     }
+    private val packageManager = mock(PackageManager::class.java).also {
+        doReturn(true).`when`(it)
+            .hasSystemFeature(PackageManager.FEATURE_TELEPHONY_SUBSCRIPTION)
+    }
     private val resolver = MockContentResolver().apply {
         addProvider(Settings.AUTHORITY, FakeSettingsProvider()) }
     private val context = mock(Context::class.java).also {
         doReturn(Context.TELEPHONY_SERVICE).`when`(it)
-                .getSystemServiceName(TelephonyManager::class.java)
+            .getSystemServiceName(TelephonyManager::class.java)
         doReturn(telephonyManager).`when`(it).getSystemService(Context.TELEPHONY_SERVICE)
         if (it.getSystemService(TelephonyManager::class.java) == null) {
             // Test is using mockito extended
             doCallRealMethod().`when`(it).getSystemService(TelephonyManager::class.java)
         }
         doReturn(subscriptionManager).`when`(it)
-                .getSystemService(Context.TELEPHONY_SUBSCRIPTION_SERVICE)
+            .getSystemService(Context.TELEPHONY_SUBSCRIPTION_SERVICE)
+        doReturn(carrierConfigManager).`when`(it)
+            .getSystemService(CarrierConfigManager::class.java)
         doReturn(resolver).`when`(it).contentResolver
         doReturn(resources).`when`(it).resources
         doReturn(it).`when`(it).createConfigurationContext(any())
+        doReturn(packageManager).`when`(it).packageManager
         Settings.Global.putString(resolver, NETWORK_AVOID_BAD_WIFI, "1")
         ConnectivityResources.setResourcesContextForTest(it)
     }
     private val csLooper = TestLooper()
     private val handler = Handler(csLooper.looper)
-    private val trackerDependencies = MultinetworkPolicyTrackerTestDependencies(resources)
-    private val tracker = MultinetworkPolicyTracker(context, handler,
-            null /* avoidBadWifiCallback */, trackerDependencies)
+    private val bgHandler = BackgroundThread.getHandler()
+    private val trackerDependencies =
+        MultinetworkPolicyTrackerTestDependencies(resources)
 
+    // this needs to be initialized in setUp() because
+    // the featureFlag from the annotation is not ready here
+    private lateinit var tracker: MultinetworkPolicyTracker
     private fun assertMultipathPreference(preference: Int) {
-        Settings.Global.putString(resolver, NETWORK_METERED_MULTIPATH_PREFERENCE,
-                preference.toString())
+        Settings.Global.putString(
+            resolver,
+            NETWORK_METERED_MULTIPATH_PREFERENCE,
+                preference.toString()
+        )
         tracker.updateMeteredMultipathPreference()
         assertEquals(preference, tracker.meteredMultipathPreference)
     }
 
+    private fun runOnActiveDataSubscriptionIdChanged() {
+        val testSubId = 1000
+        val subscriptionInfo = SubscriptionInfo(testSubId, ""/* iccId */, 1/* iccId */,
+            "TMO"/* displayName */, "TMO"/* carrierName */, 1/* nameSource */, 1/* iconTint */,
+            "123"/* number */, 1/* roaming */, null/* icon */, "310"/* mcc */, "210"/* mnc */,
+            ""/* countryIso */, false/* isEmbedded */, null/* nativeAccessRules */,
+            "1"/* cardString */)
+        doReturn(subscriptionInfo).`when`(subscriptionManager).getActiveSubscriptionInfo(testSubId)
+
+        // Modify avoidBadWifi and meteredMultipathPreference settings value and local variables in
+        // MultinetworkPolicyTracker should be also updated after subId changed.
+        Settings.Global.putString(resolver, NETWORK_AVOID_BAD_WIFI, "0")
+        Settings.Global.putString(
+            resolver,
+            NETWORK_METERED_MULTIPATH_PREFERENCE,
+            MULTIPATH_PREFERENCE_PERFORMANCE.toString()
+        )
+
+        assertTrue(tracker.avoidBadWifi)
+
+        val listenerCaptor = ArgumentCaptor.forClass(
+            ActiveDataSubscriptionIdListener::class.java
+        )
+        verify(telephonyManager, times(1))
+            .registerTelephonyCallback(any(), listenerCaptor.capture())
+        val listener = listenerCaptor.value
+        csLooper.dispatchAll()
+
+        // Mock the carrier configuration to return false
+        trackerDependencies.setAvoidBadWifiCarrierConfigForSubId(testSubId, false)
+        listener.onActiveDataSubscriptionIdChanged(testSubId)
+
+        // Check if avoidBadWifi and meteredMultipathPreference values have been updated.
+        assertFalse(tracker.avoidBadWifi)
+        assertEquals(MULTIPATH_PREFERENCE_PERFORMANCE, tracker.meteredMultipathPreference)
+    }
+
     @Before
     fun setUp() {
+        trackerDependencies.setAvoidBadWifiFromCarrierConfigFeature(
+            featureFlags.contains(FLAG_AVOID_BAD_WIFI_FROM_CARRIER_CONFIG)
+        )
+
+        trackerDependencies.setBackgroundThreadHandler(bgHandler)
+        tracker = MultinetworkPolicyTracker(
+            context,
+            handler,
+            null /* avoidBadWifiCallback */,
+            trackerDependencies
+        )
         tracker.start()
     }
 
     @After
     fun tearDown() {
         ConnectivityResources.setResourcesContextForTest(null)
+        trackerDependencies.resetAvoidBadWifiCarrierConfigForSubIdMap()
     }
 
     @Test
+    @FeatureFlag(name = FLAG_AVOID_BAD_WIFI_FROM_CARRIER_CONFIG, false)
     fun testUpdateMeteredMultipathPreference() {
         assertMultipathPreference(MULTIPATH_PREFERENCE_HANDOVER)
         assertMultipathPreference(MULTIPATH_PREFERENCE_RELIABILITY)
@@ -123,6 +231,7 @@ class MultinetworkPolicyTrackerTest {
     }
 
     @Test
+    @FeatureFlag(name = FLAG_AVOID_BAD_WIFI_FROM_CARRIER_CONFIG, false)
     fun testUpdateAvoidBadWifi() {
         doReturn(0).`when`(resources).getInteger(R.integer.config_activelyPreferBadWifi)
         Settings.Global.putString(resolver, NETWORK_AVOID_BAD_WIFI, "0")
@@ -165,32 +274,119 @@ class MultinetworkPolicyTrackerTest {
     }
 
     @Test
-    fun testOnActiveDataSubscriptionIdChanged() {
-        val testSubId = 1000
-        val subscriptionInfo = SubscriptionInfo(testSubId, ""/* iccId */, 1/* iccId */,
-                "TMO"/* displayName */, "TMO"/* carrierName */, 1/* nameSource */, 1/* iconTint */,
-                "123"/* number */, 1/* roaming */, null/* icon */, "310"/* mcc */, "210"/* mnc */,
-                ""/* countryIso */, false/* isEmbedded */, null/* nativeAccessRules */,
-                "1"/* cardString */)
-        doReturn(subscriptionInfo).`when`(subscriptionManager).getActiveSubscriptionInfo(testSubId)
+    @FeatureFlag(name = FLAG_AVOID_BAD_WIFI_FROM_CARRIER_CONFIG, false)
+    fun testOnActiveDataSubscriptionIdChangedFromResources() {
+        runOnActiveDataSubscriptionIdChanged()
+    }
 
-        // Modify avoidBadWifi and meteredMultipathPreference settings value and local variables in
-        // MultinetworkPolicyTracker should be also updated after subId changed.
+    @Test
+    @FeatureFlag(name = FLAG_AVOID_BAD_WIFI_FROM_CARRIER_CONFIG, true)
+    @DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.BAKLAVA)
+    fun testOnActiveDataSubscriptionIdChangedFromCarrierConfig() {
+        runOnActiveDataSubscriptionIdChanged()
+    }
+
+    @Test
+    @FeatureFlag(name = FLAG_AVOID_BAD_WIFI_FROM_CARRIER_CONFIG, true)
+    @DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.BAKLAVA)
+    fun testAvoidBadWifiWithGlobalSetting() {
+        val activeSubId = 1000
+        // Mock the initial global setting to false
         Settings.Global.putString(resolver, NETWORK_AVOID_BAD_WIFI, "0")
-        Settings.Global.putString(resolver, NETWORK_METERED_MULTIPATH_PREFERENCE,
-                MULTIPATH_PREFERENCE_PERFORMANCE.toString())
-
-        assertTrue(tracker.avoidBadWifi)
+        // Mock the initial carrier configuration to return true
+        trackerDependencies.setAvoidBadWifiCarrierConfigForSubId(activeSubId, true)
 
         val listenerCaptor = ArgumentCaptor.forClass(
-                ActiveDataSubscriptionIdListener::class.java)
+            ActiveDataSubscriptionIdListener::class.java
+        )
         verify(telephonyManager, times(1))
-                .registerTelephonyCallback(any(), listenerCaptor.capture())
+            .registerTelephonyCallback(any(), listenerCaptor.capture())
         val listener = listenerCaptor.value
-        listener.onActiveDataSubscriptionIdChanged(testSubId)
+        csLooper.dispatchAll()
 
-        // Check if avoidBadWifi and meteredMultipathPreference values have been updated.
+        // Simulate a change in the active data subscription ID to activeSubId.
+        listener.onActiveDataSubscriptionIdChanged(activeSubId)
+
+        // Assert that the tracker's avoidBadWifi flag is false based on global setting
         assertFalse(tracker.avoidBadWifi)
-        assertEquals(MULTIPATH_PREFERENCE_PERFORMANCE, tracker.meteredMultipathPreference)
+        assertTrue(tracker.activelyPreferBadWifi)
+
+        // Mock the initial global setting to true
+        Settings.Global.putString(resolver, NETWORK_AVOID_BAD_WIFI, "1")
+        // Mock the initial carrier configuration to return false
+        trackerDependencies.setAvoidBadWifiCarrierConfigForSubId(activeSubId, false)
+
+        // Assert that the tracker's avoidBadWifi flag is true based on global setting
+        assertTrue(tracker.updateAvoidBadWifi())
+        assertTrue(tracker.avoidBadWifi)
+        assertTrue(tracker.activelyPreferBadWifi)
+    }
+
+    @Test
+    @FeatureFlag(name = FLAG_AVOID_BAD_WIFI_FROM_CARRIER_CONFIG, true)
+    @DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.BAKLAVA)
+    fun testUpdateAvoidBadWifiOnCarrierConfigChange() {
+        // Mock the initial global setting to null
+        Settings.Global.putString(resolver, NETWORK_AVOID_BAD_WIFI, null)
+
+        val activeSubId = 1000
+        val listenerCaptor = ArgumentCaptor.forClass(
+            ActiveDataSubscriptionIdListener::class.java
+        )
+        verify(telephonyManager, times(1))
+            .registerTelephonyCallback(any(), listenerCaptor.capture())
+        val listener = listenerCaptor.value
+        // Simulate a change in the active data subscription ID to activeSubId.
+        listener.onActiveDataSubscriptionIdChanged(activeSubId)
+
+        val carrierConfiglistenCaptor = ArgumentCaptor.forClass(
+            CarrierConfigManager.CarrierConfigChangeListener::class.java
+        )
+
+        // Mock the initial carrier configuration to return false
+        trackerDependencies.setAvoidBadWifiCarrierConfigForSubId(activeSubId, false)
+        verify(carrierConfigManager, times(1))
+            .registerCarrierConfigChangeListener(any(), carrierConfiglistenCaptor.capture())
+
+        val carrierConfiglistener = carrierConfiglistenCaptor.value
+        // dispatch for the first carrier config initialization on the handler thread
+        csLooper.dispatchAll()
+
+        val runner = CarrierConfigChangeRunner(csLooper, bgHandler, carrierConfiglistener)
+        // Simulate a carrier configuration change for the initial activeSubId (1000),
+        // with avoid bad Wi-Fi set to false.
+        runner.runCarrierConfigChangeOnBackgroundThread(activeSubId)
+
+        // Assert that the tracker's avoidBadWifi flag is false after the carrier config change.
+        assertFalse(tracker.avoidBadWifi)
+        assertTrue(tracker.activelyPreferBadWifi)
+
+        // Mock the carrier configuration to now return true for KEY_AVOID_BAD_WIFI_BOOL.
+        trackerDependencies.setAvoidBadWifiCarrierConfigForSubId(activeSubId, true)
+        // Simulate another carrier configuration change for the same activeSubId (1000),
+        // now with avoid bad Wi-Fi set to true.
+        runner.runCarrierConfigChangeOnBackgroundThread(activeSubId)
+
+        // Assert that the tracker's avoidBadWifi flag is now true.
+        assertTrue(tracker.avoidBadWifi)
+        assertTrue(tracker.activelyPreferBadWifi)
+
+        val changedActiveSubId = 1001
+        // Mock the carrier configuration to return false
+        trackerDependencies.setAvoidBadWifiCarrierConfigForSubId(changedActiveSubId, false)
+        // Simulate a carrier configuration change for a different subscription ID.
+        runner.runCarrierConfigChangeOnBackgroundThread(changedActiveSubId)
+
+        // Assert that the tracker's avoidBadWifi flag remains true,
+        // because the config change was for a non-active subscription.
+        assertTrue(tracker.avoidBadWifi)
+        assertTrue(tracker.activelyPreferBadWifi)
+
+        // Simulate a change in the active data subscription ID to the new ID (1001).
+        listener.onActiveDataSubscriptionIdChanged(changedActiveSubId)
+        // Assert that the tracker's avoidBadWifi flag is now false,
+        // reflecting the carrier config of the new active subscription.
+        assertFalse(tracker.avoidBadWifi)
+        assertTrue(tracker.activelyPreferBadWifi)
     }
 }
diff --git a/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTestDependencies.kt b/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTestDependencies.kt
index 4c82c7688d..7285cbe32b 100644
--- a/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTestDependencies.kt
+++ b/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTestDependencies.kt
@@ -1,33 +1,60 @@
 package com.android.server.connectivity
 
+import android.content.Context
 import android.content.res.Resources
+import android.os.Handler
 import android.provider.DeviceConfig
 import android.provider.DeviceConfig.NAMESPACE_CONNECTIVITY
 import android.provider.DeviceConfig.OnPropertiesChangedListener
 import com.android.internal.annotations.GuardedBy
+import com.android.internal.os.BackgroundThread
 import com.android.server.connectivity.MultinetworkPolicyTracker.CONFIG_ACTIVELY_PREFER_BAD_WIFI
 import java.util.concurrent.Executor
 
-class MultinetworkPolicyTrackerTestDependencies(private val resources: Resources) :
-        MultinetworkPolicyTracker.Dependencies() {
+class MultinetworkPolicyTrackerTestDependencies(
+    private val resources: Resources
+) : MultinetworkPolicyTracker.Dependencies() {
     @GuardedBy("listeners")
     private var configActivelyPreferBadWifi = 0
+
     // TODO : move this to an actual fake device config object
     @GuardedBy("listeners")
     private val listeners = mutableListOf<Pair<Executor, OnPropertiesChangedListener>>()
 
+    private var avoidBadWifiFromCarrierConfigFeature = false
+    private val avoidBadWifiCarrierConfigForSubIdMap = HashMap<Int, Boolean>()
+    private var backgroundThreadHandler = BackgroundThread.getHandler()
+
     fun putConfigActivelyPreferBadWifi(value: Int) {
         synchronized(listeners) {
             if (value == configActivelyPreferBadWifi) return
             configActivelyPreferBadWifi = value
-            val p = DeviceConfig.Properties(NAMESPACE_CONNECTIVITY,
-                    mapOf(CONFIG_ACTIVELY_PREFER_BAD_WIFI to value.toString()))
+            val p = DeviceConfig.Properties(
+                NAMESPACE_CONNECTIVITY,
+                mapOf(CONFIG_ACTIVELY_PREFER_BAD_WIFI to value.toString())
+            )
             listeners.forEach { (executor, listener) ->
                 executor.execute { listener.onPropertiesChanged(p) }
             }
         }
     }
 
+    fun setAvoidBadWifiFromCarrierConfigFeature(value: Boolean) {
+        avoidBadWifiFromCarrierConfigFeature = value
+    }
+
+    fun setAvoidBadWifiCarrierConfigForSubId(subId: Int, value: Boolean) {
+        avoidBadWifiCarrierConfigForSubIdMap[subId] = value
+    }
+
+    fun resetAvoidBadWifiCarrierConfigForSubIdMap() {
+        avoidBadWifiCarrierConfigForSubIdMap.clear()
+    }
+
+    fun setBackgroundThreadHandler(handler: Handler) {
+        backgroundThreadHandler = handler
+    }
+
     override fun getConfigActivelyPreferBadWifi(): Int {
         return synchronized(listeners) { configActivelyPreferBadWifi }
     }
@@ -42,5 +69,17 @@ class MultinetworkPolicyTrackerTestDependencies(private val resources: Resources
     }
 
     override fun getResourcesForActiveSubId(res: ConnectivityResources, id: Int): Resources =
-            resources
+        resources
+
+    override fun readAvoidBadWifiFromCarrierConfig(
+        context: Context,
+        subId: Int
+    ): Boolean =
+        avoidBadWifiCarrierConfigForSubIdMap.getOrDefault(subId, true)
+
+    public override fun getAvoidBadWifiFromCarrierConfigFeature(): Boolean =
+        avoidBadWifiFromCarrierConfigFeature
+
+    public override fun getBackgroundThreadHandler(): Handler =
+        backgroundThreadHandler
 }

From 638c43f201360619e800c1500137a64e63a57184 Mon Sep 17 00:00:00 2001
From: Junyu Lai <junyulai@google.com>
Date: Tue, 6 May 2025 10:38:05 +0800
Subject: [PATCH 220/377] Add Kill Switch for PermissionMonitor Refactoring

As a follow-up to ag/33089478 and ag/33101784, the intent
receiving and dispatching logic was refactored and centralized
within the newly introduced BroadcastReceiveHelper.

However, due to the potential risks associated with this
refactoring, a kill switch is being added specifically for the
PermissionMonitor refactoring. This will allow for reverting
to the previous implementation (potentially involving code
duplication) to mitigate risks if issues arise.

Flag: EXEMPT flagged with a kill switch
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.connectivity.PermissionMonitorTest \
      ConnectivityCoverageTests:android.net.connectivity.com.android.server.ConnectivityServiceTest \
      --update-device
Bug: 410731080
Change-Id: I7889ef457d841c750da60a80e50ed6208c45448f
---
 .../android/server/ConnectivityService.java   |  20 ++-
 .../connectivity/ConnectivityFlags.java       |  13 ++
 .../connectivity/PermissionMonitor.java       | 125 ++++++++++++++++++
 .../server/ConnectivityServiceTest.java       |   5 +
 .../connectivity/PermissionMonitorTest.java   |  73 +++++++++-
 .../server/connectivityservice/base/CSTest.kt |   1 +
 6 files changed, 230 insertions(+), 7 deletions(-)

diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index 334edc74bf..b8e94122b9 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -7759,7 +7759,9 @@ public class ConnectivityService extends IConnectivityManager.Stub
         updateProfileAllowedNetworks();
         final List<PackageInfo> apps = mContext.getPackageManager()
                 .getInstalledPackagesAsUser(GET_PERMISSIONS, user.getIdentifier());
-        mPermissionMonitor.onUserAddedWithInstalledPackageList(user, apps);
+        if (mPermissionMonitor.useBroadcastReceiveHelper()) {
+            mPermissionMonitor.onUserAddedWithInstalledPackageList(user, apps);
+        }
         if (mSatelliteAccessController != null) {
             mSatelliteAccessController.onUserAddedWithInstalledPackageList(user, apps);
         }
@@ -7775,7 +7777,9 @@ public class ConnectivityService extends IConnectivityManager.Stub
         if (mOemNetworkPreferences.getNetworkPreferences().size() > 0) {
             handleSetOemNetworkPreference(mOemNetworkPreferences, null);
         }
-        mPermissionMonitor.onUserRemoved(user);
+        if (mPermissionMonitor.useBroadcastReceiveHelper()) {
+            mPermissionMonitor.onUserRemoved(user);
+        }
         if (mSatelliteAccessController != null) {
             mSatelliteAccessController.onUserRemoved(user);
         }
@@ -7784,7 +7788,9 @@ public class ConnectivityService extends IConnectivityManager.Stub
     @Override
     public void onPackageAdded(@NonNull final String packageName, final int uid) {
         handlePackageChanged(packageName);
-        mPermissionMonitor.onPackageAdded(packageName, uid);
+        if (mPermissionMonitor.useBroadcastReceiveHelper()) {
+            mPermissionMonitor.onPackageAdded(packageName, uid);
+        }
         if (mSatelliteAccessController != null) {
             mSatelliteAccessController.onPackageAdded(packageName, uid);
         }
@@ -7793,7 +7799,9 @@ public class ConnectivityService extends IConnectivityManager.Stub
     @Override
     public void onPackageRemoved(@NonNull final String packageName, final int uid) {
         handlePackageChanged(packageName);
-        mPermissionMonitor.onPackageRemoved(packageName, uid);
+        if (mPermissionMonitor.useBroadcastReceiveHelper()) {
+            mPermissionMonitor.onPackageRemoved(packageName, uid);
+        }
         if (mSatelliteAccessController != null) {
             mSatelliteAccessController.onPackageRemoved(packageName, uid);
         }
@@ -7806,7 +7814,9 @@ public class ConnectivityService extends IConnectivityManager.Stub
 
     @Override
     public void onExternalApplicationsAvailable(@Nullable String[] pkgList) {
-        mPermissionMonitor.onExternalApplicationsAvailable(pkgList);
+        if (mPermissionMonitor.useBroadcastReceiveHelper()) {
+            mPermissionMonitor.onExternalApplicationsAvailable(pkgList);
+        }
         if (mSatelliteAccessController != null) {
             mSatelliteAccessController.onExternalApplicationsAvailable((pkgList));
         }
diff --git a/service/src/com/android/server/connectivity/ConnectivityFlags.java b/service/src/com/android/server/connectivity/ConnectivityFlags.java
index 06f3d63291..0905fbec1e 100644
--- a/service/src/com/android/server/connectivity/ConnectivityFlags.java
+++ b/service/src/com/android/server/connectivity/ConnectivityFlags.java
@@ -79,6 +79,19 @@ public final class ConnectivityFlags {
     public static final String EARLY_LINK_PROPERTIES_UPDATE_FOR_VPN =
             "early_link_properties_update_for_vpn";
 
+    /**
+     * Kill switch for the PermissionMonitor refactoring that centralizes intent
+     * receiving and dispatching within the {@link BroadcastReceiveHelper}.
+     * If enabled, the refactored logic in {@link BroadcastReceiveHelper} will be used.
+     * If disabled, the PermissionMonitor will revert to its previous implementation
+     * for receiving and dispatching intents.
+     *
+     * This flag is introduced as a risk mitigation strategy in case issues are
+     * discovered with the new refactored implementation.
+     */
+    public static final String USE_BROADCAST_RECEIVE_HELPER_FOR_PERMISSION_MONITOR =
+            "use_broadcast_receive_helper_for_permission_monitor";
+
     private boolean mNoRematchAllRequestsOnRegister;
 
     /**
diff --git a/service/src/com/android/server/connectivity/PermissionMonitor.java b/service/src/com/android/server/connectivity/PermissionMonitor.java
index 9e4bb689a6..48f68051d1 100755
--- a/service/src/com/android/server/connectivity/PermissionMonitor.java
+++ b/service/src/com/android/server/connectivity/PermissionMonitor.java
@@ -30,6 +30,7 @@ import static android.net.connectivity.ConnectivityCompatChanges.RESTRICT_LOCAL_
 import static android.os.Process.INVALID_UID;
 import static android.os.Process.SYSTEM_UID;
 
+import static com.android.server.connectivity.ConnectivityFlags.USE_BROADCAST_RECEIVE_HELPER_FOR_PERMISSION_MONITOR;
 import static com.android.server.connectivity.NetworkPermissions.PERMISSION_NETWORK;
 import static com.android.server.connectivity.NetworkPermissions.PERMISSION_NONE;
 import static com.android.server.connectivity.NetworkPermissions.PERMISSION_SYSTEM;
@@ -40,9 +41,13 @@ import static com.android.net.module.util.CollectionUtils.toIntArray;
 
 import android.annotation.NonNull;
 import android.annotation.Nullable;
+import android.annotation.SuppressLint;
 import android.app.compat.CompatChanges;
 import android.content.AttributionSource;
+import android.content.BroadcastReceiver;
 import android.content.Context;
+import android.content.Intent;
+import android.content.IntentFilter;
 import android.content.pm.ApplicationInfo;
 import android.content.pm.PackageInfo;
 import android.content.pm.PackageManager;
@@ -60,6 +65,7 @@ import android.os.RemoteException;
 import android.os.ServiceSpecificException;
 import android.os.SystemConfigManager;
 import android.os.UserHandle;
+import android.os.UserManager;
 import android.permission.PermissionManager;
 import android.provider.Settings;
 import android.util.ArrayMap;
@@ -72,6 +78,7 @@ import com.android.internal.annotations.VisibleForTesting;
 import com.android.internal.util.IndentingPrintWriter;
 import com.android.modules.utils.build.SdkLevel;
 import com.android.net.module.util.CollectionUtils;
+import com.android.net.module.util.DeviceConfigUtils;
 import com.android.net.module.util.SharedLog;
 import com.android.networkstack.apishim.ProcessShimImpl;
 import com.android.networkstack.apishim.common.ProcessShim;
@@ -93,6 +100,7 @@ public class PermissionMonitor {
     private static final int VERSION_Q = Build.VERSION_CODES.Q;
 
     private final PackageManager mPackageManager;
+    private final UserManager mUserManager;
     private final SystemConfigManager mSystemConfigManager;
     private final PermissionManager mPermissionManager;
     private final PermissionChangeListener mPermissionChangeListener;
@@ -156,6 +164,54 @@ public class PermissionMonitor {
 
     private static final int MAX_PERMISSION_UPDATE_LOGS = 40;
     private final SharedLog mPermissionUpdateLogs = new SharedLog(MAX_PERMISSION_UPDATE_LOGS, TAG);
+    private final boolean mUseBroadcastReceiveHelper;
+
+    private final BroadcastReceiver mIntentReceiver = new BroadcastReceiver() {
+        @Override
+        public void onReceive(Context context, Intent intent) {
+            if (mUseBroadcastReceiveHelper) {
+                throw new IllegalStateException(
+                        "This should only be called if UseBroadcastReceiveHelper is false");
+            }
+            final String action = intent.getAction();
+
+            if (Intent.ACTION_PACKAGE_ADDED.equals(action)) {
+                final int uid = intent.getIntExtra(Intent.EXTRA_UID, -1);
+                final Uri packageData = intent.getData();
+                final String packageName =
+                        packageData != null ? packageData.getSchemeSpecificPart() : null;
+                onPackageAdded(packageName, uid);
+            } else if (Intent.ACTION_PACKAGE_REMOVED.equals(action)) {
+                final int uid = intent.getIntExtra(Intent.EXTRA_UID, -1);
+                final Uri packageData = intent.getData();
+                final String packageName =
+                        packageData != null ? packageData.getSchemeSpecificPart() : null;
+                onPackageRemoved(packageName, uid);
+            } else if (Intent.ACTION_EXTERNAL_APPLICATIONS_AVAILABLE.equals(action)) {
+                final String[] pkgList =
+                        intent.getStringArrayExtra(Intent.EXTRA_CHANGED_PACKAGE_LIST);
+                onExternalApplicationsAvailable(pkgList);
+            } else if (Intent.ACTION_USER_ADDED.equals(action)) {
+                final UserHandle user = intent.getParcelableExtra(Intent.EXTRA_USER);
+                // User should be filled for below intents, check the existence.
+                if (user == null) {
+                    Log.wtf(TAG, action + " broadcast without EXTRA_USER");
+                    return;
+                }
+                onUserAdded(user);
+            } else if (Intent.ACTION_USER_REMOVED.equals(action)) {
+                final UserHandle user = intent.getParcelableExtra(Intent.EXTRA_USER);
+                // User should be filled for below intents, check the existence.
+                if (user == null) {
+                    Log.wtf(TAG, action + " broadcast without EXTRA_USER");
+                    return;
+                }
+                onUserRemoved(user);
+            } else {
+                Log.wtf(TAG, "received unexpected intent: " + action);
+            }
+        }
+    };
 
     /**
      * Dependencies of PermissionMonitor, for injection in tests.
@@ -190,6 +246,13 @@ public class PermissionMonitor {
             return BpfNetMaps.isAtLeast25Q2() &&
                     CompatChanges.isChangeEnabled(RESTRICT_LOCAL_NETWORK, uid);
         }
+
+        /**
+         * @see DeviceConfigUtils#isTetheringFeatureNotChickenedOut
+         */
+        public boolean isFeatureNotChickenedOut(Context context, String name) {
+            return DeviceConfigUtils.isTetheringFeatureNotChickenedOut(context, name);
+        }
     }
 
     private static class MultiSet<T> {
@@ -250,6 +313,13 @@ public class PermissionMonitor {
             // restrictions can only occur after this registration has completed.
             mPackageManager.addOnPermissionsChangeListener(mPermissionChangeListener);
         }
+        mUseBroadcastReceiveHelper = mDeps.isFeatureNotChickenedOut(
+                mContext, USE_BROADCAST_RECEIVE_HELPER_FOR_PERMISSION_MONITOR);
+        if (!mUseBroadcastReceiveHelper) {
+            mUserManager = context.getSystemService(UserManager.class);
+        } else {
+            mUserManager = null;
+        }
     }
 
     @VisibleForTesting
@@ -406,12 +476,39 @@ public class PermissionMonitor {
      * Intended to be called only once at startup, in the systemReady phase.
      * This shouldn't/needn't be called again.
      */
+    @SuppressLint("MissingPermission")
     public synchronized void initialize() {
         log("Initialize");
 
         final Handler handler = new Handler(mThread.getLooper());
         final Context userAllContext = mContext.createContextAsUser(UserHandle.ALL, 0 /* flags */);
 
+        if (!mUseBroadcastReceiveHelper) {
+            final IntentFilter intentFilter = new IntentFilter();
+            intentFilter.addAction(Intent.ACTION_PACKAGE_ADDED);
+            intentFilter.addAction(Intent.ACTION_PACKAGE_REMOVED);
+            intentFilter.addDataScheme("package");
+            userAllContext.registerReceiver(
+                    mIntentReceiver, intentFilter, null /* broadcastPermission */, handler);
+
+            // Listen to EXTERNAL_APPLICATIONS_AVAILABLE is that an app becoming
+            // available means it may need to gain a permission. But an app that
+            // becomes unavailable can neither gain nor lose permissions on that
+            // account, it just can no longer run. Thus, doesn't need to listen to
+            // EXTERNAL_APPLICATIONS_UNAVAILABLE.
+            final IntentFilter externalIntentFilter =
+                    new IntentFilter(Intent.ACTION_EXTERNAL_APPLICATIONS_AVAILABLE);
+            userAllContext.registerReceiver(
+                    mIntentReceiver, externalIntentFilter, null /* broadcastPermission */, handler);
+
+            // Listen for user add/remove.
+            final IntentFilter userIntentFilter = new IntentFilter();
+            userIntentFilter.addAction(Intent.ACTION_USER_ADDED);
+            userIntentFilter.addAction(Intent.ACTION_USER_REMOVED);
+            userAllContext.registerReceiver(
+                    mIntentReceiver, userIntentFilter, null /* broadcastPermission */, handler);
+        }
+
         // Register UIDS_ALLOWED_ON_RESTRICTED_NETWORKS setting observer
         mDeps.registerContentObserver(
                 userAllContext,
@@ -432,9 +529,26 @@ public class PermissionMonitor {
         // are not specific to any particular user.
         mUsersTrafficPermissions.put(UserHandle.ALL, getSystemTrafficPerm());
 
+        if (!mUseBroadcastReceiveHelper) {
+            final List<UserHandle> usrs = mUserManager.getUserHandles(true /* excludeDying */);
+            // Update netd permissions for all users.
+            for (UserHandle user : usrs) {
+                onUserAdded(user);
+            }
+        }
+
         log("UidToNetworkPerm: " + mUidToNetworkPerm.size());
     }
 
+    /**
+     * Indicates whether the BroadcastReceiveHelper should be used by PermissionMonitor.
+     *
+     * This flag value is initialized in the constructor, ensuring consistency across sub-modules.
+     */
+    public boolean useBroadcastReceiveHelper() {
+        return mUseBroadcastReceiveHelper;
+    }
+
     @VisibleForTesting
     synchronized void updateUidsAllowedOnRestrictedNetworks(final Set<Integer> uids) {
         mUidsAllowedOnRestrictedNetworks.clear();
@@ -540,6 +654,17 @@ public class PermissionMonitor {
         }
     }
 
+    @SuppressLint("MissingPermission")
+    private synchronized void onUserAdded(@NonNull UserHandle user) {
+        if (mUseBroadcastReceiveHelper) {
+            throw new IllegalStateException(
+                    "This should only be called if UseBroadcastReceiveHelper is false");
+        }
+        final List<PackageInfo> apps =  mPackageManager.getInstalledPackagesAsUser(
+                GET_PERMISSIONS, user.getIdentifier());
+        onUserAddedWithInstalledPackageList(user, apps);
+    }
+
     /**
      * Called when a user is added. See {link #ACTION_USER_ADDED}.
      *
diff --git a/tests/unit/java/com/android/server/ConnectivityServiceTest.java b/tests/unit/java/com/android/server/ConnectivityServiceTest.java
index 1a3a399024..b144cd17a3 100755
--- a/tests/unit/java/com/android/server/ConnectivityServiceTest.java
+++ b/tests/unit/java/com/android/server/ConnectivityServiceTest.java
@@ -2412,6 +2412,11 @@ public class ConnectivityServiceTest {
         public boolean shouldEnforceLocalNetRestrictions(int uid) {
             return false;
         }
+
+        @Override
+        public boolean isFeatureNotChickenedOut(Context context, String name) {
+            return true;
+        }
     }
 
     private class AutomaticOnOffKeepaliveTrackerDependencies
diff --git a/tests/unit/java/com/android/server/connectivity/PermissionMonitorTest.java b/tests/unit/java/com/android/server/connectivity/PermissionMonitorTest.java
index a2a9422e6c..04cb639b30 100644
--- a/tests/unit/java/com/android/server/connectivity/PermissionMonitorTest.java
+++ b/tests/unit/java/com/android/server/connectivity/PermissionMonitorTest.java
@@ -24,6 +24,7 @@ import static android.Manifest.permission.INTERNET;
 import static android.Manifest.permission.NEARBY_WIFI_DEVICES;
 import static android.Manifest.permission.NETWORK_STACK;
 import static android.Manifest.permission.OBSERVE_GRANT_REVOKE_PERMISSIONS;
+import static android.Manifest.permission.READ_DEVICE_CONFIG;
 import static android.Manifest.permission.UPDATE_DEVICE_STATS;
 import static android.content.pm.ApplicationInfo.PRIVATE_FLAG_OEM;
 import static android.content.pm.ApplicationInfo.PRIVATE_FLAG_PRODUCT;
@@ -45,6 +46,7 @@ import static android.net.connectivity.ConnectivityCompatChanges.RESTRICT_LOCAL_
 import static android.os.Process.SYSTEM_UID;
 import static android.permission.PermissionManager.PERMISSION_GRANTED;
 
+import static com.android.server.connectivity.ConnectivityFlags.USE_BROADCAST_RECEIVE_HELPER_FOR_PERMISSION_MONITOR;
 import static com.android.server.connectivity.PermissionMonitor.isHigherNetworkPermission;
 import static com.android.testutils.TestPermissionUtil.runAsShell;
 
@@ -75,7 +77,9 @@ import static org.mockito.Mockito.when;
 
 import android.compat.testing.PlatformCompatChangeRule;
 import android.content.AttributionSource;
+import android.content.BroadcastReceiver;
 import android.content.Context;
+import android.content.Intent;
 import android.content.pm.ApplicationInfo;
 import android.content.pm.PackageInfo;
 import android.content.pm.PackageManager;
@@ -109,6 +113,8 @@ import com.android.testutils.DevSdkIgnoreRule;
 import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo;
 import com.android.testutils.DevSdkIgnoreRunner;
 import com.android.testutils.HandlerUtils;
+import com.android.testutils.com.android.testutils.SetFeatureFlagsRule;
+import com.android.testutils.com.android.testutils.SetFeatureFlagsRule.FeatureFlag;
 
 import libcore.junit.util.compat.CoreCompatChangeRule.EnableCompatChanges;
 
@@ -126,6 +132,7 @@ import org.mockito.invocation.InvocationOnMock;
 
 import java.lang.reflect.Array;
 import java.util.Arrays;
+import java.util.HashMap;
 import java.util.List;
 import java.util.Set;
 
@@ -135,6 +142,17 @@ import java.util.Set;
 public class PermissionMonitorTest {
     @Rule
     public TestRule compatChangeRule = new PlatformCompatChangeRule();
+
+    final HashMap<String, Boolean> mFeatureFlags = new HashMap<>();
+    // This will set feature flags from @FeatureFlag annotations
+    // into the map before setUp() runs.
+    @Rule
+    public final SetFeatureFlagsRule mSetFeatureFlagsRule =
+            new SetFeatureFlagsRule((name, enabled) -> {
+                mFeatureFlags.put(name, enabled);
+                return null;
+            }, (name) -> mFeatureFlags.getOrDefault(name, false));
+
     private static final int MOCK_USER_ID1 = 0;
     private static final int MOCK_USER_ID2 = 1;
     private static final int MOCK_USER_ID3 = 2;
@@ -200,7 +218,7 @@ public class PermissionMonitorTest {
     public void setUp() throws Exception {
         MockitoAnnotations.initMocks(this);
         when(mContext.getPackageManager()).thenReturn(mPackageManager);
-        when(mContext.getSystemService(eq(Context.USER_SERVICE))).thenReturn(mUserManager);
+        when(mContext.getSystemService(UserManager.class)).thenReturn(mUserManager);
         when(mContext.getSystemService(PermissionManager.class)).thenReturn(mPermissionManager);
         when(mContext.getSystemServiceName(SystemConfigManager.class))
                 .thenReturn(Context.SYSTEM_CONFIG_SERVICE);
@@ -222,6 +240,8 @@ public class PermissionMonitorTest {
         // Set DEVICE_INITIAL_SDK_INT to Q that SYSTEM_UID won't have restricted network permission
         // by default.
         doReturn(VERSION_Q).when(mDeps).getDeviceFirstSdkInt();
+        doAnswer(invocation -> mFeatureFlags.getOrDefault((String) invocation.getArgument(1), true))
+                .when(mDeps).isFeatureNotChickenedOut(any(), anyString());
 
         mHandlerThread = new HandlerThread("PermissionMonitorTest");
         mPermissionMonitor = new PermissionMonitor(
@@ -1408,7 +1428,7 @@ public class PermissionMonitorTest {
         // necessary permission.
         final Context realContext = InstrumentationRegistry.getContext();
         final PermissionMonitor monitor = runAsShell(
-                OBSERVE_GRANT_REVOKE_PERMISSIONS,
+                OBSERVE_GRANT_REVOKE_PERMISSIONS, READ_DEVICE_CONFIG,
                 () -> new PermissionMonitor(realContext, mNetdService, mBpfNetMaps, mHandlerThread)
         );
         final PackageManager manager = realContext.getPackageManager();
@@ -1431,15 +1451,64 @@ public class PermissionMonitorTest {
         mBpfMapMonitor.expectTrafficPerm(PERMISSION_TRAFFIC_ALL, MOCK_APPID2);
     }
 
+    private BroadcastReceiver expectBroadcastReceiver(String... actions) {
+        final ArgumentCaptor<BroadcastReceiver> receiverCaptor =
+                ArgumentCaptor.forClass(BroadcastReceiver.class);
+        verify(mContext, times(1)).registerReceiver(receiverCaptor.capture(),
+                argThat(filter -> {
+                    for (String action : actions) {
+                        if (!filter.hasAction(action)) {
+                            return false;
+                        }
+                    }
+                    return true;
+                }), any(), any());
+        final BroadcastReceiver originalReceiver = receiverCaptor.getValue();
+        return new BroadcastReceiver() {
+            @Override
+            public void onReceive(Context context, Intent intent) {
+                processOnHandlerThread(() -> originalReceiver.onReceive(context, intent));
+            }
+        };
+    }
+
     private void processOnHandlerThread(Runnable function) {
         final Handler handler = mHandlerThread.getThreadHandler();
         handler.post(() -> function.run());
         HandlerUtils.waitForIdle(mHandlerThread, TIMEOUT_MS);
     }
 
+    @Test
+    @EnableCompatChanges(RESTRICT_LOCAL_NETWORK)
+    @FeatureFlag(name = USE_BROADCAST_RECEIVE_HELPER_FOR_PERMISSION_MONITOR, enabled = false)
+    public void testUidPermissionWhenPackageAddedRemovedWithIntent() throws Exception {
+        doReturn(List.of(MOCK_USER1)).when(mUserManager).getUserHandles(eq(true));
+        initialize();
+        assertFalse(mPermissionMonitor.useBroadcastReceiveHelper());
+
+        final BroadcastReceiver receiver = expectBroadcastReceiver(
+                Intent.ACTION_PACKAGE_ADDED, Intent.ACTION_PACKAGE_REMOVED);
+        // Add/Remove package and verify uid permissions.
+        final Intent addedIntent = new Intent(Intent.ACTION_PACKAGE_ADDED,
+                Uri.fromParts("package", MOCK_PACKAGE1, null /* fragment */));
+        addedIntent.putExtra(Intent.EXTRA_UID, MOCK_UID11);
+        buildAndMockPackageInfoWithPermissions(MOCK_PACKAGE1, MOCK_UID11, INTERNET,
+                UPDATE_DEVICE_STATS);
+        receiver.onReceive(mContext, addedIntent);
+        mBpfMapMonitor.expectTrafficPerm(PERMISSION_TRAFFIC_ALL, MOCK_APPID1);
+
+        when(mPackageManager.getPackagesForUid(MOCK_UID11)).thenReturn(new String[]{});
+        final Intent removedIntent = new Intent(Intent.ACTION_PACKAGE_REMOVED,
+                Uri.fromParts("package", MOCK_PACKAGE1, null /* fragment */));
+        removedIntent.putExtra(Intent.EXTRA_UID, MOCK_UID11);
+        receiver.onReceive(mContext, removedIntent);
+        mBpfMapMonitor.expectTrafficPerm(PERMISSION_UNINSTALLED, MOCK_APPID1);
+    }
+
     @Test
     @EnableCompatChanges(RESTRICT_LOCAL_NETWORK)
     public void testUidPermissionWhenPackageAddedRemoved() throws Exception {
+        assertTrue(mPermissionMonitor.useBroadcastReceiveHelper());
         initialize();
         onUserAddedWithInstalledPackageList(MOCK_USER1, List.of());
 
diff --git a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
index afa8d13ac1..0a915df77c 100644
--- a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
@@ -431,6 +431,7 @@ open class CSTest {
 
     inner class PermDeps : PermissionMonitor.Dependencies() {
         override fun shouldEnforceLocalNetRestrictions(uid: Int) = false
+        override fun isFeatureNotChickenedOut(context: Context?, name: String?) = true
     }
 
     inner class CSContext(base: Context) : BroadcastInterceptingContext(base) {

From c037b5d94f4085122d847596aa833a555d805ee6 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Thu, 8 May 2025 15:27:05 -0700
Subject: [PATCH 221/377] Remove unused constant

TIMEOUT_MS is unused.

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: Ifd1635181013a587a9ff8cfafdcd81cf2b64f0c0
---
 service/src/com/android/server/L2capNetworkProvider.java | 1 -
 1 file changed, 1 deletion(-)

diff --git a/service/src/com/android/server/L2capNetworkProvider.java b/service/src/com/android/server/L2capNetworkProvider.java
index 149979ffa8..459a573f7f 100644
--- a/service/src/com/android/server/L2capNetworkProvider.java
+++ b/service/src/com/android/server/L2capNetworkProvider.java
@@ -251,7 +251,6 @@ public class L2capNetworkProvider {
         private final Set<L2capNetwork> mL2capNetworks = new ArraySet<>();
 
         private class AcceptThread extends Thread {
-            private static final int TIMEOUT_MS = 500;
             private final BluetoothServerSocket mServerSocket;
 
             public AcceptThread(BluetoothServerSocket serverSocket) {

From 4943a17fb682c65afe46c413d088e5b8b751ab40 Mon Sep 17 00:00:00 2001
From: Junyu Lai <junyulai@google.com>
Date: Thu, 8 May 2025 21:42:40 +0800
Subject: [PATCH 222/377] Log improvement when the meta-data format is
 unexpected

Currently, if the value of opt-in meta-data is not a String,
calling Bundle#getString would result in flooding the system
log with Bundle warning log and callstacks, but without
useful information like the package name.

Thus, a manual type check is performed, and the package name
is logged if a mismatch occurs.

Flag: EXEMPT flagged with a kill switch
Test: atest CtsHostsideNetworkTests:com.android.cts.net.HostsideSatelliteDataOptInTest \
      ConnectivityCoverageTests:android.net.connectivity.com.android.server.connectivity.SatelliteAccessControllerTest \
      --update-device
Bug: 416351099
Change-Id: Iae8e26f657e009edb8630dbbe64c7e3e958abc43
---
 .../SatelliteAccessController.java            | 15 +++++++++---
 .../SatelliteAccessControllerTest.kt          | 23 +++++++++++++++++++
 2 files changed, 35 insertions(+), 3 deletions(-)

diff --git a/service/src/com/android/server/connectivity/SatelliteAccessController.java b/service/src/com/android/server/connectivity/SatelliteAccessController.java
index 6cc7a77592..6951624d72 100644
--- a/service/src/com/android/server/connectivity/SatelliteAccessController.java
+++ b/service/src/com/android/server/connectivity/SatelliteAccessController.java
@@ -421,10 +421,19 @@ public class SatelliteAccessController {
             final ApplicationInfo applicationInfo = pmForUser.getApplicationInfo(
                     packageName, PackageManager.GET_META_DATA);
             final Bundle metaData = applicationInfo.metaData;
-            if (metaData != null) {
-                final String value = metaData.getString(PROPERTY_SATELLITE_DATA_OPTIMIZED);
-                return TextUtils.equals(value, packageName);
+            if (metaData == null) return false;
+            // Retrieve the value as a generic Object to avoid Bundle warning log
+            // flooding when the format is mismatched.
+            final Object rawValue = metaData.get(PROPERTY_SATELLITE_DATA_OPTIMIZED);
+            if (rawValue == null) return false; // No expected meta-data.
+
+            // Check if the retrieved object is a matched String.
+            if (rawValue instanceof String
+                    && TextUtils.equals((String) rawValue, packageName)) {
+                return true;
             }
+            // Logging if the value is not expected (e.g., Boolean, wrong package name).
+            mLog.i("Wrong meta-data format: " + packageName);
             return false;
         } catch (PackageManager.NameNotFoundException e) {
             return false;
diff --git a/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt b/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt
index 0230128eaf..d570d41f92 100644
--- a/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt
+++ b/tests/unit/java/com/android/server/connectivity/SatelliteAccessControllerTest.kt
@@ -385,6 +385,29 @@ class SatelliteAccessControllerTest {
         verify(callback).accept(emptySet(), setOf(TEST_UID1))
     }
 
+    @FeatureFlag(name = CONSTRAINED_DATA_SATELLITE_OPTIN)
+    @Test
+    fun testSatelliteOptInUids_invalidMetaData() {
+        val appInfoWithBoolean = ApplicationInfo()
+        appInfoWithBoolean.metaData = Bundle()
+        appInfoWithBoolean.metaData.putBoolean(PROPERTY_SATELLITE_DATA_OPTIMIZED, true)
+        val pm = mockPackageManagerForUser(TEST_UID1.getUserId())
+        doReturn(appInfoWithBoolean).`when`(pm)
+                .getApplicationInfo(TEST_PACKAGE1, PackageManager.GET_META_DATA)
+        onPackageAdded(TEST_PACKAGE1, TEST_UID1)
+        verify(callback, never()).accept(any(), any())
+
+        val appInfoWithWrongPackage = ApplicationInfo()
+        appInfoWithWrongPackage.metaData = Bundle()
+        appInfoWithWrongPackage.metaData
+                .putString(PROPERTY_SATELLITE_DATA_OPTIMIZED, "wrong package")
+        doReturn(appInfoWithWrongPackage).`when`(pm)
+                .getApplicationInfo(TEST_PACKAGE1, PackageManager.GET_META_DATA)
+
+        onPackageAdded(TEST_PACKAGE1, TEST_UID1)
+        verify(callback, never()).accept(any(), any())
+    }
+
     @FeatureFlag(name = CONSTRAINED_DATA_SATELLITE_OPTIN)
     @Test
     fun testSatelliteOptInUids_onPackageAdded_ignoresIfNotSatelliteOptimized() {

From 6305252415a03ce1b5327f6347b9952da5ad4d75 Mon Sep 17 00:00:00 2001
From: Sewook Seo <sewookseo@google.com>
Date: Sun, 30 Mar 2025 11:31:57 +0000
Subject: [PATCH 223/377] Extend QosFilter address matching function

Extend QosFilter address match function for IP address range based on
prefix length.

Bug: 406146808
Bug: 399960748
Flag: com.android.net.flags.qos_filter_ip_range_matching
Test: atest CtsNetTestCases
Test: atest ConnectivityCoverageTests
Change-Id: I78d995fda111d258da9a912c7afa5e472e43437f
---
 common/Android.bp                             |  5 ++
 common/flags.aconfig                          |  8 ++
 framework/api/system-current.txt              |  2 +
 framework/src/android/net/QosFilter.java      | 35 +++++++++
 .../src/android/net/QosSocketFilter.java      | 62 +++++++++++-----
 .../src/android/net/cts/NetworkAgentTest.kt   | 16 ++++
 .../java/android/net/QosSocketFilterTest.java | 73 +++++++++++++++----
 7 files changed, 169 insertions(+), 32 deletions(-)

diff --git a/common/Android.bp b/common/Android.bp
index 95d84cc879..acd2349bc9 100644
--- a/common/Android.bp
+++ b/common/Android.bp
@@ -39,6 +39,11 @@ java_aconfig_library {
     ],
 }
 
+// This library MUST NOT be available to platform. This is because if the
+// platform depends on a flag, it will not be able to delete that flag until
+// that platform version is no longer supported by mainline. Additionally,
+// there is no any safety mechanism that prevents the module from
+// deleting the flag by mistake, regressing on previous platform versions.
 java_aconfig_library {
     name: "com.android.net.flags-aconfig-java-export",
     aconfig_declarations: "com.android.net.flags-aconfig",
diff --git a/common/flags.aconfig b/common/flags.aconfig
index 17ddff8dc3..9fcd981be9 100644
--- a/common/flags.aconfig
+++ b/common/flags.aconfig
@@ -191,3 +191,11 @@ flag {
   bug: "397536853"
   is_fixed_read_only: true
 }
+
+flag {
+  name: "qos_filter_ip_range_matching"
+  namespace: "android_core_networking"
+  description: "Flag for API to provide IP address range based QoS socket matching."
+  bug: "406146808"
+  is_fixed_read_only: true
+}
diff --git a/framework/api/system-current.txt b/framework/api/system-current.txt
index bef29a4283..e631e5d9a4 100644
--- a/framework/api/system-current.txt
+++ b/framework/api/system-current.txt
@@ -433,8 +433,10 @@ package android.net {
   public abstract class QosFilter {
     method @NonNull public abstract android.net.Network getNetwork();
     method public abstract boolean matchesLocalAddress(@NonNull java.net.InetAddress, int, int);
+    method @FlaggedApi("com.android.net.flags.qos_filter_ip_range_matching") public abstract boolean matchesLocalPrefix(@NonNull android.net.IpPrefix, int, int);
     method public boolean matchesProtocol(int);
     method public abstract boolean matchesRemoteAddress(@NonNull java.net.InetAddress, int, int);
+    method @FlaggedApi("com.android.net.flags.qos_filter_ip_range_matching") public abstract boolean matchesRemotePrefix(@NonNull android.net.IpPrefix, int, int);
   }
 
   public final class QosSession implements android.os.Parcelable {
diff --git a/framework/src/android/net/QosFilter.java b/framework/src/android/net/QosFilter.java
index a731b23c10..c28671085f 100644
--- a/framework/src/android/net/QosFilter.java
+++ b/framework/src/android/net/QosFilter.java
@@ -16,9 +16,12 @@
 
 package android.net;
 
+import android.annotation.FlaggedApi;
 import android.annotation.NonNull;
 import android.annotation.SystemApi;
 
+import com.android.net.flags.Flags;
+
 import java.net.InetAddress;
 
 /**
@@ -93,6 +96,38 @@ public abstract class QosFilter {
     public abstract boolean matchesRemoteAddress(@NonNull InetAddress address,
             int startPort, int endPort);
 
+    /**
+     * Determines whether or not the parameters will be matched with prefix length, source address
+     * and port.
+     *
+     * @param ipPrefix the UE side IP address and prefix length included in IP packet filter set of
+     *     a QoS flow assigned on {@link Network}.
+     * @param startPort the start of UE side port range included in IP packet filter set of a QoS
+     *     flow assigned on {@link Network}.
+     * @param endPort the end of UE side port range included in IP packet filter set of a QoS flow
+     *     assigned on {@link Network}.
+     * @return whether the parameters match the UE side address and port of the filter
+     */
+    @FlaggedApi(Flags.FLAG_QOS_FILTER_IP_RANGE_MATCHING)
+    public abstract boolean matchesLocalPrefix(
+            @NonNull IpPrefix ipPrefix, int startPort, int endPort);
+
+    /**
+     * Determines whether or not the parameters will be matched with prefix length, remote address
+     * and port.
+     *
+     * @param ipPrefix the remote IP address and prefix length included in IP packet filter set of a
+     *     QoS flow assigned on {@link Network}.
+     * @param startPort the start of remote port range included in IP packet filter set of a QoS
+     *     flow assigned on {@link Network}.
+     * @param endPort the end of the remote range included in IP packet filter set of a QoS flow
+     *     assigned on {@link Network}.
+     * @return whether the parameters match the remote address and port of the filter
+     */
+    @FlaggedApi(Flags.FLAG_QOS_FILTER_IP_RANGE_MATCHING)
+    public abstract boolean matchesRemotePrefix(
+            @NonNull IpPrefix ipPrefix, int startPort, int endPort);
+
     /**
      * Determines whether or not the parameter will be matched with this filter.
      *
diff --git a/framework/src/android/net/QosSocketFilter.java b/framework/src/android/net/QosSocketFilter.java
index 5ceeb67127..ecc2af1446 100644
--- a/framework/src/android/net/QosSocketFilter.java
+++ b/framework/src/android/net/QosSocketFilter.java
@@ -36,6 +36,7 @@ import android.util.Log;
 import com.android.internal.annotations.VisibleForTesting;
 
 import java.io.FileDescriptor;
+import java.net.Inet4Address;
 import java.net.InetAddress;
 import java.net.InetSocketAddress;
 import java.net.Socket;
@@ -179,10 +180,11 @@ public class QosSocketFilter extends QosFilter {
     @Override
     public boolean matchesLocalAddress(@NonNull final InetAddress address, final int startPort,
             final int endPort) {
-        if (mQosSocketInfo.getLocalSocketAddress() == null) {
-            return false;
-        }
-        return matchesAddress(mQosSocketInfo.getLocalSocketAddress(), address, startPort,
+        return matchesLocalPrefix(
+                address instanceof Inet4Address
+                        ? new IpPrefix(address, 32)
+                        : new IpPrefix(address, 128),
+                startPort,
                 endPort);
     }
 
@@ -192,11 +194,33 @@ public class QosSocketFilter extends QosFilter {
     @Override
     public boolean matchesRemoteAddress(@NonNull final InetAddress address, final int startPort,
             final int endPort) {
+        return matchesRemotePrefix(
+                address instanceof Inet4Address
+                        ? new IpPrefix(address, 32)
+                        : new IpPrefix(address, 128),
+                startPort,
+                endPort);
+    }
+
+    /** {@inheritDoc} */
+    @Override
+    public boolean matchesLocalPrefix(
+            @NonNull final IpPrefix ipPrefix, final int startPort, final int endPort) {
+        if (mQosSocketInfo.getLocalSocketAddress() == null) {
+            return false;
+        }
+        return matchesAddress(mQosSocketInfo.getLocalSocketAddress(), ipPrefix, startPort, endPort);
+    }
+
+    /** {@inheritDoc} */
+    @Override
+    public boolean matchesRemotePrefix(
+            @NonNull final IpPrefix ipPrefix, final int startPort, final int endPort) {
         if (mQosSocketInfo.getRemoteSocketAddress() == null) {
             return false;
         }
-        return matchesAddress(mQosSocketInfo.getRemoteSocketAddress(), address, startPort,
-                endPort);
+        return matchesAddress(
+                mQosSocketInfo.getRemoteSocketAddress(), ipPrefix, startPort, endPort);
     }
 
     /**
@@ -212,25 +236,27 @@ public class QosSocketFilter extends QosFilter {
     }
 
     /**
-     * Called from {@link QosSocketFilter#matchesLocalAddress(InetAddress, int, int)}
-     * and {@link QosSocketFilter#matchesRemoteAddress(InetAddress, int, int)} with the
-     * filterSocketAddress coming from {@link QosSocketInfo#getLocalSocketAddress()}.
-     * <p>
-     * This method exists for testing purposes since {@link QosSocketInfo} couldn't be mocked
-     * due to being final.
+     * Called from {@link QosSocketFilter#matchesLocalPrefix(IpPrefix, int, int)} and {@link
+     * QosSocketFilter#matchesRemotePrefix(IpPrefix, int, int)} with the filterSocketAddress coming
+     * from {@link QosSocketInfo#getLocalSocketAddress()}.
+     *
+     * <p>This method exists for testing purposes since {@link QosSocketInfo} couldn't be mocked due
+     * to being final.
      *
      * @param filterSocketAddress the socket address of the filter
-     * @param address the address to compare the filterSocketAddressWith
+     * @param ipPrefix the IP address with prefix length to compare the filterSocketAddressWith
      * @param startPort the start of the port range to check
      * @param endPort the end of the port range to check
      */
     @VisibleForTesting
-    public static boolean matchesAddress(@NonNull final InetSocketAddress filterSocketAddress,
-            @NonNull final InetAddress address,
-            final int startPort, final int endPort) {
+    public static boolean matchesAddress(
+            @NonNull final InetSocketAddress filterSocketAddress,
+            @NonNull final IpPrefix ipPrefix,
+            final int startPort,
+            final int endPort) {
         return startPort <= filterSocketAddress.getPort()
                 && endPort >= filterSocketAddress.getPort()
-                && (address.isAnyLocalAddress()
-                        || filterSocketAddress.getAddress().equals(address));
+                && (ipPrefix.getAddress().isAnyLocalAddress()
+                        || ipPrefix.contains(filterSocketAddress.getAddress()));
     }
 }
diff --git a/tests/cts/net/src/android/net/cts/NetworkAgentTest.kt b/tests/cts/net/src/android/net/cts/NetworkAgentTest.kt
index 7c75211151..147998c8c6 100644
--- a/tests/cts/net/src/android/net/cts/NetworkAgentTest.kt
+++ b/tests/cts/net/src/android/net/cts/NetworkAgentTest.kt
@@ -1392,6 +1392,22 @@ class NetworkAgentTest {
                 agent.expectCallback<OnRegisterQosCallback>().let {
                     callbackId = it.callbackId
                     assertTrue(it.filter.matchesProtocol(proto))
+                    // This test is only validating QosFilter address match APIs can be called.
+                    // Detail functionality checks are executed on QosSocketFilterTest.
+                    // Verify the match of test socket's Local address, currently the test socket
+                    // binds to the loopback address.
+                    assertTrue(it.filter.matchesLocalPrefix(
+                        IpPrefix(InetAddress.getLoopbackAddress(), 128),
+                        0,
+                        65535
+                    ))
+                    // Since the test socket doesn't connect to the remote address, we expect
+                    // unmatched result.
+                    assertFalse(it.filter.matchesRemotePrefix(
+                        IpPrefix(InetAddress.getLoopbackAddress(), 128),
+                        0,
+                        65535
+                    ))
                 }
 
                 assertFailsWith<QosCallbackRegistrationException>(
diff --git a/tests/unit/java/android/net/QosSocketFilterTest.java b/tests/unit/java/android/net/QosSocketFilterTest.java
index 6820b4048c..c2e65fdae2 100644
--- a/tests/unit/java/android/net/QosSocketFilterTest.java
+++ b/tests/unit/java/android/net/QosSocketFilterTest.java
@@ -52,50 +52,95 @@ public class QosSocketFilterTest {
     public void testPortExactMatch() {
         final InetAddress addressA = InetAddresses.parseNumericAddress("1.2.3.4");
         final InetAddress addressB = InetAddresses.parseNumericAddress("1.2.3.4");
-        assertTrue(QosSocketFilter.matchesAddress(
-                new InetSocketAddress(addressA, 10), addressB, 10, 10));
+        assertTrue(
+                QosSocketFilter.matchesAddress(
+                        new InetSocketAddress(addressA, 10), new IpPrefix(addressB, 32), 10, 10));
     }
 
     @Test
     public void testPortLessThanStart() {
         final InetAddress addressA = InetAddresses.parseNumericAddress("1.2.3.4");
         final InetAddress addressB = InetAddresses.parseNumericAddress("1.2.3.4");
-        assertFalse(QosSocketFilter.matchesAddress(
-                new InetSocketAddress(addressA, 8), addressB, 10, 10));
+        assertFalse(
+                QosSocketFilter.matchesAddress(
+                        new InetSocketAddress(addressA, 8), new IpPrefix(addressB, 32), 10, 10));
     }
 
     @Test
     public void testPortGreaterThanEnd() {
         final InetAddress addressA = InetAddresses.parseNumericAddress("1.2.3.4");
         final InetAddress addressB = InetAddresses.parseNumericAddress("1.2.3.4");
-        assertFalse(QosSocketFilter.matchesAddress(
-                new InetSocketAddress(addressA, 18), addressB, 10, 10));
+        assertFalse(
+                QosSocketFilter.matchesAddress(
+                        new InetSocketAddress(addressA, 18), new IpPrefix(addressB, 32), 10, 10));
     }
 
     @Test
     public void testPortBetweenStartAndEnd() {
         final InetAddress addressA = InetAddresses.parseNumericAddress("1.2.3.4");
         final InetAddress addressB = InetAddresses.parseNumericAddress("1.2.3.4");
-        assertTrue(QosSocketFilter.matchesAddress(
-                new InetSocketAddress(addressA, 10), addressB, 8, 18));
+        assertTrue(
+                QosSocketFilter.matchesAddress(
+                        new InetSocketAddress(addressA, 10), new IpPrefix(addressB, 32), 8, 18));
     }
 
     @Test
     public void testAddressesDontMatch() {
         final InetAddress addressA = InetAddresses.parseNumericAddress("1.2.3.4");
         final InetAddress addressB = InetAddresses.parseNumericAddress("1.2.3.5");
-        assertFalse(QosSocketFilter.matchesAddress(
-                new InetSocketAddress(addressA, 10), addressB, 10, 10));
+        assertFalse(
+                QosSocketFilter.matchesAddress(
+                        new InetSocketAddress(addressA, 10), new IpPrefix(addressB, 32), 10, 10));
     }
 
     @Test
     public void testAddressMatchWithAnyLocalAddresses() {
         final InetAddress addressA = InetAddresses.parseNumericAddress("1.2.3.4");
         final InetAddress addressB = InetAddresses.parseNumericAddress("0.0.0.0");
-        assertTrue(QosSocketFilter.matchesAddress(
-                new InetSocketAddress(addressA, 10), addressB, 10, 10));
-        assertFalse(QosSocketFilter.matchesAddress(
-                new InetSocketAddress(addressB, 10), addressA, 10, 10));
+        assertTrue(
+                QosSocketFilter.matchesAddress(
+                        new InetSocketAddress(addressA, 10), new IpPrefix(addressB, 32), 10, 10));
+        assertFalse(
+                QosSocketFilter.matchesAddress(
+                        new InetSocketAddress(addressB, 10), new IpPrefix(addressA, 32), 10, 10));
+    }
+
+    @Test
+    public void testAddressMatchWithPrefixLength() {
+        final InetAddress addressA = InetAddresses.parseNumericAddress("1.2.3.100");
+        final InetAddress addressB = InetAddresses.parseNumericAddress("1.2.3.132");
+        final InetAddress addressC = InetAddresses.parseNumericAddress("1.2.3.96");
+        final InetAddress addressD = InetAddresses.parseNumericAddress("2001:2:3:5::13:D17");
+        final InetAddress addressE = InetAddresses.parseNumericAddress("2001:2:3:4::13:D17");
+        final InetAddress addressF = InetAddresses.parseNumericAddress("2001:2:3:5::");
+        final InetAddress addressG = InetAddresses.parseNumericAddress("135.23.185.35");
+        final InetAddress addressH = InetAddresses.parseNumericAddress("135.23.186.127");
+        final InetAddress addressI = InetAddresses.parseNumericAddress("135.23.183.127");
+
+        assertTrue(
+                QosSocketFilter.matchesAddress(
+                        new InetSocketAddress(addressA, 10), new IpPrefix(addressC, 27), 10, 10));
+        assertFalse(
+                QosSocketFilter.matchesAddress(
+                        new InetSocketAddress(addressB, 10), new IpPrefix(addressC, 27), 10, 10));
+        assertTrue(
+                QosSocketFilter.matchesAddress(
+                        new InetSocketAddress(addressG, 10), new IpPrefix(addressH, 22), 10, 10));
+        assertFalse(
+                QosSocketFilter.matchesAddress(
+                        new InetSocketAddress(addressI, 10), new IpPrefix(addressH, 22), 10, 10));
+        assertTrue(
+                QosSocketFilter.matchesAddress(
+                        new InetSocketAddress(addressD, 10), new IpPrefix(addressF, 64), 10, 10));
+        assertFalse(
+                QosSocketFilter.matchesAddress(
+                        new InetSocketAddress(addressE, 10), new IpPrefix(addressF, 64), 10, 10));
+        assertFalse(
+                QosSocketFilter.matchesAddress(
+                        new InetSocketAddress(addressA, 10), new IpPrefix(addressF, 64), 10, 10));
+        assertTrue(
+                QosSocketFilter.matchesAddress(
+                        new InetSocketAddress(addressD, 10), new IpPrefix(addressD, 128), 10, 10));
     }
 
     @Test

From 893f84f96e77c820665cc52b0617c2066141b800 Mon Sep 17 00:00:00 2001
From: Chalard Jean <jchalard@google.com>
Date: Fri, 9 May 2025 13:26:04 +0900
Subject: [PATCH 224/377] Clean up an old flag for removed downstream branches

Test: TH
Flag: EXEMPT test-only
Change-Id: I4a860c7c42afdfb5249b787daee80395096f5c84
---
 staticlibs/testutils/Android.bp | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/staticlibs/testutils/Android.bp b/staticlibs/testutils/Android.bp
index e2b46310a4..24257eb569 100644
--- a/staticlibs/testutils/Android.bp
+++ b/staticlibs/testutils/Android.bp
@@ -67,14 +67,6 @@ java_library {
         "//packages/modules/Connectivity/tests/cts/hostside",
         "//external/cronet:__subpackages__",
     ],
-    // There are downstream branches using an old version of Kotlin
-    // that used to reserve the right to make breaking changes to the
-    // Result type and disallowed returning an instance of it.
-    // Later versions allowed this and there was never a change,
-    // so no matter the version returning Result is always fine,
-    // but on sc-mainline-prod the compiler rejects it without
-    // the following flag.
-    kotlincflags: ["-Xallow-result-return-type"],
     libs: [
         "jsr305",
     ],

From e73d3b934c1020b647e3a12fa36fa9ff462ae14d Mon Sep 17 00:00:00 2001
From: Chalard Jean <jchalard@google.com>
Date: Mon, 28 Apr 2025 14:17:00 +0900
Subject: [PATCH 225/377] Cleanup and improve logging for
 DefaultNetworkRestoreMonitor

Bug: 413188127
Flag: EXEMPT test-only
Test: CtsNetTestCases
Change-Id: I16938de33e1beee1a38c76eeae2fcf52d8f79870
---
 .../testutils/DefaultNetworkRestoreMonitor.kt | 25 ++++++++++---------
 .../android/testutils/DevSdkIgnoreRunner.kt   |  2 +-
 2 files changed, 14 insertions(+), 13 deletions(-)

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/DefaultNetworkRestoreMonitor.kt b/staticlibs/testutils/devicetests/com/android/testutils/DefaultNetworkRestoreMonitor.kt
index dd52d0b307..4559cb7b09 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/DefaultNetworkRestoreMonitor.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/DefaultNetworkRestoreMonitor.kt
@@ -16,6 +16,7 @@
 
 package com.android.testutils
 
+import android.annotation.SuppressLint
 import android.content.Context
 import android.content.pm.PackageManager
 import android.net.ConnectivityManager
@@ -23,6 +24,7 @@ import android.net.Network
 import android.net.NetworkCapabilities
 import com.android.internal.annotations.VisibleForTesting
 import com.android.net.module.util.BitUtils
+import com.android.testutils.RecorderCallback.CallbackEntry.CapabilitiesChanged
 import java.util.concurrent.CompletableFuture
 import java.util.concurrent.TimeUnit
 import org.junit.runner.Description
@@ -41,7 +43,10 @@ class DefaultNetworkRestoreMonitor(
     val cm = ctx.getSystemService(ConnectivityManager::class.java)!!
     val pm = ctx.packageManager
     val listener = object : RunListener() {
+        @SuppressLint("WrongConstant") // transportNamesOf wants @Transport annotation
         override fun testFinished(desc: Description) {
+            fun ConnectivityManager.activeNetworkCaps() =
+                activeNetwork?.let { getNetworkCapabilities(it) }
             // Only the first method that does not restore the default network should be blamed.
             if (firstFailure != null) {
                 return
@@ -49,15 +54,16 @@ class DefaultNetworkRestoreMonitor(
             val cb = TestableNetworkCallback()
             cm.registerDefaultNetworkCallback(cb)
             try {
-                cb.eventuallyExpect<RecorderCallback.CallbackEntry.CapabilitiesChanged>(
-                    timeoutMs = timeoutMs
-                ) {
+                cb.eventuallyExpect<CapabilitiesChanged>(timeoutMs = timeoutMs) {
                     BitUtils.packBits(it.caps.transportTypes) == initialTransports &&
                             it.caps.hasCapability(NetworkCapabilities.NET_CAPABILITY_VALIDATED)
                 }
             } catch (e: AssertionError) {
-                firstFailure = IllegalStateException(desc.methodName + " does not restore the" +
-                        "default network, initialTransports = $initialTransports", e)
+                val expectedTransports = BitUtils.unpackBits(initialTransports)
+                firstFailure = IllegalStateException(desc.methodName + " does not restore the " +
+                        "default network. Default network has caps ${cm.activeNetworkCaps()} ; " +
+                        "expected a network with transports = " +
+                        NetworkCapabilities.transportNamesOf(expectedTransports))
             } finally {
                 cm.unregisterNetworkCallback(cb)
             }
@@ -79,10 +85,7 @@ class DefaultNetworkRestoreMonitor(
 
         val capFuture = CompletableFuture<NetworkCapabilities>()
         val cb = object : ConnectivityManager.NetworkCallback() {
-            override fun onCapabilitiesChanged(
-                    network: Network,
-                    cap: NetworkCapabilities
-            ) {
+            override fun onCapabilitiesChanged(network: Network, cap: NetworkCapabilities) {
                 capFuture.complete(cap)
             }
         }
@@ -103,9 +106,7 @@ class DefaultNetworkRestoreMonitor(
     fun reportResultAndCleanUp(desc: Description) {
         notifier.fireTestStarted(desc)
         if (firstFailure != null) {
-            notifier.fireTestFailure(
-                    Failure(desc, firstFailure)
-            )
+            notifier.fireTestFailure(Failure(desc, firstFailure))
         }
         notifier.fireTestFinished(desc)
         notifier.removeListener(listener)
diff --git a/staticlibs/testutils/devicetests/com/android/testutils/DevSdkIgnoreRunner.kt b/staticlibs/testutils/devicetests/com/android/testutils/DevSdkIgnoreRunner.kt
index d00ae525cd..8b1ecba77a 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/DevSdkIgnoreRunner.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/DevSdkIgnoreRunner.kt
@@ -139,7 +139,7 @@ class DevSdkIgnoreRunner(private val klass: Class<*>) : Runner(), Filterable, So
         }
 
         val networkRestoreMonitor = if (restoreDefaultNetwork) {
-            DefaultNetworkRestoreMonitor(ctx, notifier).apply{
+            DefaultNetworkRestoreMonitor(ctx, notifier).apply {
                 init(ConnectUtil(ctx))
             }
         } else {

From 1e66940f0b1867f12783baa3a8b16572e63a24ba Mon Sep 17 00:00:00 2001
From: Remi NGUYEN VAN <reminv@google.com>
Date: Tue, 22 Apr 2025 11:51:19 +0900
Subject: [PATCH 226/377] Remove last @hide usage in CtsNetTestCases

Inline the last remaining constants, and add a workaround for test APIs
that are missing in module API stubs.

While inlining the constants and reflection usage is far from ideal,
this is effectively what the tests are doing today, and it allows
preventing further usage of hidden API in the tests by making them build
against API stubs (in subsequent change).

Test: atest
Flag: TEST_ONLY
Bug: 410435307
Change-Id: Id2ffc0cb41bc31e4cd049b711a392904910414a3
---
 .../src/android/net/cts/ApfIntegrationTest.kt |  7 ++-
 .../net/src/android/net/cts/Ikev2VpnTest.java | 47 ++++++++++++-------
 .../net/cts/IpSecManagerTunnelTest.java       |  4 +-
 3 files changed, 37 insertions(+), 21 deletions(-)

diff --git a/tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt b/tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt
index 52777fd0ec..3e35968738 100644
--- a/tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt
+++ b/tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt
@@ -72,8 +72,8 @@ import com.android.compatibility.common.util.PropertyUtil.getVsrApiLevel
 import com.android.compatibility.common.util.SystemUtil.runShellCommand
 import com.android.compatibility.common.util.SystemUtil.runShellCommandOrThrow
 import com.android.compatibility.common.util.VsrTest
-import com.android.internal.util.HexDump
 import com.android.modules.utils.build.SdkLevel
+import com.android.net.module.util.HexDump
 import com.android.net.module.util.NetworkStackConstants.ETHER_ADDR_LEN
 import com.android.net.module.util.NetworkStackConstants.ETHER_DST_ADDR_OFFSET
 import com.android.net.module.util.NetworkStackConstants.ETHER_HEADER_LEN
@@ -170,7 +170,10 @@ class ApfIntegrationTest {
             val packageManager = context.getPackageManager()
             val userManager = context.getSystemService(UserManager::class.java)!!
             return (packageManager.hasSystemFeature(FEATURE_AUTOMOTIVE) &&
-                    userManager.isVisibleBackgroundUsersSupported)
+                    // isVisibleBackgroundUsersSupported is @TestApi, but this test should build
+                    // against module API stubs, which do not include it (b/409931932).
+                    userManager.javaClass.getMethod("isVisibleBackgroundUsersSupported")
+                        .invoke(userManager) as Boolean)
         }
 
         private fun disableLowPowerStandby() {
diff --git a/tests/cts/net/src/android/net/cts/Ikev2VpnTest.java b/tests/cts/net/src/android/net/cts/Ikev2VpnTest.java
index d948241e02..3289385b5d 100644
--- a/tests/cts/net/src/android/net/cts/Ikev2VpnTest.java
+++ b/tests/cts/net/src/android/net/cts/Ikev2VpnTest.java
@@ -22,8 +22,8 @@ import static android.net.NetworkCapabilities.TRANSPORT_VPN;
 import static android.net.cts.util.CtsNetUtils.TestNetworkCallback;
 
 import static com.android.compatibility.common.util.SystemUtil.runWithShellPermissionIdentity;
-import static com.android.modules.utils.build.SdkLevel.isAtLeastU;
 import static com.android.modules.utils.build.SdkLevel.isAtLeastT;
+import static com.android.modules.utils.build.SdkLevel.isAtLeastU;
 import static com.android.testutils.DevSdkIgnoreRuleKt.SC_V2;
 
 import static org.junit.Assert.assertArrayEquals;
@@ -34,12 +34,11 @@ import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertThrows;
 import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
-import static org.junit.Assume.assumeTrue;
 import static org.junit.Assume.assumeFalse;
+import static org.junit.Assume.assumeTrue;
 
 import android.Manifest;
 import android.annotation.NonNull;
-import android.app.AppOpsManager;
 import android.content.Context;
 import android.content.Intent;
 import android.content.pm.PackageManager;
@@ -99,6 +98,10 @@ import javax.security.auth.x500.X500Principal;
 public class Ikev2VpnTest {
     private static final String TAG = Ikev2VpnTest.class.getSimpleName();
 
+    // TODO: make AppOpsManager.OP_ACTIVATE_VPN API
+    private static final int OP_ACTIVATE_VPN = 47;
+    private static final int OP_ACTIVATE_PLATFORM_VPN = 94;
+
     @Rule
     public final DevSdkIgnoreRule ignoreRule = new DevSdkIgnoreRule();
 
@@ -219,8 +222,8 @@ public class Ikev2VpnTest {
         for (TestableNetworkCallback callback : mCallbacksToUnregister) {
             sCM.unregisterNetworkCallback(callback);
         }
-        setAppop(AppOpsManager.OP_ACTIVATE_VPN, false);
-        setAppop(AppOpsManager.OP_ACTIVATE_PLATFORM_VPN, false);
+        setAppop(OP_ACTIVATE_VPN, false);
+        setAppop(OP_ACTIVATE_PLATFORM_VPN, false);
 
         // Make sure the VpnProfile is not provisioned already.
         sVpnMgr.stopProvisionedVpnProfile();
@@ -265,14 +268,22 @@ public class Ikev2VpnTest {
             builder.setAutomaticNattKeepaliveTimerEnabled(automaticNattKeepaliveTimerEnabled);
         }
 
-        // TODO: replace it in alternative way to remove the hidden method usage
         if (isRestrictedToTestNetworks) {
-            builder.restrictToTestNetworks();
+            restrictToTestNetworks(builder);
         }
 
         return builder.build();
     }
 
+    private void restrictToTestNetworks(@NonNull Ikev2VpnProfile.Builder builder) {
+        try {
+            // TODO: replace it in alternative way to remove the hidden method usage
+            builder.getClass().getMethod("restrictToTestNetworks").invoke(builder);
+        } catch (ReflectiveOperationException e) {
+            throw new AssertionError(e);
+        }
+    }
+
     private Ikev2VpnProfile buildIkev2VpnProfileIkeTunConnParams(
             final boolean isRestrictedToTestNetworks, final boolean requiresValidation,
             final boolean testIpv6) throws Exception {
@@ -288,9 +299,8 @@ public class Ikev2VpnTest {
                         .setMaxMtu(TEST_MTU)
                         .setMetered(false);
 
-        // TODO: replace it in alternative way to remove the hidden method usage
         if (isRestrictedToTestNetworks) {
-            builder.restrictToTestNetworks();
+            restrictToTestNetworks(builder);
         }
         return builder.build();
     }
@@ -335,7 +345,8 @@ public class Ikev2VpnTest {
         assertTrue(profile.isBypassable());
         assertFalse(profile.isMetered());
         assertEquals(TEST_MTU, profile.getMaxMtu());
-        assertFalse(profile.isRestrictedToTestNetworks());
+        assertFalse((boolean) profile.getClass().getMethod("isRestrictedToTestNetworks")
+                .invoke(profile));
     }
 
     public void doTestBuildIkev2VpnProfilePsk(final boolean requiresValidation) throws Exception {
@@ -427,8 +438,8 @@ public class Ikev2VpnTest {
             throws Exception {
         assumeTrue(mCtsNetUtils.hasIpsecTunnelsFeature());
 
-        setAppop(AppOpsManager.OP_ACTIVATE_VPN, hasActivateVpn);
-        setAppop(AppOpsManager.OP_ACTIVATE_PLATFORM_VPN, hasActivatePlatformVpn);
+        setAppop(OP_ACTIVATE_VPN, hasActivateVpn);
+        setAppop(OP_ACTIVATE_PLATFORM_VPN, hasActivatePlatformVpn);
 
         final Ikev2VpnProfile profile = buildIkev2VpnProfilePsk(TEST_SERVER_ADDR_V6,
                 false /* isRestrictedToTestNetworks */, false /* requiresValidation */);
@@ -472,19 +483,19 @@ public class Ikev2VpnTest {
     public void testDeleteVpnProfile() throws Exception {
         assumeTrue(mCtsNetUtils.hasIpsecTunnelsFeature());
 
-        setAppop(AppOpsManager.OP_ACTIVATE_PLATFORM_VPN, true);
+        setAppop(OP_ACTIVATE_PLATFORM_VPN, true);
 
         final Ikev2VpnProfile profile = buildIkev2VpnProfilePsk(TEST_SERVER_ADDR_V6,
                 false /* isRestrictedToTestNetworks */, false /* requiresValidation */);
         assertNull(sVpnMgr.provisionVpnProfile(profile));
 
         // Verify that deleting the profile works (even without the appop)
-        setAppop(AppOpsManager.OP_ACTIVATE_PLATFORM_VPN, false);
+        setAppop(OP_ACTIVATE_PLATFORM_VPN, false);
         sVpnMgr.deleteProvisionedVpnProfile();
 
         // Test that the profile was deleted - starting it should throw an IAE.
         try {
-            setAppop(AppOpsManager.OP_ACTIVATE_PLATFORM_VPN, true);
+            setAppop(OP_ACTIVATE_PLATFORM_VPN, true);
             sVpnMgr.startProvisionedVpnProfile();
             fail("Expected IllegalArgumentException due to missing profile");
         } catch (IllegalArgumentException expected) {
@@ -495,8 +506,8 @@ public class Ikev2VpnTest {
     public void testStartVpnProfileNoPreviousConsent() throws Exception {
         assumeTrue(mCtsNetUtils.hasIpsecTunnelsFeature());
 
-        setAppop(AppOpsManager.OP_ACTIVATE_VPN, false);
-        setAppop(AppOpsManager.OP_ACTIVATE_PLATFORM_VPN, false);
+        setAppop(OP_ACTIVATE_VPN, false);
+        setAppop(OP_ACTIVATE_PLATFORM_VPN, false);
 
         // Make sure the VpnProfile is not provisioned already.
         sVpnMgr.stopProvisionedVpnProfile();
@@ -518,7 +529,7 @@ public class Ikev2VpnTest {
         boolean hasNat = !testIpv6;
 
         // Requires MANAGE_TEST_NETWORKS to provision a test-mode profile.
-        mCtsNetUtils.setAppopPrivileged(AppOpsManager.OP_ACTIVATE_PLATFORM_VPN, true);
+        mCtsNetUtils.setAppopPrivileged(OP_ACTIVATE_PLATFORM_VPN, true);
 
         final Ikev2VpnProfile profile = testIkeTunConnParams
                 ? buildIkev2VpnProfileIkeTunConnParams(true /* isRestrictedToTestNetworks */,
diff --git a/tests/cts/net/src/android/net/cts/IpSecManagerTunnelTest.java b/tests/cts/net/src/android/net/cts/IpSecManagerTunnelTest.java
index f2c6d337a9..2f8ab032ad 100644
--- a/tests/cts/net/src/android/net/cts/IpSecManagerTunnelTest.java
+++ b/tests/cts/net/src/android/net/cts/IpSecManagerTunnelTest.java
@@ -16,7 +16,6 @@
 
 package android.net.cts;
 
-import static android.app.AppOpsManager.OP_MANAGE_IPSEC_TUNNELS;
 import static android.net.IpSecManager.UdpEncapsulationSocket;
 import static android.net.cts.IpSecManagerTest.assumeExperimentalIpv6UdpEncapSupported;
 import static android.net.cts.IpSecManagerTest.assumeRequestIpSecTransformStateSupported;
@@ -87,6 +86,9 @@ import java.net.NetworkInterface;
 public class IpSecManagerTunnelTest extends IpSecBaseTest {
     @Rule public final DevSdkIgnoreRule ignoreRule = new DevSdkIgnoreRule();
 
+    // TODO: make AppOpsManager.OP_MANAGE_IPSEC_TUNNELS API
+    private static final int OP_MANAGE_IPSEC_TUNNELS = 75;
+
     private static final String TAG = IpSecManagerTunnelTest.class.getSimpleName();
 
     private static final InetAddress LOCAL_OUTER_4 = InetAddress.parseNumericAddress("192.0.2.1");

From 0c3142bdce65c960b71441681edf24e93ccc97f4 Mon Sep 17 00:00:00 2001
From: Remi NGUYEN VAN <reminv@google.com>
Date: Tue, 22 Apr 2025 11:55:12 +0900
Subject: [PATCH 227/377] Build CtsNetTestCases against API

Instead of building against hidden API, build against module API.

This does not build against test API as test API does not contain module
API stubs, and this test uses more module APIs than test APIs.

Building against stubs should make the build faster (no need to build
all of framework.jar), and is desirable in CTS to avoid depending on
methods that may change over time or be modified by OEMs.

Test: atest
Flag: TEST_ONLY
Bug: 410435307
Change-Id: I2ac80daa144416cab5477843ecf32041fe0882c5
---
 tests/cts/net/Android.bp | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/tests/cts/net/Android.bp b/tests/cts/net/Android.bp
index a7eca21385..3fc0e33be8 100644
--- a/tests/cts/net/Android.bp
+++ b/tests/cts/net/Android.bp
@@ -21,13 +21,28 @@ java_defaults {
     name: "CtsNetTestCasesDefaults",
     defaults: [
         "cts_defaults",
-        "framework-connectivity-test-defaults",
     ],
 
     // Include both the 32 and 64 bit versions
     compile_multilib: "both",
 
+    sdk_version: "module_current",
     libs: [
+        "framework-annotations-lib",
+        "framework-connectivity.impl",
+        "framework-connectivity-b.impl",
+        "framework-connectivity-t.impl",
+        "framework-tethering.impl",
+        "framework-configinfrastructure.stubs.module_lib",
+        "framework-bluetooth.stubs.module_lib",
+        "android.net.ipsec.ike.stubs.module_lib",
+        "framework-wifi.stubs.module_lib",
+
+        // module_current stubs will hide test_stubs symbols in classes that also have module API
+        // (for example UserManager#isVisibleBackgroundUsersSupported is test API but UserManager
+        // is picked up from module lib stubs so that method will not be there). But test_stubs
+        // still provide stubs for classes that are only test API, such as VintfRuntimeInfo.
+        "android_test_stubs_current",
         "voip-common",
         "android.test.base.stubs",
     ],
@@ -53,11 +68,13 @@ java_defaults {
         "cts-net-utils",
         "CtsNetTestsNonUpdatableLib",
         "ctstestrunner-axt",
+        "DhcpPacketLib",
         "junit",
         "junit-params",
         "modules-utils-build",
         "net-tests-utils",
         "net-utils-framework-common",
+        "NetworkStackApiCurrentShims",
         "truth",
         "TetheringIntegrationTestsBaseLib",
     ],
@@ -88,11 +105,6 @@ android_test {
     name: "CtsNetTestCases",
     defaults: [
         "CtsNetTestCasesDefaults",
-        "ConnectivityNextEnableDefaults",
-    ],
-    static_libs: [
-        "DhcpPacketLib",
-        "NetworkStackApiCurrentShims",
     ],
     test_suites: [
         "automotive-general-tests",
@@ -104,22 +116,10 @@ android_test {
     resource_zips: [":connectivity-module-version-as-resource-zip"],
 }
 
-java_defaults {
-    name: "CtsNetTestCasesApiStableDefaults",
-    // TODO: CTS should not depend on the entirety of the networkstack code.
-    static_libs: [
-        "DhcpPacketLib",
-        "NetworkStackApiStableShims",
-    ],
-    jni_uses_sdk_apis: true,
-    min_sdk_version: "30",
-}
-
 java_defaults {
     name: "CtsNetTestCasesMaxTargetSdkDefaults",
     defaults: [
         "CtsNetTestCasesDefaults",
-        "CtsNetTestCasesApiStableDefaults",
     ],
     test_suites: [
         "cts",

From 26bbed3c5b7a62e68fd1ff8960ba2742c814f178 Mon Sep 17 00:00:00 2001
From: Richard Uhler <ruhler@google.com>
Date: Fri, 9 May 2025 10:11:11 -0700
Subject: [PATCH 228/377] Add unit test for filteredClone.

BUG: 416650909
Test: atest ConnectivityCoverageTests:android.net.connectivity.android.net.NetworkStatsTest
Flag: TEST_ONLY
Change-Id: I03d38e6960d82b2b2b98454fba68359800188fff
---
 .../java/android/net/NetworkStatsTest.java    | 32 +++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/tests/unit/java/android/net/NetworkStatsTest.java b/tests/unit/java/android/net/NetworkStatsTest.java
index 70ddc17242..37a0e576e1 100644
--- a/tests/unit/java/android/net/NetworkStatsTest.java
+++ b/tests/unit/java/android/net/NetworkStatsTest.java
@@ -844,6 +844,38 @@ public class NetworkStatsTest {
         assertEquals(entry3, stats.getValues(1, null));
     }
 
+    @Test
+    public void testFilteredClone() {
+        final int testUid = 10101;
+        NetworkStats.Entry entry1 = new NetworkStats.Entry(
+                "test1", 10100, SET_DEFAULT, TAG_NONE, METERED_NO, ROAMING_NO,
+                DEFAULT_NETWORK_NO, 50000L, 25L, 100000L, 50L, 0L);
+
+        NetworkStats.Entry entry2 = new NetworkStats.Entry(
+                "test2", testUid, SET_DEFAULT, TAG_NONE, METERED_NO, ROAMING_NO,
+                DEFAULT_NETWORK_NO, 50000L, 25L, 100000L, 50L, 0L);
+
+        NetworkStats.Entry entry3 = new NetworkStats.Entry(
+                "test3", testUid, SET_DEFAULT, 123, METERED_NO, ROAMING_NO,
+                DEFAULT_NETWORK_NO, 50000L, 25L, 100000L, 50L, 0L);
+
+        NetworkStats stats = new NetworkStats(TEST_START, 3)
+                .insertEntry(entry1)
+                .insertEntry(entry2)
+                .insertEntry(entry3);
+
+        NetworkStats filtered = stats.filteredClone(testUid, INTERFACES_ALL, TAG_ALL);
+
+        assertEquals(3, stats.size());
+        assertEquals(entry1, stats.getValues(0, null));
+        assertEquals(entry2, stats.getValues(1, null));
+        assertEquals(entry3, stats.getValues(2, null));
+
+        assertEquals(2, filtered.size());
+        assertEquals(entry2, filtered.getValues(0, null));
+        assertEquals(entry3, filtered.getValues(1, null));
+    }
+
     @Test
     public void testFilter_InterfaceFilter() {
         final String testIf1 = "testif1";

From 944bc19fbf1e3d3412b69cef3bda2c068c124ff7 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Sun, 11 May 2025 16:30:25 -0700
Subject: [PATCH 229/377] Increase TIMEOUT_MS to 20s

Accounting for RS delay, a 2s timeout is not enough.

Test: TH
Flag: EXEMPT mainline
Bug: 416710891
Change-Id: I19e78f39c8d77e150792a36fe9c86791aac0c2f8
---
 tests/integration/src/android/net/Dhcp6PdTest.kt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/integration/src/android/net/Dhcp6PdTest.kt b/tests/integration/src/android/net/Dhcp6PdTest.kt
index e031ad5e07..594984ceb7 100644
--- a/tests/integration/src/android/net/Dhcp6PdTest.kt
+++ b/tests/integration/src/android/net/Dhcp6PdTest.kt
@@ -60,7 +60,7 @@ import org.junit.runner.RunWith
 
 private const val TAG = "Dhcp6PdTest"
 private const val SHORT_TIMEOUT_MS = 200L
-private const val TIMEOUT_MS = 2000L
+private const val TIMEOUT_MS = 20_000L
 
 private const val DHCP6_PFLAG_CONFIG = "ipclient_dhcpv6_pd_preferred_flag_version"
 

From e41b66393cfbab36fcfa464dcb6a6ec545cb5100 Mon Sep 17 00:00:00 2001
From: Yuyang Huang <yuyanghuang@google.com>
Date: Wed, 30 Apr 2025 18:30:13 +0900
Subject: [PATCH 230/377] Skip subtype PTR records in announcements/offload

Skip including the subtype PTR query for both announcement and offload
packets. This is necessary because devices like Googlecast have
numerous subtypes. Including these subtypes in the packets can easily
exceed the MTU limit. Furthermore, the Wi-Fi firmware has limited RAM
available for hardware offload, and including subtypes would consume
excessive memory resources needed for the offload code.

Test: TH
Flag: EXEMPT bug fix
Change-Id: I2575659983579da0bbf4ff104ba5b8111ee9585e
---
 .../android/net/nsd/AdvertisingRequest.java   |   6 +
 .../src/com/android/server/NsdService.java    |   6 +-
 .../connectivity/mdns/MdnsAdvertiser.java     |  16 +-
 .../mdns/MdnsAdvertisingOptions.java          |  47 ++-
 .../mdns/MdnsInterfaceAdvertiser.java         |   2 +-
 .../mdns/MdnsRecordRepository.java            |  79 +++--
 .../connectivity/mdns/MdnsAdvertiserTest.kt   |   4 +-
 .../mdns/MdnsInterfaceAdvertiserTest.kt       |   6 +-
 .../mdns/MdnsRecordRepositoryTest.kt          | 331 ++++++++++++++++--
 9 files changed, 423 insertions(+), 74 deletions(-)

diff --git a/framework-t/src/android/net/nsd/AdvertisingRequest.java b/framework-t/src/android/net/nsd/AdvertisingRequest.java
index a62df65901..4b1833ad8b 100644
--- a/framework-t/src/android/net/nsd/AdvertisingRequest.java
+++ b/framework-t/src/android/net/nsd/AdvertisingRequest.java
@@ -52,6 +52,12 @@ public final class AdvertisingRequest implements Parcelable {
      */
     public static final long FLAG_SKIP_PROBING = 1 << 1;
 
+    /**
+     * Don't announce the subtype of the service.
+     * @hide
+     */
+    public static final long FLAG_SKIP_SUBTYPE_ANNOUNCEMENTS = 1L << 63;
+
     /** @hide */
     @Retention(RetentionPolicy.SOURCE)
     @LongDef(flag = true, prefix = {"FLAG_"}, value = {
diff --git a/service-t/src/com/android/server/NsdService.java b/service-t/src/com/android/server/NsdService.java
index 23899150bf..17139a9889 100644
--- a/service-t/src/com/android/server/NsdService.java
+++ b/service-t/src/com/android/server/NsdService.java
@@ -24,6 +24,7 @@ import static android.net.NetworkCapabilities.TRANSPORT_VPN;
 import static android.net.NetworkCapabilities.TRANSPORT_WIFI;
 import static android.net.NetworkStack.PERMISSION_MAINLINE_NETWORK_STACK;
 import static android.net.nsd.AdvertisingRequest.FLAG_SKIP_PROBING;
+import static android.net.nsd.AdvertisingRequest.FLAG_SKIP_SUBTYPE_ANNOUNCEMENTS;
 import static android.net.nsd.NsdManager.MDNS_DISCOVERY_MANAGER_EVENT;
 import static android.net.nsd.NsdManager.MDNS_SERVICE_EVENT;
 import static android.net.nsd.NsdManager.RESOLVE_SERVICE_SUCCEEDED;
@@ -1048,12 +1049,15 @@ public class NsdService extends INsdManager.Stub {
                             serviceInfo.setSubtypes(subtypes);
                             maybeStartMonitoringSockets();
                             final boolean skipProbing = (advertisingRequest.getFlags()
-                                    & FLAG_SKIP_PROBING) > 0;
+                                    & FLAG_SKIP_PROBING) != 0;
+                            final boolean skipSubtypeAnnouncements = (advertisingRequest.getFlags()
+                                    & FLAG_SKIP_SUBTYPE_ANNOUNCEMENTS) != 0;
                             final MdnsAdvertisingOptions mdnsAdvertisingOptions =
                                     MdnsAdvertisingOptions.newBuilder()
                                             .setIsOnlyUpdate(isUpdateOnly)
                                             .setSkipProbing(skipProbing)
                                             .setTtl(advertisingRequest.getTtl())
+                                            .setSkipSubtypeAnnouncements(skipSubtypeAnnouncements)
                                             .build();
                             mAdvertiser.addOrUpdateService(transactionId, serviceInfo,
                                     mdnsAdvertisingOptions, clientInfo.mUid);
diff --git a/service-t/src/com/android/server/connectivity/mdns/MdnsAdvertiser.java b/service-t/src/com/android/server/connectivity/mdns/MdnsAdvertiser.java
index e251ec2375..bd7b8b585f 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MdnsAdvertiser.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MdnsAdvertiser.java
@@ -1027,17 +1027,13 @@ public class MdnsAdvertiser {
         });
     }
 
-    private List<String> getOffloadSubtype(@NonNull NsdServiceInfo nsdServiceInfo) {
-        // Workaround: Google Cast doesn't announce subtypes per DNS-SD/mDNS spec.
-        // Thus, subtypes aren't offloaded; only "_googlecast._tcp" is.
-        // Subtype responses occur when hardware offload is off.
-        // This solution works because Google Cast doesn't follow the intended usage of subtypes in
-        // the spec, as it always discovers for both the subtype+base type, and only uses the mDNS
-        // subtype as an optimization.
-        if (nsdServiceInfo.getServiceType().equals("_googlecast._tcp")) {
+    private List<String> getOffloadSubtype(@NonNull Registration registration) {
+        final NsdServiceInfo serviceInfo = registration.getServiceInfo();
+        // If skipSubtypeAnnouncements is set, we should not offload subtypes.
+        if (registration.mAdvertisingOptions.skipSubtypeAnnouncements()) {
             return new ArrayList<>();
         }
-        return new ArrayList<>(nsdServiceInfo.getSubtypes());
+        return new ArrayList<>(serviceInfo.getSubtypes());
     }
 
     private OffloadServiceInfoWrapper createOffloadService(int serviceId,
@@ -1050,7 +1046,7 @@ public class MdnsAdvertiser {
         final OffloadServiceInfo offloadServiceInfo = new OffloadServiceInfo(
                 new OffloadServiceInfo.Key(nsdServiceInfo.getServiceName(),
                         nsdServiceInfo.getServiceType()),
-                getOffloadSubtype(nsdServiceInfo),
+                getOffloadSubtype(registration),
                 String.join(".", mDeviceHostName),
                 rawOffloadPacket,
                 priority,
diff --git a/service-t/src/com/android/server/connectivity/mdns/MdnsAdvertisingOptions.java b/service-t/src/com/android/server/connectivity/mdns/MdnsAdvertisingOptions.java
index 5133d4f730..250e61fd6e 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MdnsAdvertisingOptions.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MdnsAdvertisingOptions.java
@@ -35,14 +35,17 @@ public class MdnsAdvertisingOptions {
     @Nullable
     private final Duration mTtl;
     private final boolean mSkipProbing;
+    private final boolean mSkipSubtypeAnnouncements;
 
     /**
      * Parcelable constructs for a {@link MdnsAdvertisingOptions}.
      */
-    MdnsAdvertisingOptions(boolean isOnlyUpdate, @Nullable Duration ttl, boolean skipProbing) {
+    MdnsAdvertisingOptions(boolean isOnlyUpdate, @Nullable Duration ttl, boolean skipProbing,
+            boolean skipSubtypeAnnouncements) {
         this.mIsOnlyUpdate = isOnlyUpdate;
         this.mTtl = ttl;
         this.mSkipProbing = skipProbing;
+        this.mSkipSubtypeAnnouncements = skipSubtypeAnnouncements;
     }
 
     /**
@@ -84,6 +87,13 @@ public class MdnsAdvertisingOptions {
         return mTtl;
     }
 
+    /**
+     * Returns {@code true} if subtype announcements should be skipped.
+     */
+    public boolean skipSubtypeAnnouncements() {
+        return mSkipSubtypeAnnouncements;
+    }
+
     @Override
     public boolean equals(Object other) {
         if (this == other) {
@@ -93,19 +103,36 @@ public class MdnsAdvertisingOptions {
         } else {
             final MdnsAdvertisingOptions otherOptions = (MdnsAdvertisingOptions) other;
             return mIsOnlyUpdate == otherOptions.mIsOnlyUpdate
+                    && mSkipProbing == otherOptions.mSkipProbing
+                    && mSkipSubtypeAnnouncements == otherOptions.mSkipSubtypeAnnouncements
                     && Objects.equals(mTtl, otherOptions.mTtl);
         }
     }
 
     @Override
     public int hashCode() {
-        return Objects.hash(mIsOnlyUpdate, mTtl);
+        return Objects.hash(mIsOnlyUpdate, mTtl, mSkipProbing, mSkipSubtypeAnnouncements);
     }
 
     @Override
     public String toString() {
-        return "MdnsAdvertisingOptions{" + "mIsOnlyUpdate=" + mIsOnlyUpdate + ", mTtl=" + mTtl
-                + '}';
+        final StringBuilder sb = new StringBuilder();
+        sb.append("MdnsAdvertisingOptions{");
+        if (mIsOnlyUpdate) {
+            sb.append(" isOnlyUpdate");
+        }
+        if (mSkipProbing) {
+            sb.append(" skipProbing");
+        }
+        if (mSkipSubtypeAnnouncements) {
+            sb.append(" skipSubtypeAnnouncements");
+        }
+        if (mTtl != null) {
+            sb.append(" ttl=");
+            sb.append(mTtl);
+        }
+        sb.append(" }");
+        return sb.toString();
     }
 
     /**
@@ -114,6 +141,7 @@ public class MdnsAdvertisingOptions {
     public static final class Builder {
         private boolean mIsOnlyUpdate = false;
         private boolean mSkipProbing = false;
+        private boolean mSkipSubtypeAnnouncements = false;
         @Nullable
         private Duration mTtl;
 
@@ -144,11 +172,20 @@ public class MdnsAdvertisingOptions {
             return this;
         }
 
+        /**
+         * Sets whether to skip subtype announcements.
+         */
+        public Builder setSkipSubtypeAnnouncements(boolean skipSubtypeAnnouncements) {
+            this.mSkipSubtypeAnnouncements = skipSubtypeAnnouncements;
+            return this;
+        }
+
         /**
          * Builds a {@link MdnsAdvertisingOptions} with the arguments supplied to this builder.
          */
         public MdnsAdvertisingOptions build() {
-            return new MdnsAdvertisingOptions(mIsOnlyUpdate, mTtl, mSkipProbing);
+            return new MdnsAdvertisingOptions(mIsOnlyUpdate, mTtl, mSkipProbing,
+                    mSkipSubtypeAnnouncements);
         }
     }
 }
diff --git a/service-t/src/com/android/server/connectivity/mdns/MdnsInterfaceAdvertiser.java b/service-t/src/com/android/server/connectivity/mdns/MdnsInterfaceAdvertiser.java
index b9b09ed0c8..b5c3468343 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MdnsInterfaceAdvertiser.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MdnsInterfaceAdvertiser.java
@@ -276,7 +276,7 @@ public class MdnsInterfaceAdvertiser implements MulticastPacketReader.PacketHand
     public void addService(int id, NsdServiceInfo service,
             @NonNull MdnsAdvertisingOptions advertisingOptions) throws NameConflictException {
         final int replacedExitingService =
-                mRecordRepository.addService(id, service, advertisingOptions.getTtl());
+                mRecordRepository.addService(id, service, advertisingOptions);
         // Cancel announcements for the existing service. This only happens for exiting services
         // (so cancelling exiting announcements), as per RecordRepository.addService.
         if (replacedExitingService >= 0) {
diff --git a/service-t/src/com/android/server/connectivity/mdns/MdnsRecordRepository.java b/service-t/src/com/android/server/connectivity/mdns/MdnsRecordRepository.java
index 73a6f2f78b..411130b702 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MdnsRecordRepository.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MdnsRecordRepository.java
@@ -202,6 +202,8 @@ public class MdnsRecordRepository {
         public final List<RecordInfo<MdnsInetAddressRecord>> addressRecords;
         @NonNull
         public final NsdServiceInfo serviceInfo;
+        @NonNull
+        private final MdnsAdvertisingOptions mAdvertisingOptions;
 
         /**
          * Whether the service is sending exit announcements and will be destroyed soon.
@@ -223,9 +225,6 @@ public class MdnsRecordRepository {
          */
         private boolean isProbing;
 
-        @Nullable
-        private Duration ttl;
-
         /**
          * Create a ServiceRegistration with only update the subType.
          */
@@ -234,17 +233,38 @@ public class MdnsRecordRepository {
             NsdServiceInfo newServiceInfo = new NsdServiceInfo(serviceInfo);
             newServiceInfo.setSubtypes(newSubtypes);
             return new ServiceRegistration(srvRecord.record.getServiceHost(), newServiceInfo,
-                    repliedServiceCount, sentPacketCount, exiting, isProbing, ttl,
+                    repliedServiceCount, sentPacketCount, exiting, isProbing, mAdvertisingOptions,
                     featureFlags);
         }
 
+        /**
+         * Get filtered all records of the service registration.
+         */
+        List<RecordInfo<?>> getFilteredAllRecords() {
+            return CollectionUtils.filter(allRecords,
+                    info -> !mAdvertisingOptions.skipSubtypeAnnouncements() || !isSubtypePtrRecord(
+                            info));
+        }
+
+        /**
+         * Get filtered ptr records of the service registration.
+         */
+        List<RecordInfo<MdnsPointerRecord>> getFilteredPtrRecords() {
+            return CollectionUtils.filter(ptrRecords,
+                    info -> !mAdvertisingOptions.skipSubtypeAnnouncements() || !isSubtypePtrRecord(
+                            info));
+        }
+
+
         /**
          * Create a ServiceRegistration for dns-sd service registration (RFC6763).
          */
         ServiceRegistration(@NonNull String[] deviceHostname, @NonNull NsdServiceInfo serviceInfo,
                 int repliedServiceCount, int sentPacketCount, boolean exiting, boolean isProbing,
-                @Nullable Duration ttl, @NonNull MdnsFeatureFlags featureFlags) {
+                @NonNull MdnsAdvertisingOptions advertisingOptions,
+                @NonNull MdnsFeatureFlags featureFlags) {
             this.serviceInfo = serviceInfo;
+            this.mAdvertisingOptions = advertisingOptions;
 
             final long nonNameRecordsTtlMillis;
             final long nameRecordsTtlMillis;
@@ -253,6 +273,7 @@ public class MdnsRecordRepository {
             // This is typically useful for SRP (Service Registration Protocol:
             // https://datatracker.ietf.org/doc/html/draft-ietf-dnssd-srp-24) Advertising Proxy
             // where all records in a single SRP are required the same TTL.
+            final Duration ttl = advertisingOptions.getTtl();
             if (ttl != null) {
                 nonNameRecordsTtlMillis = ttl.toMillis();
                 nameRecordsTtlMillis = ttl.toMillis();
@@ -398,10 +419,11 @@ public class MdnsRecordRepository {
          * @param serviceInfo Service to advertise
          */
         ServiceRegistration(@NonNull String[] deviceHostname, @NonNull NsdServiceInfo serviceInfo,
-                int repliedServiceCount, int sentPacketCount, @Nullable Duration ttl,
+                int repliedServiceCount, int sentPacketCount,
+                @NonNull MdnsAdvertisingOptions advertisingOptions,
                 @NonNull MdnsFeatureFlags featureFlags) {
             this(deviceHostname, serviceInfo,repliedServiceCount, sentPacketCount,
-                    false /* exiting */, true /* isProbing */, ttl, featureFlags);
+                    false /* exiting */, true /* isProbing */, advertisingOptions, featureFlags);
         }
 
         void setProbing(boolean probing) {
@@ -467,12 +489,13 @@ public class MdnsRecordRepository {
      * This may remove/replace any existing service that used the name added but is exiting.
      * @param serviceId A unique service ID.
      * @param serviceInfo Service info to add.
-     * @param ttl the TTL duration for all records of {@code serviceInfo} or {@code null}
+     * @param advertisingOptions the advertiser options for this service.
      * @return If the added service replaced another with a matching name (which was exiting), the
      *         ID of the replaced service.
      * @throws NameConflictException There is already a (non-exiting) service using the name.
      */
-    public int addService(int serviceId, NsdServiceInfo serviceInfo, @Nullable Duration ttl)
+    public int addService(int serviceId, NsdServiceInfo serviceInfo,
+            @NonNull MdnsAdvertisingOptions advertisingOptions)
             throws NameConflictException {
         if (mServices.contains(serviceId)) {
             throw new IllegalArgumentException(
@@ -488,7 +511,7 @@ public class MdnsRecordRepository {
 
         final ServiceRegistration registration = new ServiceRegistration(
                 mDeviceHostname, serviceInfo, NO_PACKET /* repliedServiceCount */,
-                NO_PACKET /* sentPacketCount */, ttl,
+                NO_PACKET /* sentPacketCount */, advertisingOptions,
                 mMdnsFeatureFlags);
         mServices.put(serviceId, registration);
 
@@ -588,14 +611,14 @@ public class MdnsRecordRepository {
         if (registration == null) return null;
         if (registration.exiting) return null;
 
-        // Send exit (TTL 0) for the PTR records, if at least one was sent (in particular don't send
-        // if still probing)
-        if (CollectionUtils.all(registration.ptrRecords, r -> r.lastSentTimeMs == 0L)) {
+        registration.exiting = true;
+        final List<RecordInfo<MdnsPointerRecord>> filteredRecords = CollectionUtils.filter(
+                registration.getFilteredPtrRecords(), r -> r.lastSentTimeMs != 0L);
+        if (filteredRecords.isEmpty()) {
             return null;
         }
-
-        registration.exiting = true;
-        final List<MdnsRecord> expiredRecords = CollectionUtils.map(registration.ptrRecords,
+        final List<MdnsRecord> expiredRecords = CollectionUtils.map(
+                filteredRecords,
                 r -> new MdnsPointerRecord(
                         r.record.getName(),
                         0L /* receiptTimeMillis */,
@@ -1100,6 +1123,14 @@ public class MdnsRecordRepository {
         return makeAnnouncementInfo(serviceId, registration);
     }
 
+    private static boolean isSubtypePtrRecord(@NonNull RecordInfo<?> info) {
+        if (!(info.record instanceof MdnsPointerRecord)) {
+            return false;
+        }
+        final String[] recordName = info.record.getName();
+        return recordName.length > 4;
+    }
+
     /**
      * Make the announcement info of the given service ID.
      *
@@ -1132,13 +1163,15 @@ public class MdnsRecordRepository {
                     });
         }
 
+        final List<RecordInfo<?>> filteredAllRecords = registration.getFilteredAllRecords();
         // All service records
-        for (RecordInfo<?> info : registration.allRecords) {
+        for (RecordInfo<?> info : filteredAllRecords) {
             answersSet.add(info.record);
         }
 
+        // ignore all the PTR query with subtype
         addNsecRecordsForUniqueNames(additionalAnswers,
-                mGeneralRecords.iterator(), registration.allRecords.iterator());
+                mGeneralRecords.iterator(), filteredAllRecords.iterator());
 
         return new MdnsAnnouncer.AnnouncementInfo(serviceId,
                 new ArrayList<>(answersSet), additionalAnswers);
@@ -1158,6 +1191,10 @@ public class MdnsRecordRepository {
 
         // Adds all PTR, SRV, TXT, A/AAAA records.
         for (RecordInfo<MdnsPointerRecord> ptrRecord : registration.ptrRecords) {
+            if (registration.mAdvertisingOptions.skipSubtypeAnnouncements() && isSubtypePtrRecord(
+                    ptrRecord)) {
+                continue;
+            }
             answers.add(ptrRecord.record);
         }
         if (registration.srvRecord != null) {
@@ -1424,8 +1461,8 @@ public class MdnsRecordRepository {
         if (existing == null) return null;
 
         final ServiceRegistration newService = new ServiceRegistration(mDeviceHostname, newInfo,
-                existing.repliedServiceCount, existing.sentPacketCount, existing.ttl,
-                mMdnsFeatureFlags);
+                existing.repliedServiceCount, existing.sentPacketCount,
+                existing.mAdvertisingOptions, mMdnsFeatureFlags);
         mServices.put(serviceId, newService);
         return makeProbingInfo(serviceId, newService);
     }
@@ -1438,7 +1475,7 @@ public class MdnsRecordRepository {
         if (registration == null) return;
 
         final long now = mDeps.elapsedRealTime();
-        for (RecordInfo<?> record : registration.allRecords) {
+        for (RecordInfo<?> record : registration.getFilteredAllRecords()) {
             record.lastSentTimeMs = now;
             record.lastAdvertisedOnIpv4TimeMs = now;
             record.lastAdvertisedOnIpv6TimeMs = now;
diff --git a/tests/unit/java/com/android/server/connectivity/mdns/MdnsAdvertiserTest.kt b/tests/unit/java/com/android/server/connectivity/mdns/MdnsAdvertiserTest.kt
index 087617ad62..e08ce84109 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/MdnsAdvertiserTest.kt
+++ b/tests/unit/java/com/android/server/connectivity/mdns/MdnsAdvertiserTest.kt
@@ -576,14 +576,14 @@ class MdnsAdvertiserTest {
     }
 
     @Test
-    fun testAddService_NoSubtypeForGoogleCastOffload() {
+    fun testAddService_NoSubtypeForOffloadWhenSkipAnnouncements() {
         val advertiser =
             MdnsAdvertiser(thread.looper, socketProvider, cb, mockDeps, sharedlog, flags, context)
         postSync {
             advertiser.addOrUpdateService(
                 SERVICE_ID_1,
                 GOOGLECAST_SERVICE,
-                DEFAULT_ADVERTISING_OPTION,
+                MdnsAdvertisingOptions.newBuilder().setSkipSubtypeAnnouncements(true).build(),
                 TEST_CLIENT_UID_1
             )
         }
diff --git a/tests/unit/java/com/android/server/connectivity/mdns/MdnsInterfaceAdvertiserTest.kt b/tests/unit/java/com/android/server/connectivity/mdns/MdnsInterfaceAdvertiserTest.kt
index dc62c8474b..4c003c54e9 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/MdnsInterfaceAdvertiserTest.kt
+++ b/tests/unit/java/com/android/server/connectivity/mdns/MdnsInterfaceAdvertiserTest.kt
@@ -575,7 +575,11 @@ class MdnsInterfaceAdvertiserTest {
         doReturn(testProbingInfo).`when`(repository).setServiceProbing(serviceId)
 
         advertiser.addService(serviceId, serviceInfo, MdnsAdvertisingOptions.getDefaultOptions())
-        verify(repository).addService(serviceId, serviceInfo, null /* ttl */)
+        verify(repository).addService(
+            serviceId,
+            serviceInfo,
+            MdnsAdvertisingOptions.newBuilder().build()
+        )
         verify(prober).startProbing(testProbingInfo)
 
         return testProbingInfo
diff --git a/tests/unit/java/com/android/server/connectivity/mdns/MdnsRecordRepositoryTest.kt b/tests/unit/java/com/android/server/connectivity/mdns/MdnsRecordRepositoryTest.kt
index 38b333c0ae..ddd8d176c1 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/MdnsRecordRepositoryTest.kt
+++ b/tests/unit/java/com/android/server/connectivity/mdns/MdnsRecordRepositoryTest.kt
@@ -85,6 +85,12 @@ private val TEST_TEMPORARY_IPV6_ADDRESS = LinkAddress(
     0 /* lifetime */
 )
 
+private val GOOGLECAST_SERVICE = NsdServiceInfo().apply {
+    serviceType = "_googlecast._tcp"
+    serviceName = "MyTestService"
+    port = TEST_PORT
+}
+
 private val TEST_SERVICE_1 = NsdServiceInfo().apply {
     serviceType = "_testservice._tcp"
     serviceName = "MyTestService"
@@ -147,6 +153,8 @@ private val TEST_PUBLIC_KEY_2 = hexStringToByteArray(
                 "270962d4"
 )
 
+private val DEFAULT_OPTION = MdnsAdvertisingOptions.newBuilder().build()
+
 @RunWith(DevSdkIgnoreRunner::class)
 @DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.S_V2)
 class MdnsRecordRepositoryTest {
@@ -195,10 +203,13 @@ class MdnsRecordRepositoryTest {
     @Test
     fun testAddServiceAndProbe() {
         val repository = MdnsRecordRepository(thread.looper, deps, TEST_HOSTNAME, makeFlags())
+        val option = MdnsAdvertisingOptions.newBuilder()
+            .setTtl(Duration.ofSeconds(50))
+            .build()
         assertEquals(0, repository.servicesCount)
         assertEquals(
             -1,
-            repository.addService(TEST_SERVICE_ID_1, TEST_SERVICE_1, Duration.ofSeconds(50))
+            repository.addService(TEST_SERVICE_ID_1, TEST_SERVICE_1, option)
         )
         assertEquals(1, repository.servicesCount)
 
@@ -238,10 +249,10 @@ class MdnsRecordRepositoryTest {
         val repository = MdnsRecordRepository(thread.looper, deps, TEST_HOSTNAME, makeFlags())
         repository.initWithService(TEST_SERVICE_ID_1, TEST_SERVICE_1)
         assertFailsWith(NameConflictException::class) {
-            repository.addService(TEST_SERVICE_ID_2, TEST_SERVICE_1, null /* ttl */)
+            repository.addService(TEST_SERVICE_ID_2, TEST_SERVICE_1, DEFAULT_OPTION)
         }
         assertFailsWith(NameConflictException::class) {
-            repository.addService(TEST_SERVICE_ID_3, TEST_SERVICE_3, null /* ttl */)
+            repository.addService(TEST_SERVICE_ID_3, TEST_SERVICE_3, DEFAULT_OPTION)
         }
     }
 
@@ -288,9 +299,9 @@ class MdnsRecordRepositoryTest {
     @Test
     fun testInvalidReuseOfServiceId() {
         val repository = MdnsRecordRepository(thread.looper, deps, TEST_HOSTNAME, makeFlags())
-        repository.addService(TEST_SERVICE_ID_1, TEST_SERVICE_1, null /* ttl */)
+        repository.addService(TEST_SERVICE_ID_1, TEST_SERVICE_1, DEFAULT_OPTION)
         assertFailsWith(IllegalArgumentException::class) {
-            repository.addService(TEST_SERVICE_ID_1, TEST_SERVICE_2, null /* ttl */)
+            repository.addService(TEST_SERVICE_ID_1, TEST_SERVICE_2, DEFAULT_OPTION)
         }
     }
 
@@ -299,7 +310,7 @@ class MdnsRecordRepositoryTest {
         val repository = MdnsRecordRepository(thread.looper, deps, TEST_HOSTNAME, makeFlags())
         assertFalse(repository.hasActiveService(TEST_SERVICE_ID_1))
 
-        repository.addService(TEST_SERVICE_ID_1, TEST_SERVICE_1, null /* ttl */)
+        repository.addService(TEST_SERVICE_ID_1, TEST_SERVICE_1, DEFAULT_OPTION)
         assertTrue(repository.hasActiveService(TEST_SERVICE_ID_1))
 
         val probingInfo = repository.setServiceProbing(TEST_SERVICE_ID_1)
@@ -391,6 +402,258 @@ class MdnsRecordRepositoryTest {
         assertEquals(0, repository.servicesCount)
     }
 
+    @Test
+    fun testAnnouncementsWithOutSubtypes() {
+        val repository = MdnsRecordRepository(thread.looper, deps, TEST_HOSTNAME, makeFlags())
+        val option = MdnsAdvertisingOptions.newBuilder().setSkipSubtypeAnnouncements(true).build()
+        val announcementInfo = repository.initWithService(
+            TEST_SERVICE_ID_1,
+            GOOGLECAST_SERVICE,
+            setOf(TEST_SUBTYPE, TEST_SUBTYPE2),
+            option = option
+        )
+        repository.onAdvertisementSent(TEST_SERVICE_ID_1, 2 /* sentPacketCount */)
+        val packet = announcementInfo.getPacket(0)
+
+        assertEquals(0, packet.transactionId)
+        assertEquals(0x8400 /* response, authoritative */, packet.flags)
+        assertEquals(0, packet.questions.size)
+        assertEquals(0, packet.authorityRecords.size)
+
+        val serviceType = arrayOf("_googlecast", "_tcp", "local")
+        val serviceName = arrayOf("MyTestService", "_googlecast", "_tcp", "local")
+        val v4AddrRev = getReverseDnsAddress(TEST_ADDRESSES[0].address)
+        val v6Addr1Rev = getReverseDnsAddress(TEST_ADDRESSES[1].address)
+        val v6Addr2Rev = getReverseDnsAddress(TEST_ADDRESSES[2].address)
+
+        assertThat(packet.answers).containsExactly(
+            // Reverse address and address records for the hostname
+            MdnsPointerRecord(
+                v4AddrRev,
+                0L /* receiptTimeMillis */,
+                true /* cacheFlush */,
+                120000L /* ttlMillis */,
+                TEST_HOSTNAME
+            ),
+            MdnsInetAddressRecord(
+                TEST_HOSTNAME,
+                0L /* receiptTimeMillis */,
+                true /* cacheFlush */,
+                120000L /* ttlMillis */,
+                TEST_ADDRESSES[0].address
+            ),
+            MdnsPointerRecord(
+                v6Addr1Rev,
+                0L /* receiptTimeMillis */,
+                true /* cacheFlush */,
+                120000L /* ttlMillis */,
+                TEST_HOSTNAME
+            ),
+            MdnsInetAddressRecord(
+                TEST_HOSTNAME,
+                0L /* receiptTimeMillis */,
+                true /* cacheFlush */,
+                120000L /* ttlMillis */,
+                TEST_ADDRESSES[1].address
+            ),
+            MdnsPointerRecord(
+                v6Addr2Rev,
+                0L /* receiptTimeMillis */,
+                true /* cacheFlush */,
+                120000L /* ttlMillis */,
+                TEST_HOSTNAME
+            ),
+            MdnsInetAddressRecord(
+                TEST_HOSTNAME,
+                0L /* receiptTimeMillis */,
+                true /* cacheFlush */,
+                120000L /* ttlMillis */,
+                TEST_ADDRESSES[2].address
+            ),
+            // Service registration records (RFC6763)
+            MdnsPointerRecord(
+                serviceType,
+                0L /* receiptTimeMillis */,
+                // Not a unique name owned by the announcer, so cacheFlush=false
+                false /* cacheFlush */,
+                4500000L /* ttlMillis */,
+                serviceName
+            ),
+            MdnsServiceRecord(
+                serviceName,
+                0L /* receiptTimeMillis */,
+                true /* cacheFlush */,
+                120000L /* ttlMillis */,
+                0 /* servicePriority */,
+                0 /* serviceWeight */,
+                TEST_PORT /* servicePort */,
+                TEST_HOSTNAME
+            ),
+            MdnsTextRecord(
+                serviceName,
+                0L /* receiptTimeMillis */,
+                true /* cacheFlush */,
+                4500000L /* ttlMillis */,
+                emptyList() /* entries */
+            ),
+            // Service type enumeration record (RFC6763 9.)
+            MdnsPointerRecord(
+                arrayOf("_services", "_dns-sd", "_udp", "local"),
+                0L /* receiptTimeMillis */,
+                false /* cacheFlush */,
+                4500000L /* ttlMillis */,
+                serviceType
+            ))
+
+        assertContentEquals(listOf(
+            MdnsNsecRecord(
+                v4AddrRev,
+                0L /* receiptTimeMillis */,
+                true /* cacheFlush */,
+                120000L /* ttlMillis */,
+                v4AddrRev,
+                intArrayOf(TYPE_PTR)
+            ),
+            MdnsNsecRecord(
+                TEST_HOSTNAME,
+                0L /* receiptTimeMillis */,
+                true /* cacheFlush */,
+                120000L /* ttlMillis */,
+                TEST_HOSTNAME,
+                intArrayOf(TYPE_A, TYPE_AAAA)
+            ),
+            MdnsNsecRecord(
+                v6Addr1Rev,
+                0L /* receiptTimeMillis */,
+                true /* cacheFlush */,
+                120000L /* ttlMillis */,
+                v6Addr1Rev,
+                intArrayOf(TYPE_PTR)
+            ),
+            MdnsNsecRecord(
+                v6Addr2Rev,
+                0L /* receiptTimeMillis */,
+                true /* cacheFlush */,
+                120000L /* ttlMillis */,
+                v6Addr2Rev,
+                intArrayOf(TYPE_PTR)
+            ),
+            MdnsNsecRecord(
+                serviceName,
+                0L /* receiptTimeMillis */,
+                true /* cacheFlush */,
+                4500000L /* ttlMillis */,
+                serviceName,
+                intArrayOf(TYPE_TXT, TYPE_SRV)
+            )
+        ), packet.additionalRecords)
+    }
+
+    @Test
+    fun testExitAnnouncementsWithOutSubtypes() {
+        val repository = MdnsRecordRepository(thread.looper, deps, TEST_HOSTNAME, makeFlags())
+        val option = MdnsAdvertisingOptions.newBuilder().setSkipSubtypeAnnouncements(true).build()
+        repository.initWithService(
+            TEST_SERVICE_ID_1,
+            TEST_SERVICE_1,
+            setOf(TEST_SUBTYPE, TEST_SUBTYPE2),
+            option = option
+        )
+        repository.onAdvertisementSent(TEST_SERVICE_ID_1, 2 /* sentPacketCount */)
+
+        val exitAnnouncement = repository.exitService(TEST_SERVICE_ID_1)
+        assertNotNull(exitAnnouncement)
+        assertEquals(1, repository.servicesCount)
+        val packet = exitAnnouncement.getPacket(0)
+
+        assertEquals(0, packet.transactionId)
+        assertEquals(0x8400 /* response, authoritative */, packet.flags)
+        assertEquals(0, packet.questions.size)
+        assertEquals(0, packet.authorityRecords.size)
+        assertEquals(0, packet.additionalRecords.size)
+
+        assertThat(packet.answers).containsExactly(
+            MdnsPointerRecord(
+                arrayOf("_testservice", "_tcp", "local"),
+                0L /* receiptTimeMillis */,
+                false /* cacheFlush */,
+                0L /* ttlMillis */,
+                arrayOf("MyTestService", "_testservice", "_tcp", "local")
+            ),
+        )
+    }
+
+    @Test
+    fun testGetOffloadPacketWithoutSubtype() {
+        val repository = MdnsRecordRepository(thread.looper, deps, TEST_HOSTNAME, makeFlags())
+        val ipAddress = TEST_ADDRESSES.toMutableList()
+        ipAddress.add(TEST_TEMPORARY_IPV6_ADDRESS)
+        val option = MdnsAdvertisingOptions.newBuilder().setSkipSubtypeAnnouncements(true).build()
+        repository.initWithService(
+            TEST_SERVICE_ID_1,
+            GOOGLECAST_SERVICE,
+            setOf(TEST_SUBTYPE, TEST_SUBTYPE2),
+            addresses = ipAddress,
+            option = option
+        )
+        val serviceName = arrayOf("MyTestService", "_googlecast", "_tcp", "local")
+        val serviceType = arrayOf("_googlecast", "_tcp", "local")
+        val offloadPacket = repository.getOffloadPacket(TEST_SERVICE_ID_1)
+        assertEquals(0, offloadPacket.transactionId)
+        assertEquals(0x8400, offloadPacket.flags)
+        assertEquals(0, offloadPacket.questions.size)
+        assertEquals(0, offloadPacket.additionalRecords.size)
+        assertEquals(0, offloadPacket.authorityRecords.size)
+        assertContentEquals(listOf(
+            MdnsPointerRecord(
+                serviceType,
+                0L /* receiptTimeMillis */,
+                // Not a unique name owned by the announcer, so cacheFlush=false
+                false /* cacheFlush */,
+                4500000L /* ttlMillis */,
+                serviceName
+            ),
+            MdnsServiceRecord(
+                serviceName,
+                0L /* receiptTimeMillis */,
+                true /* cacheFlush */,
+                120000L /* ttlMillis */,
+                0 /* servicePriority */,
+                0 /* serviceWeight */,
+                TEST_PORT /* servicePort */,
+                TEST_HOSTNAME
+            ),
+            MdnsTextRecord(
+                serviceName,
+                0L /* receiptTimeMillis */,
+                true /* cacheFlush */,
+                4500000L /* ttlMillis */,
+                emptyList() /* entries */
+            ),
+            MdnsInetAddressRecord(
+                TEST_HOSTNAME,
+                0L /* receiptTimeMillis */,
+                true /* cacheFlush */,
+                120000L /* ttlMillis */,
+                TEST_ADDRESSES[0].address
+            ),
+            MdnsInetAddressRecord(
+                TEST_HOSTNAME,
+                0L /* receiptTimeMillis */,
+                true /* cacheFlush */,
+                120000L /* ttlMillis */,
+                TEST_ADDRESSES[1].address
+            ),
+            MdnsInetAddressRecord(
+                TEST_HOSTNAME,
+                0L /* receiptTimeMillis */,
+                true /* cacheFlush */,
+                120000L /* ttlMillis */,
+                TEST_ADDRESSES[2].address
+            ),
+        ), offloadPacket.answers)
+    }
+
     @Test
     fun testExitingServiceReAdded() {
         val repository = MdnsRecordRepository(thread.looper, deps, TEST_HOSTNAME, makeFlags())
@@ -400,7 +663,7 @@ class MdnsRecordRepositoryTest {
 
         assertEquals(
             TEST_SERVICE_ID_1,
-            repository.addService(TEST_SERVICE_ID_2, TEST_SERVICE_1, null /* ttl */)
+            repository.addService(TEST_SERVICE_ID_2, TEST_SERVICE_1, DEFAULT_OPTION)
         )
         assertEquals(1, repository.servicesCount)
 
@@ -1188,7 +1451,7 @@ class MdnsRecordRepositoryTest {
             subtypes = setOf(),
             listOf(LinkAddress(parseNumericAddress("192.0.2.111"), 24))
         )
-        repository.addService(TEST_CUSTOM_HOST_ID_2, TEST_CUSTOM_HOST_2, null /* ttl */)
+        repository.addService(TEST_CUSTOM_HOST_ID_2, TEST_CUSTOM_HOST_2, DEFAULT_OPTION)
         val src = InetSocketAddress(parseNumericAddress("fe80::123"), 5353)
 
         val query = makeQuery(TYPE_AAAA to TEST_CUSTOM_HOST_1_NAME)
@@ -1498,7 +1761,7 @@ class MdnsRecordRepositoryTest {
         repository.addService(
             TEST_SERVICE_CUSTOM_HOST_ID_1,
             TEST_SERVICE_CUSTOM_HOST_1,
-            null /* ttl */
+            DEFAULT_OPTION
         )
         repository.removeService(TEST_CUSTOM_HOST_ID_1)
         repository.removeService(TEST_SERVICE_CUSTOM_HOST_ID_1)
@@ -1744,8 +2007,8 @@ class MdnsRecordRepositoryTest {
     @Test
     fun testGetConflictingServices() {
         val repository = MdnsRecordRepository(thread.looper, deps, TEST_HOSTNAME, makeFlags())
-        repository.addService(TEST_SERVICE_ID_1, TEST_SERVICE_1, null /* ttl */)
-        repository.addService(TEST_SERVICE_ID_2, TEST_SERVICE_2, null /* ttl */)
+        repository.addService(TEST_SERVICE_ID_1, TEST_SERVICE_1, DEFAULT_OPTION)
+        repository.addService(TEST_SERVICE_ID_2, TEST_SERVICE_2, DEFAULT_OPTION)
 
         val packet = MdnsPacket(
                 0 /* flags */,
@@ -1785,8 +2048,8 @@ class MdnsRecordRepositoryTest {
     @Test
     fun testGetConflictingServicesCaseInsensitive() {
         val repository = MdnsRecordRepository(thread.looper, deps, TEST_HOSTNAME, makeFlags())
-        repository.addService(TEST_SERVICE_ID_1, TEST_SERVICE_1, null /* ttl */)
-        repository.addService(TEST_SERVICE_ID_2, TEST_SERVICE_2, null /* ttl */)
+        repository.addService(TEST_SERVICE_ID_1, TEST_SERVICE_1, DEFAULT_OPTION)
+        repository.addService(TEST_SERVICE_ID_2, TEST_SERVICE_2, DEFAULT_OPTION)
 
         val packet = MdnsPacket(
             0 /* flags */,
@@ -1826,8 +2089,8 @@ class MdnsRecordRepositoryTest {
     @Test
     fun testGetConflictingServices_customHosts_differentAddresses() {
         val repository = MdnsRecordRepository(thread.looper, deps, TEST_HOSTNAME, makeFlags())
-        repository.addService(TEST_CUSTOM_HOST_ID_1, TEST_CUSTOM_HOST_1, null /* ttl */)
-        repository.addService(TEST_CUSTOM_HOST_ID_2, TEST_CUSTOM_HOST_2, null /* ttl */)
+        repository.addService(TEST_CUSTOM_HOST_ID_1, TEST_CUSTOM_HOST_1, DEFAULT_OPTION)
+        repository.addService(TEST_CUSTOM_HOST_ID_2, TEST_CUSTOM_HOST_2, DEFAULT_OPTION)
 
         val packet = MdnsPacket(
                 0, /* flags */
@@ -1861,8 +2124,8 @@ class MdnsRecordRepositoryTest {
     @Test
     fun testGetConflictingServices_customHosts_moreAddressesThanUs_conflict() {
         val repository = MdnsRecordRepository(thread.looper, deps, TEST_HOSTNAME, makeFlags())
-        repository.addService(TEST_CUSTOM_HOST_ID_1, TEST_CUSTOM_HOST_1, null /* ttl */)
-        repository.addService(TEST_CUSTOM_HOST_ID_2, TEST_CUSTOM_HOST_2, null /* ttl */)
+        repository.addService(TEST_CUSTOM_HOST_ID_1, TEST_CUSTOM_HOST_1, DEFAULT_OPTION)
+        repository.addService(TEST_CUSTOM_HOST_ID_2, TEST_CUSTOM_HOST_2, DEFAULT_OPTION)
 
         val packet = MdnsPacket(
                 0, /* flags */
@@ -1931,7 +2194,7 @@ class MdnsRecordRepositoryTest {
     @Test
     fun testGetConflictingServices_customHostsReplyHasSameNameRecord_conflictDuringProbing() {
         val repository = MdnsRecordRepository(thread.looper, deps, TEST_HOSTNAME, makeFlags())
-        repository.addService(TEST_CUSTOM_HOST_ID_1, TEST_CUSTOM_HOST_1, null /* ttl */)
+        repository.addService(TEST_CUSTOM_HOST_ID_1, TEST_CUSTOM_HOST_1, DEFAULT_OPTION)
         repository.addServiceAndFinishProbing(TEST_CUSTOM_HOST_ID_2, TEST_CUSTOM_HOST_2)
 
         val packet = MdnsPacket(
@@ -2035,7 +2298,7 @@ class MdnsRecordRepositoryTest {
             serviceName = "MyTestService"
             port = TEST_PORT
             publicKey = TEST_PUBLIC_KEY
-        }, null /* ttl */)
+        }, DEFAULT_OPTION)
 
         val otherTtlMillis = 1234L
         val packet = MdnsPacket(
@@ -2069,7 +2332,7 @@ class MdnsRecordRepositoryTest {
             serviceName = "MyTestService"
             port = TEST_PORT
             publicKey = TEST_PUBLIC_KEY
-        }, null /* null */)
+        }, DEFAULT_OPTION)
 
         val otherTtlMillis = 1234L
         val packet = MdnsPacket(
@@ -2137,7 +2400,7 @@ class MdnsRecordRepositoryTest {
         repository.addService(TEST_SERVICE_ID_1, NsdServiceInfo().apply {
             hostname = "MyHost"
             publicKey = TEST_PUBLIC_KEY
-        }, null /* ttl */)
+        }, DEFAULT_OPTION)
 
         val otherTtlMillis = 1234L
         val packet = MdnsPacket(
@@ -2172,7 +2435,7 @@ class MdnsRecordRepositoryTest {
                     parseNumericAddress("2001:db8::1"),
                     parseNumericAddress("2001:db8::2"))
             publicKey = TEST_PUBLIC_KEY
-        }, null /* ttl */)
+        }, DEFAULT_OPTION)
 
         val otherTtlMillis = 1234L
         val packet = MdnsPacket(
@@ -2214,7 +2477,7 @@ class MdnsRecordRepositoryTest {
             port = TEST_PORT
             hostname = "MyHost"
             publicKey = TEST_PUBLIC_KEY
-        }, null /* ttl */)
+        }, DEFAULT_OPTION)
 
         // Although there's a KEY RR in the second registration being probed, it shouldn't conflict
         // with an address record which is from a probed registration in the repository.
@@ -2241,8 +2504,8 @@ class MdnsRecordRepositoryTest {
     @Test
     fun testGetConflictingServices_IdenticalService() {
         val repository = MdnsRecordRepository(thread.looper, deps, TEST_HOSTNAME, makeFlags())
-        repository.addService(TEST_SERVICE_ID_1, TEST_SERVICE_1, null /* ttl */)
-        repository.addService(TEST_SERVICE_ID_2, TEST_SERVICE_2, null /* ttl */)
+        repository.addService(TEST_SERVICE_ID_1, TEST_SERVICE_1, DEFAULT_OPTION)
+        repository.addService(TEST_SERVICE_ID_2, TEST_SERVICE_2, DEFAULT_OPTION)
 
         val otherTtlMillis = 1234L
         val packet = MdnsPacket(
@@ -2278,8 +2541,8 @@ class MdnsRecordRepositoryTest {
     @Test
     fun testGetConflictingServicesCaseInsensitive_IdenticalService() {
         val repository = MdnsRecordRepository(thread.looper, deps, TEST_HOSTNAME, makeFlags())
-        repository.addService(TEST_SERVICE_ID_1, TEST_SERVICE_1, null /* ttl */)
-        repository.addService(TEST_SERVICE_ID_2, TEST_SERVICE_2, null /* ttl */)
+        repository.addService(TEST_SERVICE_ID_1, TEST_SERVICE_1, DEFAULT_OPTION)
+        repository.addService(TEST_SERVICE_ID_2, TEST_SERVICE_2, DEFAULT_OPTION)
 
         val otherTtlMillis = 1234L
         val packet = MdnsPacket(
@@ -2382,7 +2645,7 @@ class MdnsRecordRepositoryTest {
         assertEquals(0, repository.servicesCount)
         assertEquals(
             -1,
-            repository.addService(TEST_SERVICE_ID_1, TEST_SERVICE_1, null /* ttl */)
+            repository.addService(TEST_SERVICE_ID_1, TEST_SERVICE_1, DEFAULT_OPTION)
         )
         assertEquals(1, repository.servicesCount)
 
@@ -2939,7 +3202,7 @@ class MdnsRecordRepositoryTest {
         repository.addService(
             TEST_SERVICE_CUSTOM_HOST_ID_1,
             TEST_SERVICE_CUSTOM_HOST_NO_ADDRESSES,
-            null
+            DEFAULT_OPTION
         )
         repository.setServiceProbing(TEST_SERVICE_CUSTOM_HOST_ID_1)
         repository.removeService(TEST_CUSTOM_HOST_ID_1)
@@ -3083,18 +3346,20 @@ private fun MdnsRecordRepository.initWithService(
     serviceId: Int,
     serviceInfo: NsdServiceInfo,
     subtypes: Set<String> = setOf(),
-    addresses: List<LinkAddress> = TEST_ADDRESSES
+    addresses: List<LinkAddress> = TEST_ADDRESSES,
+    option: MdnsAdvertisingOptions = DEFAULT_OPTION
 ): AnnouncementInfo {
     updateAddresses(addresses)
     serviceInfo.setSubtypes(subtypes)
-    return addServiceAndFinishProbing(serviceId, serviceInfo)
+    return addServiceAndFinishProbing(serviceId, serviceInfo, option)
 }
 
 private fun MdnsRecordRepository.addServiceAndFinishProbing(
     serviceId: Int,
-    serviceInfo: NsdServiceInfo
+    serviceInfo: NsdServiceInfo,
+    option: MdnsAdvertisingOptions = DEFAULT_OPTION
 ): AnnouncementInfo {
-    addService(serviceId, serviceInfo, null /* ttl */)
+    addService(serviceId, serviceInfo, option)
     val probingInfo = setServiceProbing(serviceId)
     assertNotNull(probingInfo)
     return onProbingSucceeded(probingInfo)

From af0d036f6e611319f8d226e9f1e2be0aa4c10b74 Mon Sep 17 00:00:00 2001
From: Yuyang Huang <yuyanghuang@google.com>
Date: Fri, 25 Apr 2025 13:34:15 +0900
Subject: [PATCH 231/377] Implement offload only code path in NsdService for TV
 migration

This commit adds the implementation in NsdService to support offloading
only advertisement requests. This is a temporary solution to facilitate
the migration of TV devices to APF-based mDNS offload.

Test: TH
Flag: EXEMPT bug fix
Change-Id: I7b8535956e701a34fca31908b8b21e9ab731505c
---
 .../android/net/nsd/AdvertisingRequest.java   |  7 +++
 .../src/com/android/server/NsdService.java    | 23 +++++++++
 .../mdns/MdnsAdvertisingOptions.java          | 29 +++++++++--
 .../mdns/MdnsInterfaceAdvertiser.java         |  2 +-
 .../mdns/MdnsRecordRepository.java            | 13 +++--
 .../com/android/server/NsdServiceTest.java    | 50 +++++++++++++++++++
 .../mdns/MdnsInterfaceAdvertiserTest.kt       | 18 +++++++
 .../mdns/MdnsRecordRepositoryTest.kt          | 37 ++++++++++++++
 8 files changed, 171 insertions(+), 8 deletions(-)

diff --git a/framework-t/src/android/net/nsd/AdvertisingRequest.java b/framework-t/src/android/net/nsd/AdvertisingRequest.java
index 4b1833ad8b..c2e7a0c7c9 100644
--- a/framework-t/src/android/net/nsd/AdvertisingRequest.java
+++ b/framework-t/src/android/net/nsd/AdvertisingRequest.java
@@ -58,6 +58,13 @@ public final class AdvertisingRequest implements Parcelable {
      */
     public static final long FLAG_SKIP_SUBTYPE_ANNOUNCEMENTS = 1L << 63;
 
+    /**
+     * Only for hardware offload, if this flag is set, NsdManager will only send callbacks to
+     * registered OffloadEngine, and not reply to mDNS queries by itself.
+     * @hide
+     */
+    public static final long FLAG_OFFLOAD_ONLY = 1L << 62;
+
     /** @hide */
     @Retention(RetentionPolicy.SOURCE)
     @LongDef(flag = true, prefix = {"FLAG_"}, value = {
diff --git a/service-t/src/com/android/server/NsdService.java b/service-t/src/com/android/server/NsdService.java
index 17139a9889..7a72f72246 100644
--- a/service-t/src/com/android/server/NsdService.java
+++ b/service-t/src/com/android/server/NsdService.java
@@ -19,10 +19,12 @@ package com.android.server;
 import static android.Manifest.permission.DEVICE_POWER;
 import static android.Manifest.permission.NETWORK_SETTINGS;
 import static android.Manifest.permission.NETWORK_STACK;
+import static android.content.pm.PackageManager.FEATURE_LEANBACK;
 import static android.net.ConnectivityManager.NETID_UNSET;
 import static android.net.NetworkCapabilities.TRANSPORT_VPN;
 import static android.net.NetworkCapabilities.TRANSPORT_WIFI;
 import static android.net.NetworkStack.PERMISSION_MAINLINE_NETWORK_STACK;
+import static android.net.nsd.AdvertisingRequest.FLAG_OFFLOAD_ONLY;
 import static android.net.nsd.AdvertisingRequest.FLAG_SKIP_PROBING;
 import static android.net.nsd.AdvertisingRequest.FLAG_SKIP_SUBTYPE_ANNOUNCEMENTS;
 import static android.net.nsd.NsdManager.MDNS_DISCOVERY_MANAGER_EVENT;
@@ -803,6 +805,19 @@ public class NsdService extends INsdManager.Stub {
                 return true;
             }
 
+            private boolean isOffloadOnlyAllowed() {
+                if (!mContext.getPackageManager().hasSystemFeature(FEATURE_LEANBACK)) {
+                    return false;
+                }
+                // The offload-only code path is a fallback for Google Cast on Android TV devices.
+                // To utilize APF-based mDNS offload, the service must be advertised via
+                // NsdManager. However, limitations or edge cases might prevent Google Cast
+                // service advertisement through NsdManager. Until these issues are resolved,
+                // MediaShell can use the offload-only code path to still leverage APF for offload.
+                // This code path is only valid in Android B TV release.
+                return Build.VERSION_CODES.BAKLAVA == Build.VERSION.SDK_INT;
+            }
+
             @Override
             public boolean processMessage(Message msg) {
                 final ClientInfo clientInfo;
@@ -1045,6 +1060,13 @@ public class NsdService extends INsdManager.Stub {
                                         NsdManager.FAILURE_BAD_PARAMETERS, false /* isLegacy */);
                                 break;
                             }
+                            final boolean isOffloadOnly =
+                                    (advertisingRequest.getFlags() & FLAG_OFFLOAD_ONLY) != 0;
+                            if (isOffloadOnly && !isOffloadOnlyAllowed()) {
+                                clientInfo.onRegisterServiceFailedImmediately(clientRequestId,
+                                        NsdManager.FAILURE_BAD_PARAMETERS, false /* isLegacy */);
+                                break;
+                            }
 
                             serviceInfo.setSubtypes(subtypes);
                             maybeStartMonitoringSockets();
@@ -1058,6 +1080,7 @@ public class NsdService extends INsdManager.Stub {
                                             .setSkipProbing(skipProbing)
                                             .setTtl(advertisingRequest.getTtl())
                                             .setSkipSubtypeAnnouncements(skipSubtypeAnnouncements)
+                                            .setOffloadOnly(isOffloadOnly)
                                             .build();
                             mAdvertiser.addOrUpdateService(transactionId, serviceInfo,
                                     mdnsAdvertisingOptions, clientInfo.mUid);
diff --git a/service-t/src/com/android/server/connectivity/mdns/MdnsAdvertisingOptions.java b/service-t/src/com/android/server/connectivity/mdns/MdnsAdvertisingOptions.java
index 250e61fd6e..3e47c0bbbe 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MdnsAdvertisingOptions.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MdnsAdvertisingOptions.java
@@ -36,16 +36,18 @@ public class MdnsAdvertisingOptions {
     private final Duration mTtl;
     private final boolean mSkipProbing;
     private final boolean mSkipSubtypeAnnouncements;
+    private final boolean mIsOffloadOnly;
 
     /**
      * Parcelable constructs for a {@link MdnsAdvertisingOptions}.
      */
     MdnsAdvertisingOptions(boolean isOnlyUpdate, @Nullable Duration ttl, boolean skipProbing,
-            boolean skipSubtypeAnnouncements) {
+            boolean skipSubtypeAnnouncements, boolean isOffloadOnly) {
         this.mIsOnlyUpdate = isOnlyUpdate;
         this.mTtl = ttl;
         this.mSkipProbing = skipProbing;
         this.mSkipSubtypeAnnouncements = skipSubtypeAnnouncements;
+        this.mIsOffloadOnly = isOffloadOnly;
     }
 
     /**
@@ -79,6 +81,13 @@ public class MdnsAdvertisingOptions {
         return mSkipProbing;
     }
 
+    /**
+     * @return {@code true} if this request is an offload only request.
+     */
+    public boolean isOffloadOnly() {
+        return mIsOffloadOnly;
+    }
+
     /**
      * Returns the TTL for all records in a service.
      */
@@ -105,13 +114,15 @@ public class MdnsAdvertisingOptions {
             return mIsOnlyUpdate == otherOptions.mIsOnlyUpdate
                     && mSkipProbing == otherOptions.mSkipProbing
                     && mSkipSubtypeAnnouncements == otherOptions.mSkipSubtypeAnnouncements
+                    && mIsOffloadOnly == otherOptions.mIsOffloadOnly
                     && Objects.equals(mTtl, otherOptions.mTtl);
         }
     }
 
     @Override
     public int hashCode() {
-        return Objects.hash(mIsOnlyUpdate, mTtl, mSkipProbing, mSkipSubtypeAnnouncements);
+        return Objects.hash(mIsOnlyUpdate, mTtl, mSkipProbing, mSkipSubtypeAnnouncements,
+                mIsOffloadOnly);
     }
 
     @Override
@@ -131,6 +142,9 @@ public class MdnsAdvertisingOptions {
             sb.append(" ttl=");
             sb.append(mTtl);
         }
+        if (mIsOffloadOnly) {
+            sb.append(" isOffloadOnly");
+        }
         sb.append(" }");
         return sb.toString();
     }
@@ -142,6 +156,7 @@ public class MdnsAdvertisingOptions {
         private boolean mIsOnlyUpdate = false;
         private boolean mSkipProbing = false;
         private boolean mSkipSubtypeAnnouncements = false;
+        private boolean mIsOffloadOnly = false;
         @Nullable
         private Duration mTtl;
 
@@ -180,12 +195,20 @@ public class MdnsAdvertisingOptions {
             return this;
         }
 
+        /**
+         * Sets whether the request is offload only request or not.
+         */
+        public Builder setOffloadOnly(boolean isOffloadOnly) {
+            this.mIsOffloadOnly = isOffloadOnly;
+            return this;
+        }
+
         /**
          * Builds a {@link MdnsAdvertisingOptions} with the arguments supplied to this builder.
          */
         public MdnsAdvertisingOptions build() {
             return new MdnsAdvertisingOptions(mIsOnlyUpdate, mTtl, mSkipProbing,
-                    mSkipSubtypeAnnouncements);
+                    mSkipSubtypeAnnouncements, mIsOffloadOnly);
         }
     }
 }
diff --git a/service-t/src/com/android/server/connectivity/mdns/MdnsInterfaceAdvertiser.java b/service-t/src/com/android/server/connectivity/mdns/MdnsInterfaceAdvertiser.java
index b5c3468343..878fd26211 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MdnsInterfaceAdvertiser.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MdnsInterfaceAdvertiser.java
@@ -285,7 +285,7 @@ public class MdnsInterfaceAdvertiser implements MulticastPacketReader.PacketHand
             mAnnouncer.stop(replacedExitingService);
         }
         final MdnsProber.ProbingInfo probingInfo = mRecordRepository.setServiceProbing(id);
-        if (advertisingOptions.skipProbing()) {
+        if (advertisingOptions.skipProbing() || advertisingOptions.isOffloadOnly()) {
             handleProbingFinished(probingInfo);
         } else {
             mProber.startProbing(probingInfo);
diff --git a/service-t/src/com/android/server/connectivity/mdns/MdnsRecordRepository.java b/service-t/src/com/android/server/connectivity/mdns/MdnsRecordRepository.java
index 411130b702..741550ae66 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MdnsRecordRepository.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MdnsRecordRepository.java
@@ -430,6 +430,9 @@ public class MdnsRecordRepository {
             this.isProbing = probing;
         }
 
+        boolean isActive() {
+            return !exiting && !mAdvertisingOptions.isOffloadOnly();
+        }
     }
 
     /**
@@ -609,7 +612,7 @@ public class MdnsRecordRepository {
     public MdnsAnnouncer.ExitAnnouncementInfo exitService(int id) {
         final ServiceRegistration registration = mServices.get(id);
         if (registration == null) return null;
-        if (registration.exiting) return null;
+        if (!registration.isActive()) return null;
 
         registration.exiting = true;
         final List<RecordInfo<MdnsPointerRecord>> filteredRecords = CollectionUtils.filter(
@@ -721,7 +724,9 @@ public class MdnsRecordRepository {
             // Add answers from each service
             for (int i = 0; i < mServices.size(); i++) {
                 final ServiceRegistration registration = mServices.valueAt(i);
-                if (registration.exiting || registration.isProbing) continue;
+                if (!registration.isActive() || registration.isProbing) {
+                    continue;
+                }
                 if (addReplyFromService(question, registration.allRecords, registration.ptrRecords,
                         registration.srvRecord, registration.txtRecord,
                         registration.serviceInfo.getHostname(),
@@ -1243,7 +1248,7 @@ public class MdnsRecordRepository {
             SparseIntArray conflictingWithRecord = new SparseIntArray();
             for (int i = 0; i < mServices.size(); i++) {
                 final ServiceRegistration registration = mServices.valueAt(i);
-                if (registration.exiting) continue;
+                if (!registration.isActive()) continue;
 
                 final RecordConflictType conflictForService =
                         conflictForService(record, registration);
@@ -1409,7 +1414,7 @@ public class MdnsRecordRepository {
         for (int i = 0; i < mServices.size(); ++i) {
             int id = mServices.keyAt(i);
             ServiceRegistration service = mServices.valueAt(i);
-            if (service.exiting) continue;
+            if (!service.isActive()) continue;
             if (DnsUtils.equalsIgnoreDnsCase(service.serviceInfo.getHostname(), hostname)) {
                 consumer.accept(id, service);
             }
diff --git a/tests/unit/java/com/android/server/NsdServiceTest.java b/tests/unit/java/com/android/server/NsdServiceTest.java
index 8b9a00d6a7..86f177ac6e 100644
--- a/tests/unit/java/com/android/server/NsdServiceTest.java
+++ b/tests/unit/java/com/android/server/NsdServiceTest.java
@@ -23,6 +23,7 @@ import static android.app.ActivityManager.RunningAppProcessInfo.IMPORTANCE_CACHE
 import static android.app.ActivityManager.RunningAppProcessInfo.IMPORTANCE_FOREGROUND;
 import static android.app.ActivityManager.RunningAppProcessInfo.IMPORTANCE_GONE;
 import static android.app.ActivityManager.RunningAppProcessInfo.IMPORTANCE_VISIBLE;
+import static android.content.pm.PackageManager.FEATURE_LEANBACK;
 import static android.content.pm.PackageManager.PERMISSION_DENIED;
 import static android.content.pm.PackageManager.PERMISSION_GRANTED;
 import static android.net.InetAddresses.parseNumericAddress;
@@ -55,6 +56,7 @@ import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertThrows;
 import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.assertFalse;
+import static org.junit.Assume.assumeTrue;
 import static org.mockito.ArgumentMatchers.anyInt;
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.ArgumentMatchers.argThat;
@@ -1655,6 +1657,54 @@ public class NsdServiceTest {
                 .onRegistrationFailed(any(), eq(FAILURE_BAD_PARAMETERS));
     }
 
+    @Test
+    public void testAdvertiseOffloadOnly_FailsForNonTv() {
+        setMdnsAdvertiserEnabled();
+        doReturn(false).when(mPackageManager).hasSystemFeature(FEATURE_LEANBACK);
+        final NsdManager client = connectClient(mService);
+        final RegistrationListener regListener = mock(RegistrationListener.class);
+        final ArgumentCaptor<MdnsAdvertiser.AdvertiserCallback> cbCaptor =
+                ArgumentCaptor.forClass(MdnsAdvertiser.AdvertiserCallback.class);
+        verify(mDeps).makeMdnsAdvertiser(any(), any(), cbCaptor.capture(), any(), any(), any());
+
+        final NsdServiceInfo regInfo = new NsdServiceInfo("Service custom TTL", SERVICE_TYPE);
+        regInfo.setPort(1234);
+        final AdvertisingRequest request =
+                new AdvertisingRequest.Builder(regInfo, NsdManager.PROTOCOL_DNS_SD)
+                        .setFlags(AdvertisingRequest.FLAG_OFFLOAD_ONLY).build();
+        client.registerService(request, Runnable::run, regListener);
+        waitForIdle();
+
+        verify(regListener, timeout(TIMEOUT_MS))
+                .onRegistrationFailed(any(), eq(FAILURE_BAD_PARAMETERS));
+    }
+
+    @Test
+    public void testAdvertiseOffloadOnly_SupportForTvRunningAndroidB() {
+        assumeTrue(Build.VERSION_CODES.BAKLAVA == Build.VERSION.SDK_INT);
+        setMdnsAdvertiserEnabled();
+        doReturn(true).when(mPackageManager).hasSystemFeature(FEATURE_LEANBACK);
+        final NsdManager client = connectClient(mService);
+        final RegistrationListener regListener = mock(RegistrationListener.class);
+        final ArgumentCaptor<MdnsAdvertiser.AdvertiserCallback> cbCaptor =
+                ArgumentCaptor.forClass(MdnsAdvertiser.AdvertiserCallback.class);
+        verify(mDeps).makeMdnsAdvertiser(any(), any(), cbCaptor.capture(), any(), any(), any());
+
+        final NsdServiceInfo regInfo = new NsdServiceInfo("Service custom TTL", SERVICE_TYPE);
+        regInfo.setPort(1234);
+        final AdvertisingRequest request =
+                new AdvertisingRequest.Builder(regInfo, NsdManager.PROTOCOL_DNS_SD)
+                        .setFlags(AdvertisingRequest.FLAG_OFFLOAD_ONLY).build();
+        client.registerService(request, Runnable::run, regListener);
+        waitForIdle();
+
+        final ArgumentCaptor<MdnsAdvertisingOptions> optionsCaptor =
+                ArgumentCaptor.forClass(MdnsAdvertisingOptions.class);
+        verify(mAdvertiser).addOrUpdateService(anyInt(), any(),
+                optionsCaptor.capture(), anyInt());
+        assertTrue(optionsCaptor.getValue().isOffloadOnly());
+    }
+
     @Test
     public void testStopServiceResolutionWithMdnsDiscoveryManager() {
         setMdnsDiscoveryManagerEnabled();
diff --git a/tests/unit/java/com/android/server/connectivity/mdns/MdnsInterfaceAdvertiserTest.kt b/tests/unit/java/com/android/server/connectivity/mdns/MdnsInterfaceAdvertiserTest.kt
index 4c003c54e9..49467f7be1 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/MdnsInterfaceAdvertiserTest.kt
+++ b/tests/unit/java/com/android/server/connectivity/mdns/MdnsInterfaceAdvertiserTest.kt
@@ -555,6 +555,24 @@ class MdnsInterfaceAdvertiserTest {
         verify(prober).startProbing(any())
     }
 
+    @Test
+    fun testOffloadOnlyWillSkipProbing() {
+        val testProbingInfo = mock(ProbingInfo::class.java)
+        doReturn(TEST_SERVICE_ID_1).`when`(repository)
+            .addService(eq(TEST_SERVICE_ID_1), any(), any())
+        doReturn(TEST_SERVICE_ID_1).`when`(testProbingInfo).serviceId
+        doReturn(testProbingInfo).`when`(repository).setServiceProbing(TEST_SERVICE_ID_1)
+        advertiser.addService(
+            TEST_SERVICE_ID_1,
+            TEST_SERVICE_1_SUBTYPE,
+            MdnsAdvertisingOptions.newBuilder().setOffloadOnly(true).build()
+        )
+        verify(repository).addService(eq(TEST_SERVICE_ID_1), any(), any())
+        thread.waitForIdle(TIMEOUT_MS)
+        verify(prober, never()).startProbing(any())
+        verify(cb).onServiceProbingSucceeded(advertiser, TEST_SERVICE_ID_1)
+    }
+
     @Test
     fun testUpdateExistingService() {
         doReturn(TEST_SERVICE_ID_DUPLICATE).`when`(repository)
diff --git a/tests/unit/java/com/android/server/connectivity/mdns/MdnsRecordRepositoryTest.kt b/tests/unit/java/com/android/server/connectivity/mdns/MdnsRecordRepositoryTest.kt
index ddd8d176c1..7e37a9b1c0 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/MdnsRecordRepositoryTest.kt
+++ b/tests/unit/java/com/android/server/connectivity/mdns/MdnsRecordRepositoryTest.kt
@@ -296,6 +296,43 @@ class MdnsRecordRepositoryTest {
         ), reply.answers)
     }
 
+    @Test
+    fun testGetReplyReturnsNullForOffloadOnlyService() {
+        val repository = MdnsRecordRepository(thread.looper, deps, TEST_HOSTNAME, makeFlags())
+        repository.initWithService(
+            TEST_SERVICE_ID_1,
+            TEST_SERVICE_1,
+            option = MdnsAdvertisingOptions.newBuilder().setOffloadOnly(true).build()
+        )
+
+        val queriedName = arrayOf(TEST_SUBTYPE, "_sub", "_testservice", "_tcp", "local")
+        val questions = listOf(MdnsPointerRecord(queriedName, false /* isUnicast */))
+        val query = MdnsPacket(
+            0 /* flags */,
+            questions,
+            emptyList() /* answers */,
+            emptyList() /* authorityRecords */,
+            emptyList() /* additionalRecords */
+        )
+        val src = InetSocketAddress(parseNumericAddress("192.0.2.123"), 5353)
+        val reply = repository.getReply(query, src)
+
+        assertNull(reply)
+    }
+
+    @Test
+    fun testExitServiceReturnNullForOffloadOnlyService() {
+        val repository = MdnsRecordRepository(thread.looper, deps, TEST_HOSTNAME, makeFlags())
+        repository.initWithService(
+            TEST_SERVICE_ID_1,
+            TEST_SERVICE_1,
+            option = MdnsAdvertisingOptions.newBuilder().setOffloadOnly(true).build()
+        )
+        repository.onAdvertisementSent(TEST_SERVICE_ID_1, 2 /* sentPacketCount */)
+        val reply = repository.exitService(TEST_SERVICE_ID_1)
+        assertNull(reply)
+    }
+
     @Test
     fun testInvalidReuseOfServiceId() {
         val repository = MdnsRecordRepository(thread.looper, deps, TEST_HOSTNAME, makeFlags())

From fddcd517931bd0684468d266810d7b3306705363 Mon Sep 17 00:00:00 2001
From: Xiao Ma <xiaom@google.com>
Date: Mon, 12 May 2025 18:29:07 +0900
Subject: [PATCH 232/377] add an integration test to verify DHCPv6 PD rebind
 for P flag.

Flag: EXEMPT test-only change
Bug: 315069348
Test: atest FrameworksNetIntegrationTests
Change-Id: Ie1413c6aef964b40eff05cc77c45d1324ad1ad6f
---
 .../src/android/net/Dhcp6PdTest.kt            | 33 +++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/tests/integration/src/android/net/Dhcp6PdTest.kt b/tests/integration/src/android/net/Dhcp6PdTest.kt
index 594984ceb7..cd1b340753 100644
--- a/tests/integration/src/android/net/Dhcp6PdTest.kt
+++ b/tests/integration/src/android/net/Dhcp6PdTest.kt
@@ -29,6 +29,7 @@ import android.platform.test.annotations.AppModeFull
 import android.provider.DeviceConfig.NAMESPACE_CONNECTIVITY
 import androidx.test.platform.app.InstrumentationRegistry
 import com.android.net.module.util.dhcp6.Dhcp6Packet
+import com.android.net.module.util.dhcp6.Dhcp6RebindPacket
 import com.android.net.module.util.dhcp6.Dhcp6SolicitPacket
 import com.android.testutils.AutoCloseTestInterfaceRule
 import com.android.testutils.DevSdkIgnoreRule
@@ -195,6 +196,38 @@ class Dhcp6PdTest {
         networkCallback.expect<Available>()
     }
 
+    @Test
+    fun testProvisioning_triggeredByMultiplePrefixesWithPflag() {
+        ndResponder.addRouterEntry(ROUTER_MAC, ROUTER_V6, RA_WITH_PFLAG)
+        val (srcAddr, solicit) = expectDhcp6Packet<Dhcp6SolicitPacket>()
+
+        run {
+            val ether = EtherPkt(src = ROUTER_MAC, dst = localMac)
+            val ipv6 = Ip6Pkt(src = ROUTER_V6, dst = srcAddr)
+            val udp = UdpPkt(sport = 547, dport = 546)
+            val dhcp6 = Dhcp6Pkt(type = "REPLY", transId = solicit.transactionId)
+                .addRapidCommitOption()
+                .addClientIdentifierOption(solicit.clientDuid)
+                .addServerIdentifierOption(byteArrayOf(1, 2, 3, 4, 5, 6))
+            val dhcp6_pd = Dhcp6IaPdOpt(iaid = solicit.iaid)
+                .addIaPrefixOption(prefix = "2001:db8:1234::/64")
+            val pkt = ether / ipv6 / udp / dhcp6 / dhcp6_pd
+            iface.sendPacket(pkt)
+        }
+
+        networkCallback.expect<Available>()
+
+        run {
+            val ether = EtherPkt(src = "f4:34:f0:64:52:fe", dst = "33:33:00:00:00:01")
+            val ipv6 = Ip6Pkt(src = "fe80::12", dst = "ff02::1")
+            val ra = RaPkt(lft = 360, retransTimer = 360)
+                .addPioOption(prefix = "2002:db8:1::/64", flags = "LAP")
+            iface.sendPacket(ether / ipv6 / ra)
+        }
+
+        expectDhcp6Packet<Dhcp6RebindPacket>()
+    }
+
     @Test
     fun testProvisioning_withTwoPrefixes() {
         val ra = RaPkt()

From d0030fc967f08cc8a60485e62d2622982d6feef0 Mon Sep 17 00:00:00 2001
From: Yuyang Huang <yuyanghuang@google.com>
Date: Mon, 12 May 2025 21:40:00 +0900
Subject: [PATCH 233/377] Skip APFv6 enforcement check on Wear OS devices in
 25Q2

This commit adjusts the APFv6 enforcement logic to align with 25Q2
GMS-VSR and GTVS requirements. APFv6 is currently applicable only to
handheld and tablet devices (GMS-VSR) and TV devices (GTVS). For Wear OS
devices, APFv6 enforcement is deferred until specific requirements are
officially incorporated; thus, the enforcement check is skipped.

Bug: 415732337
Test: TH
Flag: EXEMPT bugfix
Change-Id: I838a96f3f214d8e46895484f836ade2588a335db
---
 .../net/src/android/net/cts/ApfIntegrationTest.kt | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt b/tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt
index 3e35968738..b4ad325445 100644
--- a/tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt
+++ b/tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt
@@ -22,6 +22,7 @@ package android.net.cts
 import android.Manifest.permission
 import android.content.pm.PackageManager.FEATURE_AUTOMOTIVE
 import android.content.pm.PackageManager.FEATURE_LEANBACK
+import android.content.pm.PackageManager.FEATURE_WATCH
 import android.content.pm.PackageManager.FEATURE_WIFI
 import android.net.ConnectivityManager
 import android.net.Network
@@ -390,6 +391,14 @@ class ApfIntegrationTest {
         }
     }
 
+    private fun shouldEnforceApfV6Support(vsrApiLevel: Int): Boolean {
+        if (pm.hasSystemFeature(FEATURE_WATCH)) {
+            // Enforce APFv6 post VSR-16.
+            return vsrApiLevel > 202504
+        }
+        return vsrApiLevel >= 202504
+    }
+
     @VsrTest(
         requirements = ["VSR-5.3.12-001", "VSR-5.3.12-003", "VSR-5.3.12-004", "VSR-5.3.12-009",
             "VSR-5.3.12-012"]
@@ -431,7 +440,11 @@ class ApfIntegrationTest {
         // - Note, the APF RAM requirement for APF version 6.1 will become 4000 bytes in Android 17
         //   with CHIPSETs that set ro.board.first_api_level or ro.board.api_level to 202604 or
         //   higher.
-        if (vsrApiLevel >= 202504) {
+        // Note: At 25Q2, GMS-VSR requirements related to APFv6 are only applicable to handheld
+        // and tablet devices. GTVS requirements related to APFv6 are only applicable to TV devices.
+        // For Wear OS devices, APFv6 will not be enforced until specific requirements for Wear OS
+        // are officially incorporated.
+        if (shouldEnforceApfV6Support(vsrApiLevel)) {
             assertThat(caps.apfVersionSupported).isAnyOf(6000, 6100)
             if (caps.apfVersionSupported == 6000) {
                 assertThat(caps.maximumApfProgramSize).isAtLeast(4000)

From 6807d2dd39163b6789f0cbfea392a82a0f0da413 Mon Sep 17 00:00:00 2001
From: Yuyang Huang <yuyanghuang@google.com>
Date: Mon, 12 May 2025 22:21:58 +0900
Subject: [PATCH 234/377] Enforce valid APF versions (0, 2, 3, 4, 6000, 6100)

This commit adds a check to enforce that reported APF versions are
either 0 (indicating no support) or one of the officially valid
versions: 2, 3, 4, 6000 or 6100. This ensures consistency and prevents
issues arising from device using unsupported APF versions.

Test: TH
Flag: EXEMPT bugfix
Change-Id: Icdefa89fae590ec78146df4cbd2c683b5d8258f7
---
 tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt b/tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt
index b4ad325445..3211725314 100644
--- a/tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt
+++ b/tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt
@@ -405,6 +405,8 @@ class ApfIntegrationTest {
     )
     @Test
     fun testApfCapabilities() {
+        // If APF is supported, the version must be valid.
+        assertThat(caps.apfVersionSupported).isAnyOf(0, 2, 3, 4, 6000, 6100)
         // APF became mandatory in Android 14 VSR.
         val vsrApiLevel = getVsrApiLevel()
         assume().that(vsrApiLevel).isAtLeast(34)

From 8e5a4fb2c0995c825157e9c36909f105cba0a68b Mon Sep 17 00:00:00 2001
From: Yuyang Huang <yuyanghuang@google.com>
Date: Mon, 12 May 2025 22:49:37 +0900
Subject: [PATCH 235/377] Skip ApfIntegrationTest on automotive devices

This commit modifies ApfIntegrationTest to skip execution on automotive
devices. APF GMS-VSR requirements do not apply to automotive devices.
APF offer no power benefit automotive devices due to their almost
infinite battery power supply. This change aligns the test suite with
the platform's specific requirements.

Test: TH
Flag: EXEMPT bugfix
Change-Id: Iad43a122407fe438cab94f59ed8aba8d6080af02
---
 tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt b/tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt
index 3211725314..033092f68f 100644
--- a/tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt
+++ b/tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt
@@ -352,6 +352,10 @@ class ApfIntegrationTest {
             isTvDeviceSupportFullNetworkingUnder2w()
         )
 
+        // APF GMS-VSR requirements don't apply to automotive devices. There is no power benefit to
+        // running APF on automotive as the device has almost infinite battery power.
+        assumeFalse("Skip test: automotive device", pm.hasSystemFeature(FEATURE_AUTOMOTIVE))
+
         networkCallback = TestableNetworkCallback()
         cm.requestNetwork(
                 NetworkRequest.Builder()

From 9d9bc48f7dca5334480b4136b24d60ad107bf10b Mon Sep 17 00:00:00 2001
From: Sam Saccone <samccone@google.com>
Date: Mon, 12 May 2025 07:51:40 -0700
Subject: [PATCH 236/377] Set the owners to look at the same branch not to be
 fixed to main.

Flag: EXEMPT owners only
BUG=408508431

Change-Id: I0e5e2dcb7b23e4a0e12cee1b3befdc860b8f1781
---
 tests/cts/OWNERS | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/cts/OWNERS b/tests/cts/OWNERS
index acf506deb3..5338f71fd5 100644
--- a/tests/cts/OWNERS
+++ b/tests/cts/OWNERS
@@ -1,7 +1,7 @@
 # Bug template url: http://b/new?component=31808
 # TODO: move bug template config to common owners file once b/226427845 is resolved
 set noparent
-file:platform/packages/modules/Connectivity:main:/OWNERS_core_networking_xts
+file:platform/packages/modules/Connectivity:/OWNERS_core_networking_xts
 
 # IPsec
 per-file **IpSec* = benedictwong@google.com, nharold@google.com

From cbbaaf12debe20f9288057b3e9fa558d113fbbe2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Mon, 12 May 2025 11:06:19 -0700
Subject: [PATCH 237/377] Revert "Set the owners to look at the same branch not
 to be fixed to main."

This reverts commit 9d9bc48f7dca5334480b4136b24d60ad107bf10b.

Reason for revert: Not wanted.

Change-Id: I9034d696ab72fa63d220e630786c243065f99292
---
 tests/cts/OWNERS | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/cts/OWNERS b/tests/cts/OWNERS
index 5338f71fd5..acf506deb3 100644
--- a/tests/cts/OWNERS
+++ b/tests/cts/OWNERS
@@ -1,7 +1,7 @@
 # Bug template url: http://b/new?component=31808
 # TODO: move bug template config to common owners file once b/226427845 is resolved
 set noparent
-file:platform/packages/modules/Connectivity:/OWNERS_core_networking_xts
+file:platform/packages/modules/Connectivity:main:/OWNERS_core_networking_xts
 
 # IPsec
 per-file **IpSec* = benedictwong@google.com, nharold@google.com

From 545362926675b9bac728373234f3d8a81dc1f3a7 Mon Sep 17 00:00:00 2001
From: Remi NGUYEN VAN <reminv@google.com>
Date: Tue, 13 May 2025 09:05:59 +0900
Subject: [PATCH 238/377] Fix IPv4 link-local, default routes network guess

Inet4Address#isLinkLocalAddress can also return true if the address is
in the 169.254.0.0/16 range.

The code should also only consider directly-connected routes for
guessing, as default routes would match any address.

This is not used in platform code. This code path is only used when the
mDNS stack is used as a library.

Bug: 415483522
Test: atest
Flag: EXEMPT dead code in the platform
Change-Id: I53d8ad7f96368d4609b1baa804cd75aa65628c0c
---
 ...ctivityMonitorWithConnectivityManager.java | 10 ++++--
 ...tyMonitorWithConnectivityManagerTests.java | 33 ++++++++++++++++++-
 2 files changed, 39 insertions(+), 4 deletions(-)

diff --git a/service-t/src/com/android/server/connectivity/mdns/ConnectivityMonitorWithConnectivityManager.java b/service-t/src/com/android/server/connectivity/mdns/ConnectivityMonitorWithConnectivityManager.java
index 2724d2ec2b..40be3d92f2 100644
--- a/service-t/src/com/android/server/connectivity/mdns/ConnectivityMonitorWithConnectivityManager.java
+++ b/service-t/src/com/android/server/connectivity/mdns/ConnectivityMonitorWithConnectivityManager.java
@@ -158,7 +158,7 @@ public class ConnectivityMonitorWithConnectivityManager implements ConnectivityM
     @Nullable
     public SocketKey guessNetworkOfRemoteHost(@NonNull List<NetworkInterfaceWrapper> knownIfaces,
             @NonNull InetAddress address) {
-        if (address.isLinkLocalAddress()) {
+        if (address instanceof Inet6Address && address.isLinkLocalAddress()) {
             final int scopeId = ((Inet6Address) address).getScopeId();
             for (NetworkInterfaceWrapper iface : knownIfaces) {
                 if (iface.getIndex() == scopeId) {
@@ -174,7 +174,11 @@ public class ConnectivityMonitorWithConnectivityManager implements ConnectivityM
                 // Note LinkProperties does not always contain routes for local subnets before P
                 // (change ID I35b614eebccfd22c4a5270f40256f9be1e25abfb), but on M+ Wi-Fi does add
                 // them from netlink/DHCP.
-                CollectionUtils.any(lp.getRoutes(), r -> r.matches(address)));
+                // Look for the address in directly-connected routes (no gateway).
+                // Note RouteInfo#hasGateway would be equivalent and simpler but is API 29+
+                CollectionUtils.any(lp.getRoutes(), r ->
+                      (r.getGateway() == null || r.getGateway().isAnyLocalAddress())
+                      && r.matches(address)));
         if (match == null) {
             return null;
         }
@@ -211,4 +215,4 @@ public class ConnectivityMonitorWithConnectivityManager implements ConnectivityM
         }
         return null;
     }
-}
\ No newline at end of file
+}
diff --git a/tests/unit/java/com/android/server/connectivity/mdns/ConnectivityMonitorWithConnectivityManagerTests.java b/tests/unit/java/com/android/server/connectivity/mdns/ConnectivityMonitorWithConnectivityManagerTests.java
index 997a111fd1..fa175b58d4 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/ConnectivityMonitorWithConnectivityManagerTests.java
+++ b/tests/unit/java/com/android/server/connectivity/mdns/ConnectivityMonitorWithConnectivityManagerTests.java
@@ -156,10 +156,16 @@ public class ConnectivityMonitorWithConnectivityManagerTests {
         lp1.setInterfaceName("iface1");
         lp1.addRoute(new RouteInfo(
                 new IpPrefix("192.0.1.123/24"), null, lp1.getInterfaceName(), RTN_UNICAST));
+        lp1.addRoute(new RouteInfo(
+                new IpPrefix("0.0.0.0/0"), parseNumericAddress("192.0.1.1"),
+                lp1.getInterfaceName(), RTN_UNICAST));
         final LinkProperties lp2 = new LinkProperties();
         lp2.setInterfaceName("iface2");
         lp2.addRoute(new RouteInfo(
                 new IpPrefix("192.0.2.123/24"), null, lp2.getInterfaceName(), RTN_UNICAST));
+        lp2.addRoute(new RouteInfo(
+                new IpPrefix("0.0.0.0/0"), parseNumericAddress("192.0.2.1"),
+                lp2.getInterfaceName(), RTN_UNICAST));
 
         callback.onLinkPropertiesChanged(testNetwork1, lp1);
         callback.onLinkPropertiesChanged(testNetwork2, lp2);
@@ -169,7 +175,29 @@ public class ConnectivityMonitorWithConnectivityManagerTests {
     }
 
     @Test
-    public void testGuessNetworkOfRemoteHost_linkLocalAddress() throws Exception {
+    public void testGuessNetworkOfRemoteHost_ipv4LinkLocalAddress() {
+        final NetworkCallback callback = setupCallback();
+
+        final Network testNetwork = mock(Network.class);
+        final int ifIndex = 1;
+        final NetworkInterfaceWrapper iface = getTestInterface("iface1", ifIndex);
+
+        final LinkProperties lp = new LinkProperties();
+        lp.setInterfaceName("iface1");
+        lp.addRoute(new RouteInfo(
+                new IpPrefix("0.0.0.0/0"), parseNumericAddress("192.0.1.1"), lp.getInterfaceName(),
+                RTN_UNICAST));
+        lp.addRoute(new RouteInfo(
+                new IpPrefix("169.254.0.0/16"), null, lp.getInterfaceName(), RTN_UNICAST));
+
+        callback.onLinkPropertiesChanged(testNetwork, lp);
+
+        assertEquals(new SocketKey(testNetwork, ifIndex), monitor.guessNetworkOfRemoteHost(
+                List.of(iface), parseNumericAddress("169.254.1.2")));
+    }
+
+    @Test
+    public void testGuessNetworkOfRemoteHost_inet6LinkLocalAddress() throws Exception {
         final NetworkCallback callback = setupCallback();
 
         final Network testNetwork1 = mock(Network.class);
@@ -183,6 +211,9 @@ public class ConnectivityMonitorWithConnectivityManagerTests {
         lp1.setInterfaceName("wrongiface");
         lp1.addRoute(new RouteInfo(
                 new IpPrefix("fe80::123/64"), null, lp1.getInterfaceName(), RTN_UNICAST));
+        lp1.addRoute(new RouteInfo(
+                new IpPrefix("::/0"), parseNumericAddress("fe80::111"), lp1.getInterfaceName(),
+                RTN_UNICAST));
         final LinkProperties lp2 = new LinkProperties();
         // Use an interface that is known to exist so the link-local address scope can be parsed
         lp2.setInterfaceName("lo");

From b1110454bb6509528cf5c15b97009239c198ad96 Mon Sep 17 00:00:00 2001
From: Chuwei He <chuweih@google.com>
Date: Thu, 10 Apr 2025 15:23:03 +0900
Subject: [PATCH 239/377] Change creation methods in RtNetlinkLinkMessage to
 take index(1/2)

Currently methods to create netlink message in RtNetlinkLinkMessage
take interface name, while interface index is a more deterministic way
to define an interface.

This patch changes these methods from taking interface name to taking
interface index.

Bug: 404378068
Test: NetworkStaticLibTests
Flag: EXEMPT mainline
Change-Id: I0754ee53eb0160e67f24e36340abf91b1e87d0e7
---
 .../server/ethernet/EthernetTracker.java      |  4 +-
 .../net/module/util/netlink/NetlinkUtils.java | 22 ++---
 .../util/netlink/RtNetlinkLinkMessage.java    | 98 ++++++-------------
 .../netlink/RtNetlinkLinkMessageTest.java     | 56 +++--------
 4 files changed, 56 insertions(+), 124 deletions(-)

diff --git a/service-t/src/com/android/server/ethernet/EthernetTracker.java b/service-t/src/com/android/server/ethernet/EthernetTracker.java
index f804471f42..e985b059d7 100644
--- a/service-t/src/com/android/server/ethernet/EthernetTracker.java
+++ b/service-t/src/com/android/server/ethernet/EthernetTracker.java
@@ -45,6 +45,7 @@ import android.os.ConditionVariable;
 import android.os.Handler;
 import android.os.RemoteCallbackList;
 import android.os.RemoteException;
+import android.system.Os;
 import android.system.OsConstants;
 import android.text.TextUtils;
 import android.util.ArrayMap;
@@ -872,7 +873,8 @@ public class EthernetTracker {
     }
 
     private void setInterfaceUpState(@NonNull String interfaceName, boolean up) {
-        if (!NetlinkUtils.setInterfaceFlags(interfaceName, up ? IFF_UP : ~IFF_UP)) {
+        if (!NetlinkUtils.setInterfaceFlags(Os.if_nametoindex(interfaceName),
+                up ? IFF_UP : ~IFF_UP)) {
             Log.e(TAG, "Failed to set interface " + interfaceName + (up ? " up" : " down"));
         }
     }
diff --git a/staticlibs/device/com/android/net/module/util/netlink/NetlinkUtils.java b/staticlibs/device/com/android/net/module/util/netlink/NetlinkUtils.java
index 2420e7ad7e..a999306ee5 100644
--- a/staticlibs/device/com/android/net/module/util/netlink/NetlinkUtils.java
+++ b/staticlibs/device/com/android/net/module/util/netlink/NetlinkUtils.java
@@ -474,18 +474,18 @@ public class NetlinkUtils {
     /**
      * Sends a netlink request to set flags for given interface
      *
-     * @param interfaceName The name of the network interface to query.
+     * @param ifIndex The index of the network interface to configure.
      * @param flags power-of-two integer flags to set or unset. A flag to set should be passed as
      *        is as a power-of-two value, and a flag to remove should be passed inversed as -1 with
      *        a single bit down. For example: IFF_UP, ~IFF_BROADCAST...
      * @return true if the request finished successfully, otherwise false.
      */
-    public static boolean setInterfaceFlags(@NonNull String interfaceName, int... flags) {
+    public static boolean setInterfaceFlags(int ifIndex, int... flags) {
         final RtNetlinkLinkMessage ntMsg =
-                RtNetlinkLinkMessage.createSetFlagsMessage(interfaceName, /*seqNo*/ 0, flags);
+                RtNetlinkLinkMessage.createSetFlagsMessage(ifIndex, /*seqNo*/ 0, flags);
         if (ntMsg == null) {
-            Log.e(TAG, "Failed to create message to set interface flags for interface "
-                    + interfaceName + ", input flags are: " + Arrays.toString(flags));
+            Log.e(TAG, "Failed to create message to set interface flags for interface with index: "
+                    + ifIndex + ", input flags are: " + Arrays.toString(flags));
             return false;
         }
         final byte[] msg = ntMsg.pack(ByteOrder.nativeOrder());
@@ -493,7 +493,7 @@ public class NetlinkUtils {
             NetlinkUtils.sendOneShotKernelMessage(NETLINK_ROUTE, msg);
             return true;
         } catch (ErrnoException e) {
-            Log.e(TAG, "Failed to set flags for: " + interfaceName, e);
+            Log.e(TAG, "Failed to set flags for interface with index: " + ifIndex, e);
             return false;
         }
     }
@@ -501,20 +501,20 @@ public class NetlinkUtils {
     /**
      * Sends a netlink request to set MTU for given interface
      *
-     * @param interfaceName The name of the network interface to query.
+     * @param ifIndex The index of the network interface to configure.
      * @param mtu MTU value to set for the interface.
      * @return true if the request finished successfully, otherwise false.
      */
-    public static boolean setInterfaceMtu(@NonNull String interfaceName, int mtu) {
+    public static boolean setInterfaceMtu(int ifIndex, int mtu) {
         if (mtu < 68) {
             Log.e(TAG, "Invalid mtu: " + mtu + ", mtu should be greater than 68 referring RFC791");
             return false;
         }
         final RtNetlinkLinkMessage ntMsg =
-                RtNetlinkLinkMessage.createSetMtuMessage(interfaceName, /*seqNo*/ 0, mtu);
+                RtNetlinkLinkMessage.createSetMtuMessage(ifIndex, /*seqNo*/ 0, mtu);
         if (ntMsg == null) {
             Log.e(TAG, "Failed to create message to set MTU to " + mtu
-                    + "for interface " + interfaceName);
+                    + "for interface with index: " + ifIndex);
             return false;
         }
         final byte[] msg = ntMsg.pack(ByteOrder.nativeOrder());
@@ -522,7 +522,7 @@ public class NetlinkUtils {
             NetlinkUtils.sendOneShotKernelMessage(NETLINK_ROUTE, msg);
             return true;
         } catch (ErrnoException e) {
-            Log.e(TAG, "Failed to set MTU to " + mtu + " for: " + interfaceName, e);
+            Log.e(TAG, "Failed to set MTU to " + mtu + " for interface with index: " + ifIndex, e);
             return false;
         }
     }
diff --git a/staticlibs/device/com/android/net/module/util/netlink/RtNetlinkLinkMessage.java b/staticlibs/device/com/android/net/module/util/netlink/RtNetlinkLinkMessage.java
index 5d49fa33d3..8c36ed8344 100644
--- a/staticlibs/device/com/android/net/module/util/netlink/RtNetlinkLinkMessage.java
+++ b/staticlibs/device/com/android/net/module/util/netlink/RtNetlinkLinkMessage.java
@@ -227,58 +227,44 @@ public class RtNetlinkLinkMessage extends NetlinkMessage {
     /**
      * Create a link message to set the operational state (up or down) of a network interface.
      *
-     * @param interfaceName  The network interface name.
+     * @param ifIndex  The network interface index of the network interface to set state.
      * @param sequenceNumber The sequence number to use for the Netlink message.
      * @param isUp           {@code true} to set the interface up, {@code false} to set it down.
-     * @return A `RtNetlinkLinkMessage` instance configured to set the link state.
+     * @return A `RtNetlinkLinkMessage` instance configured to set the link state, or return null
+     *         in case of an error.
      */
     @Nullable
-    public static RtNetlinkLinkMessage createSetLinkStateMessage(@NonNull String interfaceName,
+    public static RtNetlinkLinkMessage createSetLinkStateMessage(int ifIndex,
             int sequenceNumber, boolean isUp) {
-        return createSetLinkStateMessage(interfaceName, sequenceNumber, isUp, new OsAccess());
-    }
-
-    @VisibleForTesting
-    @Nullable
-    protected static RtNetlinkLinkMessage createSetLinkStateMessage(@NonNull String interfaceName,
-            int sequenceNumber, boolean isUp, OsAccess osAccess) {
-        final int interfaceIndex = osAccess.if_nametoindex(interfaceName);
-        if (interfaceIndex == OsAccess.INVALID_INTERFACE_INDEX) {
+        if (ifIndex <= 0) {
             return null;
         }
 
         return RtNetlinkLinkMessage.build(
                 new StructNlMsgHdr(0, RTM_NEWLINK, NLM_F_REQUEST_ACK, sequenceNumber),
-                new StructIfinfoMsg((short) AF_UNSPEC, (short) 0, interfaceIndex,
+                new StructIfinfoMsg((short) AF_UNSPEC, (short) 0, ifIndex,
                                     isUp ? IFF_UP : 0, IFF_UP), DEFAULT_MTU, null, null);
     }
 
     /**
      * Create a link message to rename the network interface.
      *
-     * @param interfaceName  The network interface name.
+     * @param ifIndex  The network interface index of the network interface to rename.
      * @param sequenceNumber The sequence number to use for the Netlink message.
      * @param newName        The new name of the network interface.
-     * @return A `RtNetlinkLinkMessage` instance configured to rename the network interface.
+     * @return A `RtNetlinkLinkMessage` instance configured to rename the network interface,
+     *         or return null in case of an error.
      */
     @Nullable
-    public static RtNetlinkLinkMessage createSetLinkNameMessage(@NonNull String interfaceName,
+    public static RtNetlinkLinkMessage createSetLinkNameMessage(int ifIndex,
             int sequenceNumber, @NonNull String newName) {
-        return createSetLinkNameMessage(interfaceName, sequenceNumber, newName, new OsAccess());
-    }
-
-    @VisibleForTesting
-    @Nullable
-    protected static RtNetlinkLinkMessage createSetLinkNameMessage(@NonNull String interfaceName,
-            int sequenceNumber, @NonNull String newName, OsAccess osAccess) {
-        final int interfaceIndex = osAccess.if_nametoindex(interfaceName);
-        if (interfaceIndex == OsAccess.INVALID_INTERFACE_INDEX) {
+        if (ifIndex <= 0) {
             return null;
         }
 
         return RtNetlinkLinkMessage.build(
                 new StructNlMsgHdr(0, RTM_NEWLINK, NLM_F_REQUEST_ACK, sequenceNumber),
-                new StructIfinfoMsg((short) AF_UNSPEC, (short) 0, interfaceIndex, 0, 0),
+                new StructIfinfoMsg((short) AF_UNSPEC, (short) 0, ifIndex, 0, 0),
                 DEFAULT_MTU, null, newName);
     }
 
@@ -286,28 +272,21 @@ public class RtNetlinkLinkMessage extends NetlinkMessage {
      * Creates an {@link RtNetlinkLinkMessage} instance that can be used to get the link information
      * of a network interface.
      *
-     * @param interfaceName The name of the network interface to query.
+     * @param ifIndex The index of the network interface to query.
      * @param sequenceNumber The sequence number for the Netlink message.
-     * @return An `RtNetlinkLinkMessage` instance representing the request to query the interface.
+     * @return An `RtNetlinkLinkMessage` instance representing the request to query the interface,
+     *         or return null in case of an error.
      */
     @Nullable
-    public static RtNetlinkLinkMessage createGetLinkMessage(@NonNull String interfaceName,
+    public static RtNetlinkLinkMessage createGetLinkMessage(int ifIndex,
             int sequenceNumber) {
-        return createGetLinkMessage(interfaceName, sequenceNumber, new OsAccess());
-    }
-
-    @VisibleForTesting
-    @Nullable
-    protected static RtNetlinkLinkMessage createGetLinkMessage(@NonNull String interfaceName,
-            int sequenceNumber, @NonNull OsAccess osAccess) {
-        final int interfaceIndex = osAccess.if_nametoindex(interfaceName);
-        if (interfaceIndex == OsAccess.INVALID_INTERFACE_INDEX) {
+        if (ifIndex <= 0) {
             return null;
         }
 
         return RtNetlinkLinkMessage.build(
                 new StructNlMsgHdr(0, RTM_GETLINK, NLM_F_REQUEST_ACK, sequenceNumber),
-                new StructIfinfoMsg((short) AF_UNSPEC, (short) 0, interfaceIndex, 0, 0),
+                new StructIfinfoMsg((short) AF_UNSPEC, (short) 0, ifIndex, 0, 0),
                 DEFAULT_MTU, null, null);
     }
 
@@ -315,27 +294,18 @@ public class RtNetlinkLinkMessage extends NetlinkMessage {
      * Creates an {@link RtNetlinkLinkMessage} instance that can be used to set the flags of a
      * network interface.
      *
-     * @param interfaceName The name of the network interface to query.
+     * @param ifIndex The index of the network interface to configure.
      * @param sequenceNumber The sequence number for the Netlink message.
      * @param flags power-of-two integer flags to set or unset. A flag to set should be passed as
      *        is as a power-of-two value, and a flag to remove should be passed inversed as -1 with
      *        a single bit down. For example: IFF_UP, ~IFF_BROADCAST...
-     * @return An `RtNetlinkLinkMessage` instance representing the request to query the interface.
+     * @return An `RtNetlinkLinkMessage` instance representing the request to query the interface,
+     *         or return null in case of an error.
      */
     @Nullable
-    public static RtNetlinkLinkMessage createSetFlagsMessage(@NonNull String interfaceName,
+    public static RtNetlinkLinkMessage createSetFlagsMessage(int ifIndex,
             int sequenceNumber, int... flags) {
-        return createSetFlagsMessage(
-                interfaceName, sequenceNumber, new OsAccess(), flags);
-    }
-
-    @VisibleForTesting
-    @Nullable
-    protected static RtNetlinkLinkMessage createSetFlagsMessage(
-            @NonNull String interfaceName, int sequenceNumber, @NonNull OsAccess osAccess,
-            int... flags) {
-        final int interfaceIndex = osAccess.if_nametoindex(interfaceName);
-        if (interfaceIndex == OsAccess.INVALID_INTERFACE_INDEX) {
+        if (ifIndex <= 0) {
             return null;
         }
 
@@ -358,7 +328,7 @@ public class RtNetlinkLinkMessage extends NetlinkMessage {
         return RtNetlinkLinkMessage.build(
                 new StructNlMsgHdr(
                         /*payloadLen*/ 0, RTM_NEWLINK, NLM_F_REQUEST_ACK, sequenceNumber),
-                new StructIfinfoMsg((short) AF_UNSPEC, /*type*/ 0, interfaceIndex,
+                new StructIfinfoMsg((short) AF_UNSPEC, /*type*/ 0, ifIndex,
                         flagsBits, changeBits),
                 DEFAULT_MTU, /*hardwareAddress*/ null, /*interfaceName*/ null);
     }
@@ -367,29 +337,21 @@ public class RtNetlinkLinkMessage extends NetlinkMessage {
      * Creates an {@link RtNetlinkLinkMessage} instance that can be used to set the MTU of a
      * network interface.
      *
-     * @param interfaceName The name of the network interface to query.
+     * @param ifIndex The index of the network interface to configure.
      * @param sequenceNumber The sequence number for the Netlink message.
      * @param mtu MTU value to set for the interface.
-     * @return An `RtNetlinkLinkMessage` instance representing the request to query the interface.
+     * @return An `RtNetlinkLinkMessage` instance representing the request to query the interface,
+     *         or return null in case of an error.
      */
     @Nullable
-    public static RtNetlinkLinkMessage createSetMtuMessage(@NonNull String interfaceName,
+    public static RtNetlinkLinkMessage createSetMtuMessage(int ifIndex,
             int sequenceNumber, int mtu) {
-        return createSetMtuMessage(
-            interfaceName, sequenceNumber, mtu, new OsAccess());
-    }
-
-    @VisibleForTesting
-    @Nullable
-    protected static RtNetlinkLinkMessage createSetMtuMessage(@NonNull String interfaceName,
-            int sequenceNumber, int mtu, @NonNull OsAccess osAccess) {
-        final int interfaceIndex = osAccess.if_nametoindex(interfaceName);
-        if (interfaceIndex == OsAccess.INVALID_INTERFACE_INDEX) {
+        if (ifIndex <= 0) {
             return null;
         }
         return RtNetlinkLinkMessage.build(
             new StructNlMsgHdr(/*payloadLen*/ 0, RTM_NEWLINK, NLM_F_REQUEST_ACK , sequenceNumber),
-            new StructIfinfoMsg((short) AF_UNSPEC, /*type*/ 0, interfaceIndex,
+            new StructIfinfoMsg((short) AF_UNSPEC, /*type*/ 0, ifIndex,
                 /*flags*/ 0, /*change*/ 0),
             mtu, /*hardwareAddress*/ null, /*interfaceName*/ null);
     }
diff --git a/staticlibs/tests/unit/src/com/android/net/module/util/netlink/RtNetlinkLinkMessageTest.java b/staticlibs/tests/unit/src/com/android/net/module/util/netlink/RtNetlinkLinkMessageTest.java
index 08cab03b36..dca47eec60 100644
--- a/staticlibs/tests/unit/src/com/android/net/module/util/netlink/RtNetlinkLinkMessageTest.java
+++ b/staticlibs/tests/unit/src/com/android/net/module/util/netlink/RtNetlinkLinkMessageTest.java
@@ -24,7 +24,6 @@ import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertTrue;
-import static org.mockito.Mockito.when;
 
 import android.net.MacAddress;
 import android.system.OsConstants;
@@ -35,7 +34,6 @@ import com.android.net.module.util.HexDump;
 
 import org.junit.Test;
 import org.junit.runner.RunWith;
-import org.mockito.Mock;
 import org.mockito.junit.MockitoJUnitRunner;
 
 import java.nio.ByteBuffer;
@@ -44,9 +42,6 @@ import java.nio.ByteOrder;
 @RunWith(MockitoJUnitRunner.class)
 @SmallTest
 public class RtNetlinkLinkMessageTest {
-    @Mock
-    private OsAccess mOsAccess;
-
     // An example of the full RTM_NEWLINK message.
     private static final String RTM_NEWLINK_HEX =
             "64000000100000000000000000000000"   // struct nlmsghr
@@ -194,15 +189,12 @@ public class RtNetlinkLinkMessageTest {
         final String expectedHexBytes =
                 "20000000100005006824000000000000"     // struct nlmsghdr
                 + "00000000080000000100000001000000";  // struct ifinfomsg
-        final String interfaceName = "wlan0";
         final int interfaceIndex = 8;
         final int sequenceNumber = 0x2468;
         final boolean isUp = true;
 
-        when(mOsAccess.if_nametoindex(interfaceName)).thenReturn(interfaceIndex);
-
         final RtNetlinkLinkMessage msg = RtNetlinkLinkMessage.createSetLinkStateMessage(
-                interfaceName, sequenceNumber, isUp, mOsAccess);
+                interfaceIndex, sequenceNumber, isUp);
         assertNotNull(msg);
         final byte[] bytes = msg.pack(ByteOrder.LITTLE_ENDIAN);  // For testing.
         assertEquals(expectedHexBytes, HexDump.toHexString(bytes));
@@ -213,15 +205,12 @@ public class RtNetlinkLinkMessageTest {
         final String expectedHexBytes =
                 "20000000100005006824000000000000"     // struct nlmsghdr
                         + "00000000080000000000000001000000";  // struct ifinfomsg
-        final String interfaceName = "wlan0";
         final int interfaceIndex = 8;
         final int sequenceNumber = 0x2468;
         final boolean isUp = false;
 
-        when(mOsAccess.if_nametoindex(interfaceName)).thenReturn(interfaceIndex);
-
         final RtNetlinkLinkMessage msg = RtNetlinkLinkMessage.createSetLinkStateMessage(
-                interfaceName, sequenceNumber, isUp, mOsAccess);
+                interfaceIndex, sequenceNumber, isUp);
         assertNotNull(msg);
         final byte[] bytes = msg.pack(ByteOrder.LITTLE_ENDIAN);  // For testing.
         assertEquals(expectedHexBytes, HexDump.toHexString(bytes));
@@ -229,14 +218,12 @@ public class RtNetlinkLinkMessageTest {
 
     @Test
     public void testCreateSetLinkStateMessage_InvalidInterface() {
-        final String interfaceName = "wlan0";
+        final int interfaceIndex = OsAccess.INVALID_INTERFACE_INDEX;
         final int sequenceNumber = 0x2468;
         final boolean isUp = false;
 
-        when(mOsAccess.if_nametoindex(interfaceName)).thenReturn(OsAccess.INVALID_INTERFACE_INDEX);
-
         final RtNetlinkLinkMessage msg = RtNetlinkLinkMessage.createSetLinkStateMessage(
-                interfaceName, sequenceNumber, isUp, mOsAccess);
+                interfaceIndex, sequenceNumber, isUp);
         assertNull(msg);
     }
 
@@ -246,15 +233,12 @@ public class RtNetlinkLinkMessageTest {
                 "2C000000100005006824000000000000"   // struct nlmsghdr
                 + "00000000080000000000000000000000" // struct ifinfomsg
                 + "0A000300776C616E31000000";        // IFLA_IFNAME(wlan1)
-        final String interfaceName = "wlan0";
         final int interfaceIndex = 8;
         final int sequenceNumber = 0x2468;
         final String newName = "wlan1";
 
-        when(mOsAccess.if_nametoindex(interfaceName)).thenReturn(interfaceIndex);
-
         final RtNetlinkLinkMessage msg = RtNetlinkLinkMessage.createSetLinkNameMessage(
-                interfaceName, sequenceNumber, newName, mOsAccess);
+                interfaceIndex, sequenceNumber, newName);
         assertNotNull(msg);
         final byte[] bytes = msg.pack(ByteOrder.LITTLE_ENDIAN);  // For testing.
         assertEquals(expectedHexBytes, HexDump.toHexString(bytes));
@@ -262,28 +246,23 @@ public class RtNetlinkLinkMessageTest {
 
     @Test
     public void testCreateSetLinkNameMessage_InterfaceNotFound() {
-        final String interfaceName = "wlan0";
+        final int interfaceIndex = OsAccess.INVALID_INTERFACE_INDEX;
         final int sequenceNumber = 0x2468;
         final String newName = "wlan1";
 
-        when(mOsAccess.if_nametoindex(interfaceName)).thenReturn(OsAccess.INVALID_INTERFACE_INDEX);
-
         assertNull(RtNetlinkLinkMessage.createSetLinkNameMessage(
-                interfaceName, sequenceNumber, newName, mOsAccess));
+                interfaceIndex, sequenceNumber, newName));
     }
 
     @Test
     public void testCreateSetLinkNameMessage_InvalidNewName() {
-        final String interfaceName = "wlan0";
         final int interfaceIndex = 8;
         final int sequenceNumber = 0x2468;
 
-        when(mOsAccess.if_nametoindex(interfaceName)).thenReturn(interfaceIndex);
-
         final String[] invalidNames = {"", "interface_name_longer_than_limit"};
         for (String invalidName : invalidNames) {
             assertNull(RtNetlinkLinkMessage.createSetLinkNameMessage(
-                    interfaceName, sequenceNumber, invalidName, mOsAccess));
+                    interfaceIndex, sequenceNumber, invalidName));
         }
     }
 
@@ -292,14 +271,11 @@ public class RtNetlinkLinkMessageTest {
         final String expectedHexBytes =
                 "20000000120005006824000000000000"    // struct nlmsghdr
                 + "00000000080000000000000000000000"; // struct ifinfomsg
-        final String interfaceName = "wlan0";
         final int interfaceIndex = 8;
         final int sequenceNumber = 0x2468;
 
-        when(mOsAccess.if_nametoindex(interfaceName)).thenReturn(interfaceIndex);
-
         final RtNetlinkLinkMessage msg = RtNetlinkLinkMessage.createGetLinkMessage(
-                interfaceName, sequenceNumber, mOsAccess);
+                interfaceIndex, sequenceNumber);
         assertNotNull(msg);
         final byte[] bytes = msg.pack(ByteOrder.LITTLE_ENDIAN);  // For testing.
         assertEquals(expectedHexBytes, HexDump.toHexString(bytes));
@@ -310,16 +286,12 @@ public class RtNetlinkLinkMessageTest {
         final String expectedHexBytes =
                 "20000000100005006824000000000000"    // struct nlmsghdr
                         + "00000000080000000100000001000100"; // struct ifinfomsg
-        final String interfaceName = "wlan0";
         final int interfaceIndex = 8;
         final int sequenceNumber = 0x2468;
 
-        when(mOsAccess.if_nametoindex(interfaceName)).thenReturn(interfaceIndex);
-
         final RtNetlinkLinkMessage msg = RtNetlinkLinkMessage.createSetFlagsMessage(
-                interfaceName,
+                interfaceIndex,
                 sequenceNumber,
-                mOsAccess,
                 NetlinkConstants.IFF_UP,
                 ~NetlinkConstants.IFF_LOWER_UP);
         assertNotNull(msg);
@@ -332,18 +304,14 @@ public class RtNetlinkLinkMessageTest {
         final String expectedHexBytes =
                 "280000001000050068240000000000000000000008000000"   // struct nlmsghdr
                         + "000000000000000008000400DC050000"; // struct ifinfomsg
-        final String interfaceName = "wlan0";
         final int interfaceIndex = 8;
         final int sequenceNumber = 0x2468;
         final int mtu = 1500;
 
-        when(mOsAccess.if_nametoindex(interfaceName)).thenReturn(interfaceIndex);
-
         final RtNetlinkLinkMessage msg = RtNetlinkLinkMessage.createSetMtuMessage(
-                interfaceName,
+                interfaceIndex,
                 sequenceNumber,
-                mtu,
-                mOsAccess);
+                mtu);
         assertNotNull(msg);
         final byte[] bytes = msg.pack(ByteOrder.LITTLE_ENDIAN);  // For testing.
         assertEquals(expectedHexBytes, HexDump.toHexString(bytes));

From 57de4bfef0ede6fd0d1abd15014488a62114d180 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Mon, 12 May 2025 17:52:04 -0700
Subject: [PATCH 240/377] NetBpfLoad: (noop) simplify /sys/fs/bpf dir creation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Test: TreeHugger
Flag: EXEMPT mainline
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Iee3b3a82d3ecb233956cedb2f81a591eed43dc69
---
 bpf/loader/NetBpfLoad.cpp | 48 ++++++++++++++++-----------------------
 1 file changed, 20 insertions(+), 28 deletions(-)

diff --git a/bpf/loader/NetBpfLoad.cpp b/bpf/loader/NetBpfLoad.cpp
index 705ed99aad..43c4d2a650 100644
--- a/bpf/loader/NetBpfLoad.cpp
+++ b/bpf/loader/NetBpfLoad.cpp
@@ -1481,23 +1481,19 @@ static int loadAllElfObjects(const unsigned int bpfloader_ver, const Location& l
     return retVal;
 }
 
-static int createSysFsBpfSubDir(const char* const prefix) {
-    if (*prefix) {
-        mode_t prevUmask = umask(0);
-
-        string s = "/sys/fs/bpf/";
-        s += prefix;
-
-        errno = 0;
-        int ret = mkdir(s.c_str(), S_ISVTX | S_IRWXU | S_IRWXG | S_IRWXO);
-        if (ret && errno != EEXIST) {
-            const int err = errno;
-            ALOGE("Failed to create directory: %s, ret: %s", s.c_str(), std::strerror(err));
-            return -err;
-        }
+static int createDir(const char* const dir) {
+    mode_t prevUmask = umask(0);
 
+    errno = 0;
+    int ret = mkdir(dir, S_ISVTX | S_IRWXU | S_IRWXG | S_IRWXO);
+    if (ret && errno != EEXIST) {
+        const int err = errno;
         umask(prevUmask);
+        ALOGE("Failed to create directory: %s, ret: %s", dir, std::strerror(err));
+        return -err;
     }
+
+    umask(prevUmask);
     return 0;
 }
 
@@ -1884,18 +1880,17 @@ static int doLoad(char** argv, char * const envp[]) {
     // (this must be done first to allow selinux_context and pin_subdir functionality,
     //  which could otherwise fail with ENOENT during object pinning or renaming,
     //  due to ordering issues)
-    for (const auto& location : locations) {
-        if (location.t_plus && !isAtLeastT) continue;
-        if (createSysFsBpfSubDir(location.prefix)) return 1;
-    }
+    if (createDir("/sys/fs/bpf/tethering")) return 1;
+    // This is technically T+ but S also needs it for the 'mainline_done' file.
+    if (createDir("/sys/fs/bpf/netd_shared")) return 1;
 
     if (isAtLeastT) {
-        // Note: there's no actual src dir for fs_bpf_loader .o's,
-        // so it is not listed in 'locations[].prefix'.
-        // This is because this is primarily meant for triggering genfscon rules,
-        // and as such this will likely always be the case.
-        // Thus we need to manually create the /sys/fs/bpf/loader subdirectory.
-        if (createSysFsBpfSubDir("loader")) return 1;
+        if (createDir("/sys/fs/bpf/netd_readonly")) return 1;
+        if (createDir("/sys/fs/bpf/net_shared")) return 1;
+        if (createDir("/sys/fs/bpf/net_private")) return 1;
+
+        // This one is primarily meant for triggering genfscon rules.
+        if (createDir("/sys/fs/bpf/loader")) return 1;
     }
 
     // Load all ELF objects, create programs and maps, and pin them
@@ -1921,11 +1916,8 @@ static int doLoad(char** argv, char * const envp[]) {
         if (isAtLeastT) return 1;
     }
 
-    // on S we haven't created this subdir yet, but we need it for 'mainline_done' flag below
-    if (!isAtLeastT && createSysFsBpfSubDir("netd_shared")) return 1;
-
     // leave a flag that we're done
-    if (createSysFsBpfSubDir("netd_shared/mainline_done")) return 1;
+    if (createDir("/sys/fs/bpf/netd_shared/mainline_done")) return 1;
 
     // platform bpfloader will only succeed when run as root
     if (!runningAsRoot) {

From 81cdc02a6301c59a7ebd206435bd7b7c8ac44ecd Mon Sep 17 00:00:00 2001
From: Lorenzo Colitti <lorenzo@google.com>
Date: Tue, 13 May 2025 15:47:13 +0900
Subject: [PATCH 241/377] Ignore calls to tether() where the interface type is
 invalid.

It looks like the code was already trying to ignore this (it
reported an error to the caller), but it then continued on to
create a request and call tetherInternal on it. This is still a
no-op because the code will never create an IpServer for an
interface that has type INVALID: IpServers are only ever created
in ensureIpServerStartedForType, and the only callers are:

- ensureIpServerStartedForInterface, which returns early if the
  type is INVALID.
- enableIpServing:
  - enableWifiP2pIpServing: returns early if type is INVALID
  - enableWifiIpServing: returns early if type is INVALID
  - enableUsbIpServing: can only pass in USB or NCM
  - BluetoothCallback#onAvailable: passes in BLUETOOTH
  - EthernetCallback#onAvailable: passes in ETHERNET
  - setVirtualMachineTethering: only called with VIRTUAL
  - StartTetheringSoftApCallback#onStateChanged: passes in the
    request previously passed to it by setWifiTethering, which
    is always WIFI.

Bug: 408087033
Test: covered by existing tests
Flag: EXEMPT dead code
Change-Id: I8ebba3edde93677c54488803fe4b573d78ad25a9
---
 Tethering/src/com/android/networkstack/tethering/Tethering.java | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Tethering/src/com/android/networkstack/tethering/Tethering.java b/Tethering/src/com/android/networkstack/tethering/Tethering.java
index 0b615e9ea4..efbaee4ea6 100644
--- a/Tethering/src/com/android/networkstack/tethering/Tethering.java
+++ b/Tethering/src/com/android/networkstack/tethering/Tethering.java
@@ -1134,6 +1134,7 @@ public class Tethering {
         if (type == TETHERING_INVALID) {
             Log.e(TAG, "Ignoring call to legacy tether for unknown iface " + iface);
             sendTetherResult(listener, TETHER_ERROR_UNKNOWN_IFACE);
+            return;
         }
 
         TetheringRequest request = mRequestTracker.getNextPendingRequest(type);

From bec4b5b8d41d30875380ffd123b735740f8b0f7d Mon Sep 17 00:00:00 2001
From: Lorenzo Colitti <lorenzo@google.com>
Date: Tue, 13 May 2025 15:37:32 +0900
Subject: [PATCH 242/377] Disallow the legacy tether API for Wi-Fi.

AOSP code has never used this API, and metrics from production
show no usage either. Removing it will allow simplifying the
code.

This CL removes testRequestStaticIpLegacyTether because it makes
legacyTether a no-op and there is already a test for static IP
request right above it.

Bug: 408087033
Flag: EXEMPT dead code
Test: updated existing tests
Change-Id: Ib94ed0860ab57abfd9fc7bdfdc911f5ab57003ed
---
 .../networkstack/tethering/Tethering.java     | 50 +++++--------------
 .../networkstack/tethering/TetheringTest.java | 36 +++----------
 .../tethering/cts/TetheringManagerTest.java   | 25 ++++------
 3 files changed, 29 insertions(+), 82 deletions(-)

diff --git a/Tethering/src/com/android/networkstack/tethering/Tethering.java b/Tethering/src/com/android/networkstack/tethering/Tethering.java
index efbaee4ea6..3348c9e8a5 100644
--- a/Tethering/src/com/android/networkstack/tethering/Tethering.java
+++ b/Tethering/src/com/android/networkstack/tethering/Tethering.java
@@ -52,6 +52,7 @@ import static android.net.TetheringManager.TETHER_ERROR_UNAVAIL_IFACE;
 import static android.net.TetheringManager.TETHER_ERROR_UNKNOWN_IFACE;
 import static android.net.TetheringManager.TETHER_ERROR_UNKNOWN_REQUEST;
 import static android.net.TetheringManager.TETHER_ERROR_UNKNOWN_TYPE;
+import static android.net.TetheringManager.TETHER_ERROR_UNSUPPORTED;
 import static android.net.TetheringManager.TETHER_HARDWARE_OFFLOAD_FAILED;
 import static android.net.TetheringManager.TETHER_HARDWARE_OFFLOAD_STARTED;
 import static android.net.TetheringManager.TETHER_HARDWARE_OFFLOAD_STOPPED;
@@ -75,10 +76,6 @@ import static com.android.networkstack.tethering.TetheringConfiguration.TETHER_F
 import static com.android.networkstack.tethering.TetheringNotificationUpdater.DOWNSTREAM_NONE;
 import static com.android.networkstack.tethering.UpstreamNetworkMonitor.isCellular;
 import static com.android.networkstack.tethering.metrics.TetheringStatsLog.CORE_NETWORKING_TERRIBLE_ERROR_OCCURRED;
-import static com.android.networkstack.tethering.metrics.TetheringStatsLog.CORE_NETWORKING_TERRIBLE_ERROR_OCCURRED__ERROR_TYPE__TYPE_LEGACY_TETHER_WITH_TYPE_WIFI;
-import static com.android.networkstack.tethering.metrics.TetheringStatsLog.CORE_NETWORKING_TERRIBLE_ERROR_OCCURRED__ERROR_TYPE__TYPE_LEGACY_TETHER_WITH_TYPE_WIFI_P2P;
-import static com.android.networkstack.tethering.metrics.TetheringStatsLog.CORE_NETWORKING_TERRIBLE_ERROR_OCCURRED__ERROR_TYPE__TYPE_LEGACY_TETHER_WITH_TYPE_WIFI_P2P_SUCCESS;
-import static com.android.networkstack.tethering.metrics.TetheringStatsLog.CORE_NETWORKING_TERRIBLE_ERROR_OCCURRED__ERROR_TYPE__TYPE_LEGACY_TETHER_WITH_TYPE_WIFI_SUCCESS;
 import static com.android.networkstack.tethering.metrics.TetheringStatsLog.CORE_NETWORKING_TERRIBLE_ERROR_OCCURRED__ERROR_TYPE__TYPE_TETHER_WITH_PLACEHOLDER_REQUEST;
 import static com.android.networkstack.tethering.util.TetheringMessageBase.BASE_MAIN_SM;
 import static com.android.networkstack.tethering.util.TetheringUtils.createImplicitLocalOnlyTetheringRequest;
@@ -1137,41 +1134,17 @@ public class Tethering {
             return;
         }
 
+        if (type == TETHERING_WIFI || type == TETHERING_WIFI_P2P) {
+            // Metrics show no usage of this legacy codepath. Stop supporing it.
+            sendTetherResult(listener, TETHER_ERROR_UNSUPPORTED);
+            return;
+        }
+
         TetheringRequest request = mRequestTracker.getNextPendingRequest(type);
         if (request == null) {
             request = createLegacyGlobalScopeTetheringRequest(type);
         }
-        int result = tetherInternal(request, iface);
-        switch (type) {
-            case TETHERING_WIFI:
-                Log.i(TAG, "Legacy tether API called on Wifi iface " + iface);
-                TetheringStatsLog.write(
-                        CORE_NETWORKING_TERRIBLE_ERROR_OCCURRED,
-                        CORE_NETWORKING_TERRIBLE_ERROR_OCCURRED__ERROR_TYPE__TYPE_LEGACY_TETHER_WITH_TYPE_WIFI);
-                if (result == TETHER_ERROR_NO_ERROR) {
-                    Log.i(TAG, "Legacy tether API succeeded on Wifi iface " + iface);
-                    TetheringStatsLog.write(
-                            CORE_NETWORKING_TERRIBLE_ERROR_OCCURRED,
-                            CORE_NETWORKING_TERRIBLE_ERROR_OCCURRED__ERROR_TYPE__TYPE_LEGACY_TETHER_WITH_TYPE_WIFI_SUCCESS);
-                }
-                break;
-            case TETHERING_WIFI_P2P:
-                Log.i(TAG, "Legacy tether API called on Wifi P2P iface " + iface);
-                TetheringStatsLog.write(
-                        CORE_NETWORKING_TERRIBLE_ERROR_OCCURRED,
-                        CORE_NETWORKING_TERRIBLE_ERROR_OCCURRED__ERROR_TYPE__TYPE_LEGACY_TETHER_WITH_TYPE_WIFI_P2P);
-                if (result == TETHER_ERROR_NO_ERROR) {
-                    Log.i(TAG, "Legacy tether API succeeded on Wifi P2P iface " + iface);
-                    TetheringStatsLog.write(
-                            CORE_NETWORKING_TERRIBLE_ERROR_OCCURRED,
-                            CORE_NETWORKING_TERRIBLE_ERROR_OCCURRED__ERROR_TYPE__TYPE_LEGACY_TETHER_WITH_TYPE_WIFI_P2P_SUCCESS);
-                }
-                break;
-            default:
-                // Do nothing
-                break;
-        }
-        sendTetherResult(listener, result);
+        sendTetherResult(listener, tetherInternal(request, iface));
     }
 
     /**
@@ -1181,11 +1154,12 @@ public class Tethering {
      * processInterfaceStateChanged beforehand, which is only possible for
      *     - WIGIG Pre-S
      *     - BLUETOOTH Pre-T
+     * It was previously supported but no longer allowed for:
      *     - WIFI
      *     - WIFI_P2P.
-     * Note that WIFI and WIFI_P2P already start tethering on their respective ifaces via
-     * WIFI_(AP/P2P_STATE_CHANGED broadcasts, which makes this API redundant for those types unless
-     * those broadcasts are disabled by OEM.
+     * because metrics show that there is no usage of this method for these types in production.
+     * These types start tethering on their respective ifaces via WIFI_(AP/P2P_STATE_CHANGED
+     * broadcasts instead.
      */
     void legacyTether(String iface, final IIntResultListener listener) {
         mHandler.post(() -> handleLegacyTether(iface, listener));
diff --git a/Tethering/tests/unit/src/com/android/networkstack/tethering/TetheringTest.java b/Tethering/tests/unit/src/com/android/networkstack/tethering/TetheringTest.java
index 7a262ded62..cb25145a4d 100644
--- a/Tethering/tests/unit/src/com/android/networkstack/tethering/TetheringTest.java
+++ b/Tethering/tests/unit/src/com/android/networkstack/tethering/TetheringTest.java
@@ -57,6 +57,7 @@ import static android.net.TetheringManager.TETHER_ERROR_NO_ERROR;
 import static android.net.TetheringManager.TETHER_ERROR_SERVICE_UNAVAIL;
 import static android.net.TetheringManager.TETHER_ERROR_UNKNOWN_IFACE;
 import static android.net.TetheringManager.TETHER_ERROR_UNKNOWN_REQUEST;
+import static android.net.TetheringManager.TETHER_ERROR_UNSUPPORTED;
 import static android.net.TetheringManager.TETHER_HARDWARE_OFFLOAD_FAILED;
 import static android.net.TetheringManager.TETHER_HARDWARE_OFFLOAD_STARTED;
 import static android.net.TetheringManager.TETHER_HARDWARE_OFFLOAD_STOPPED;
@@ -3415,39 +3416,18 @@ public class TetheringTest {
 
     @Test
     @IgnoreAfter(Build.VERSION_CODES.VANILLA_ICE_CREAM)
-    public void testRequestStaticIpLegacyTether() throws Exception {
+    public void testLegacyTetherUnsupported() throws Exception {
         initTetheringOnTestThread();
 
-        // Call startTethering with static ip
-        final LinkAddress serverLinkAddr = new LinkAddress("192.168.0.123/24");
-        final LinkAddress clientLinkAddr = new LinkAddress("192.168.0.42/24");
-        final String serverAddr = "192.168.0.123";
-        final int clientAddrParceled = 0xc0a8002a;
-        final ArgumentCaptor<DhcpServingParamsParcel> dhcpParamsCaptor =
-                ArgumentCaptor.forClass(DhcpServingParamsParcel.class);
-        mTethering.startTethering(createTetheringRequest(TETHERING_WIFI,
-                        serverLinkAddr, clientLinkAddr, false, CONNECTIVITY_SCOPE_GLOBAL, null),
-                TEST_CALLER_PKG, null);
+        mTethering.interfaceAdded(TEST_WIFI_IFNAME);
         mLooper.dispatchAll();
-        verifyWifiTetheringRequested();
-        mTethering.interfaceStatusChanged(TEST_WLAN_IFNAME, true);
+        mTethering.interfaceStatusChanged(TEST_WIFI_IFNAME, false);
+        mTethering.interfaceStatusChanged(TEST_WIFI_IFNAME, true);
 
-        // Call legacyTether on the interface before the link layer event comes back.
-        // This happens, for example, in pre-T bluetooth tethering: Settings calls startTethering,
-        // and then the bluetooth code calls the tether() API.
-        final ResultListener tetherResult = new ResultListener(TETHER_ERROR_NO_ERROR);
-        mTethering.legacyTether(TEST_WLAN_IFNAME, tetherResult);
+        final ResultListener result = new ResultListener(TETHER_ERROR_UNSUPPORTED);
+        mTethering.legacyTether(TEST_WIFI_IFNAME, result);
         mLooper.dispatchAll();
-        tetherResult.assertHasResult();
-
-        // Verify that the static ip set in startTethering is used
-        verify(mNetd).interfaceSetCfg(argThat(cfg -> serverAddr.equals(cfg.ipv4Addr)));
-        verify(mIpServerDependencies, times(1)).makeDhcpServer(any(), dhcpParamsCaptor.capture(),
-                any());
-        final DhcpServingParamsParcel params = dhcpParamsCaptor.getValue();
-        assertEquals(serverAddr, intToInet4AddressHTH(params.serverAddr).getHostAddress());
-        assertEquals(24, params.serverAddrPrefixLength);
-        assertEquals(clientAddrParceled, params.singleClientAddr);
+        result.assertHasResult();
     }
 
     @Test
diff --git a/tests/cts/tethering/src/android/tethering/cts/TetheringManagerTest.java b/tests/cts/tethering/src/android/tethering/cts/TetheringManagerTest.java
index 006eafd8b9..c5e604fb65 100644
--- a/tests/cts/tethering/src/android/tethering/cts/TetheringManagerTest.java
+++ b/tests/cts/tethering/src/android/tethering/cts/TetheringManagerTest.java
@@ -41,6 +41,7 @@ import static android.net.TetheringManager.TETHER_ERROR_ENTITLEMENT_UNKNOWN;
 import static android.net.TetheringManager.TETHER_ERROR_NO_CHANGE_TETHERING_PERMISSION;
 import static android.net.TetheringManager.TETHER_ERROR_NO_ERROR;
 import static android.net.TetheringManager.TETHER_ERROR_UNKNOWN_REQUEST;
+import static android.net.TetheringManager.TETHER_ERROR_UNSUPPORTED;
 import static android.net.cts.util.CtsTetheringUtils.isAnyIfaceMatch;
 import static android.os.Process.INVALID_UID;
 
@@ -432,28 +433,20 @@ public class TetheringManagerTest {
                     mCtsTetheringUtils.startWifiTethering(tetherEventCallback, softApConfig);
 
             assertNotNull(tetheredIface);
+            final String wifiTetheringIface = tetheredIface.getInterface();
             if  (SdkLevel.isAtLeastB()) {
                 assertEquals(softApConfig, tetheredIface.getSoftApConfiguration());
             }
 
             mCtsTetheringUtils.stopWifiTethering(tetherEventCallback);
 
-            if (!SdkLevel.isAtLeastB()) {
-                final String wifiTetheringIface = tetheredIface.getInterface();
-                try {
-                    final int ret = runAsShell(TETHER_PRIVILEGED,
-                            () -> mTM.tether(wifiTetheringIface));
-                    // There is no guarantee that the wifi interface will be available after
-                    // disabling the hotspot, so don't fail the test if the call to tether() fails.
-                    if (ret == TETHER_ERROR_NO_ERROR) {
-                        // If calling #tether successful, there is a callback to tell the result of
-                        // tethering setup.
-                        tetherEventCallback.expectErrorOrTethered(
-                                new TetheringInterface(TETHERING_WIFI, wifiTetheringIface));
-                    }
-                } finally {
-                    runAsShell(TETHER_PRIVILEGED, () -> mTM.untether(wifiTetheringIface));
-                }
+            if (SdkLevel.isAtLeastB()) {
+                assertThrows(UnsupportedOperationException.class,
+                        () -> runAsShell(TETHER_PRIVILEGED,
+                                () -> mTM.tether(wifiTetheringIface)));
+            } else {
+                final int ret = runAsShell(TETHER_PRIVILEGED, () -> mTM.tether(wifiTetheringIface));
+                assertEquals(TETHER_ERROR_UNSUPPORTED, ret);
             }
         } finally {
             mCtsTetheringUtils.unregisterTetheringEventCallback(tetherEventCallback);

From 0cbf4b2b56452d1e72818f32de6200cab9162dc0 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Tue, 13 May 2025 05:09:06 -0700
Subject: [PATCH 243/377] Inline getServedUsbType

To improve readability. Renames the forNcmFunction parameter to isNcm to
make it all fit on a single line.

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: Iafebc4398aaf061175c4f84c45b37975940ca587
---
 .../networkstack/tethering/Tethering.java     | 27 +++++++------------
 1 file changed, 10 insertions(+), 17 deletions(-)

diff --git a/Tethering/src/com/android/networkstack/tethering/Tethering.java b/Tethering/src/com/android/networkstack/tethering/Tethering.java
index efbaee4ea6..7e38d19f20 100644
--- a/Tethering/src/com/android/networkstack/tethering/Tethering.java
+++ b/Tethering/src/com/android/networkstack/tethering/Tethering.java
@@ -1269,13 +1269,6 @@ public class Tethering {
         return mEntitlementMgr.isTetherProvisioningRequired(cfg);
     }
 
-    private int getServedUsbType(boolean forNcmFunction) {
-        // TETHERING_NCM is only used if the device does not use NCM for regular USB tethering.
-        if (forNcmFunction && !mConfig.isUsingNcm()) return TETHERING_NCM;
-
-        return TETHERING_USB;
-    }
-
     // TODO: Figure out how to update for local hotspot mode interfaces.
     private void notifyTetherStatesChanged() {
         if (!isTetheringSupported()) return;
@@ -1816,14 +1809,7 @@ public class Tethering {
     //     - allows requesting either tethering or local hotspot serving states
     //     - only tethers the first matching interface in listInterfaces()
     //       order of a given type
-    private void enableUsbIpServing(boolean forNcmFunction) {
-        // Note: TetheringConfiguration#isUsingNcm can change between the call to
-        // startTethering(TETHERING_USB) and the ACTION_USB_STATE broadcast. If the USB tethering
-        // function changes from NCM to RNDIS, this can lead to Tethering starting NCM tethering
-        // as local-only. But if this happens, the SettingsObserver will call stopTetheringInternal
-        // for both TETHERING_USB and TETHERING_NCM, so the local-only NCM interface will be
-        // stopped immediately.
-        final int tetheringType = getServedUsbType(forNcmFunction);
+    private void enableUsbIpServing(boolean isNcm) {
         String[] ifaces = null;
         try {
             ifaces = mNetd.interfaceGetList();
@@ -1832,17 +1818,24 @@ public class Tethering {
             return;
         }
 
+        // Note: TetheringConfiguration#isUsingNcm can change between the call to
+        // startTethering(TETHERING_USB) and the ACTION_USB_STATE broadcast. If the USB tethering
+        // function changes from NCM to RNDIS, this can lead to Tethering starting NCM tethering
+        // as local-only. But if this happens, the SettingsObserver will call stopTetheringInternal
+        // for both TETHERING_USB and TETHERING_NCM, so the local-only NCM interface will be
+        // stopped immediately.
+        final int tetheringType = (isNcm && !mConfig.isUsingNcm()) ? TETHERING_NCM : TETHERING_USB;
         final TetheringRequest request = mRequestTracker.getOrCreatePendingRequest(tetheringType);
         if (ifaces != null) {
             for (String iface : ifaces) {
                 if (ifaceNameToType(iface) == tetheringType) {
-                    enableIpServing(request, iface, forNcmFunction);
+                    enableIpServing(request, iface, isNcm);
                     return;
                 }
             }
         }
 
-        mLog.e("could not enable IpServer for function " + (forNcmFunction ? "NCM" : "RNDIS"));
+        mLog.e("could not enable IpServer for function " + (isNcm ? "NCM" : "RNDIS"));
     }
 
     private void disableUsbIpServing(boolean forNcmFunction) {

From 0978c3207e6d88fe55f999c51ec686c369a084f4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thi=C3=A9baud=20Weksteen?= <tweek@google.com>
Date: Wed, 14 May 2025 13:16:51 +1000
Subject: [PATCH 244/377] Remove v1 compatibility version

This version is deprecated, only download the latest version. Keep the
array in place to easily add the next version in the future.

Bug: 409884646
Test: atest NetworkSecurityUnitTests
Flag: EXEMPT bug fix
Change-Id: Ia367c0c796ba56a470edcbfa0bc93213c4829d3f
---
 .../android/server/net/ct/CertificateTransparencyService.java | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyService.java b/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyService.java
index b009a4afc9..edf44f4875 100644
--- a/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyService.java
+++ b/networksecurity/service/src/com/android/server/net/ct/CertificateTransparencyService.java
@@ -55,10 +55,6 @@ public class CertificateTransparencyService extends ICertificateTransparencyMana
         SignatureVerifier signatureVerifier = new SignatureVerifier(context);
         Collection<CompatibilityVersion> compatVersions =
                 Arrays.asList(
-                        new CompatibilityVersion(
-                                Config.COMPATIBILITY_VERSION_V1,
-                                Config.URL_SIGNATURE_V1,
-                                Config.URL_LOG_LIST_V1),
                         new CompatibilityVersion(
                                 Config.COMPATIBILITY_VERSION_V2,
                                 Config.URL_SIGNATURE_V2,

From 9ace2bc8d1014a73941abd1496ec5d6db0d93878 Mon Sep 17 00:00:00 2001
From: Xiao Ma <xiaom@google.com>
Date: Wed, 14 May 2025 15:19:59 +0900
Subject: [PATCH 245/377] DHCPv6 addr reg: add OPTION_ADDR_REG_ENABLE option
 code.

Flag: EXEMPT define an option code constant
Bug: 293393743
Test: TH
Change-Id: Ib8b33b3c8ef9c568e1e0ef3b7f84d716ae53f130
---
 .../com/android/net/module/util/dhcp6/Dhcp6Packet.java    | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java
index 728106b578..7ea585f764 100644
--- a/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java
+++ b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java
@@ -134,6 +134,14 @@ public class Dhcp6Packet {
     public static final byte DHCP6_SOL_MAX_RT = 82;
     private OptionalInt mSolMaxRt;
 
+    /**
+     * DHCPv6 zero-length Optional Type: The Address Registration option. Per RFC9686, the client
+     * can discover if the DHCPv6 infrastructure supports address registration by including this
+     * option in the Option Request options that it sends.
+     */
+    public static final short DHCP6_OPTION_ADDR_REG_ENABLE = 148;
+    public boolean mAddrRegEnable;
+
     /**
      * The transaction identifier used in this particular DHCPv6 negotiation
      */

From 7e4e0952f8a64afdf853bfdfac4ce32e1efe293f Mon Sep 17 00:00:00 2001
From: Ying Xu <yinxu@google.com>
Date: Fri, 9 May 2025 08:43:18 -0700
Subject: [PATCH 246/377] Enable REQUEST_RESTRICTED_WIFI and
 CARRIER_SERVICE_CHANGED_USE_CALLBACK by default with kill switch

Bug: 416044405

Test: atest ConnectivityManagerTest
      atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.ConnectivityServiceTest
Change-Id: I1b67c00ce3d4054414ce9c538ec4d7b9a55b4302
Flag: com.android.net.flags.request_restricted_wifi
---
 service/src/com/android/server/ConnectivityService.java   | 2 +-
 .../connectivity/CarrierPrivilegeAuthenticator.java       | 8 ++++----
 .../java/com/android/server/ConnectivityServiceTest.java  | 3 +--
 .../connectivity/CarrierPrivilegeAuthenticatorTest.java   | 2 +-
 4 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index 47cd3e119e..07375c7f4c 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -1966,7 +1966,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
         mAppOpsManager = (AppOpsManager) mContext.getSystemService(Context.APP_OPS_SERVICE);
         mLocationPermissionChecker = mDeps.makeLocationPermissionChecker(mContext);
         mRequestRestrictedWifiEnabled = mDeps.isAtLeastU()
-                && mDeps.isFeatureEnabled(context, REQUEST_RESTRICTED_WIFI);
+                && mDeps.isFeatureNotChickenedOut(context, REQUEST_RESTRICTED_WIFI);
         mBackgroundFirewallChainEnabled = mDeps.isAtLeastV() && mDeps.isFeatureNotChickenedOut(
                 context, ConnectivityFlags.BACKGROUND_FIREWALL_CHAIN);
         mUseDeclaredMethodsForCallbacksEnabled =
diff --git a/service/src/com/android/server/connectivity/CarrierPrivilegeAuthenticator.java b/service/src/com/android/server/connectivity/CarrierPrivilegeAuthenticator.java
index 14a935f546..84475fea36 100644
--- a/service/src/com/android/server/connectivity/CarrierPrivilegeAuthenticator.java
+++ b/service/src/com/android/server/connectivity/CarrierPrivilegeAuthenticator.java
@@ -97,7 +97,7 @@ public class CarrierPrivilegeAuthenticator {
         mContext = c;
         mTelephonyManager = t;
         mTelephonyManagerShim = telephonyManagerShim;
-        mUseCallbacksForServiceChanged = deps.isFeatureEnabled(
+        mUseCallbacksForServiceChanged = deps.isFeatureNotChickenedOut(
                 c, CARRIER_SERVICE_CHANGED_USE_CALLBACK);
         mRequestRestrictedWifiEnabled = requestRestrictedWifiEnabled;
         mListener = listener;
@@ -159,10 +159,10 @@ public class CarrierPrivilegeAuthenticator {
         }
 
         /**
-         * @see DeviceConfigUtils#isTetheringFeatureEnabled
+         * @see DeviceConfigUtils#isTetheringFeatureNotChickenedOut
          */
-        public boolean isFeatureEnabled(Context context, String name) {
-            return DeviceConfigUtils.isTetheringFeatureEnabled(context, name);
+        public boolean isFeatureNotChickenedOut(Context context, String name) {
+            return DeviceConfigUtils.isTetheringFeatureNotChickenedOut(context, name);
         }
     }
 
diff --git a/tests/unit/java/com/android/server/ConnectivityServiceTest.java b/tests/unit/java/com/android/server/ConnectivityServiceTest.java
index b144cd17a3..640806a45e 100755
--- a/tests/unit/java/com/android/server/ConnectivityServiceTest.java
+++ b/tests/unit/java/com/android/server/ConnectivityServiceTest.java
@@ -2183,8 +2183,6 @@ public class ConnectivityServiceTest {
         public boolean isFeatureEnabled(Context context, String name) {
             switch (name) {
                 case ConnectivityFlags.NO_REMATCH_ALL_REQUESTS_ON_REGISTER:
-                case ConnectivityFlags.CARRIER_SERVICE_CHANGED_USE_CALLBACK:
-                case ConnectivityFlags.REQUEST_RESTRICTED_WIFI:
                 case ConnectivityFlags.USE_DECLARED_METHODS_FOR_CALLBACKS:
                 case ConnectivityFlags.QUEUE_CALLBACKS_FOR_FROZEN_APPS:
                 case ConnectivityFlags.BACKGROUND_FIREWALL_CHAIN:
@@ -2205,6 +2203,7 @@ public class ConnectivityServiceTest {
                 case ConnectivityFlags.INGRESS_TO_VPN_ADDRESS_FILTERING:
                 case ConnectivityFlags.BACKGROUND_FIREWALL_CHAIN:
                 case ConnectivityFlags.DELAY_DESTROY_SOCKETS:
+                case ConnectivityFlags.REQUEST_RESTRICTED_WIFI:
                 case ConnectivityFlags.USE_DECLARED_METHODS_FOR_CALLBACKS:
                 case ConnectivityFlags.QUEUE_CALLBACKS_FOR_FROZEN_APPS:
                 case ConnectivityFlags.QUEUE_NETWORK_AGENT_EVENTS_IN_SYSTEM_SERVER:
diff --git a/tests/unit/java/com/android/server/connectivity/CarrierPrivilegeAuthenticatorTest.java b/tests/unit/java/com/android/server/connectivity/CarrierPrivilegeAuthenticatorTest.java
index ab81abc030..54ac4fb3ba 100644
--- a/tests/unit/java/com/android/server/connectivity/CarrierPrivilegeAuthenticatorTest.java
+++ b/tests/unit/java/com/android/server/connectivity/CarrierPrivilegeAuthenticatorTest.java
@@ -141,7 +141,7 @@ public class CarrierPrivilegeAuthenticatorTest {
         mHandlerThread = new HandlerThread(CarrierPrivilegeAuthenticatorTest.class.getSimpleName());
         mUseCallbacks = useCallbacks;
         final Dependencies deps = mock(Dependencies.class);
-        doReturn(useCallbacks).when(deps).isFeatureEnabled(any() /* context */,
+        doReturn(useCallbacks).when(deps).isFeatureNotChickenedOut(any() /* context */,
                 eq(CARRIER_SERVICE_CHANGED_USE_CALLBACK));
         doReturn(mHandlerThread).when(deps).makeHandlerThread();
         doReturn(SUBSCRIPTION_COUNT).when(mTelephonyManager).getActiveModemCount();

From 27189f4dff3c016d7a635b3cfc12fd02e53e238e Mon Sep 17 00:00:00 2001
From: Richard Uhler <ruhler@google.com>
Date: Fri, 9 May 2025 12:45:56 -0700
Subject: [PATCH 247/377] Optimize NetworkStats.filteredClone function.

Avoid duplicate calls to getValues for non-matched entries. Performance
experiments suggest it is worth the cost of the additional BitSet
allocation to keep track of what matched. BitSet performs slightly
better, and allocates/uses/frees less memory, than a boolean array.

Bug: 416650909
Test: atest ConnectivityCoverageTests:android.net.connectivity.android.net.NetworkStatsTest
Flag: EXEMPT bugfix
Change-Id: I932375798a58f8ee59b6028faade5fa88ba053cb
---
 framework-t/src/android/net/NetworkStats.java | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/framework-t/src/android/net/NetworkStats.java b/framework-t/src/android/net/NetworkStats.java
index 5b7dddb454..a50352e463 100644
--- a/framework-t/src/android/net/NetworkStats.java
+++ b/framework-t/src/android/net/NetworkStats.java
@@ -44,6 +44,7 @@ import java.io.PrintWriter;
 import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.util.Arrays;
+import java.util.BitSet;
 import java.util.HashSet;
 import java.util.Iterator;
 import java.util.List;
@@ -1431,21 +1432,26 @@ public final class NetworkStats implements Parcelable, Iterable<NetworkStats.Ent
      * @hide
      */
     public NetworkStats filteredClone(int limitUid, String[] limitIfaces, int limitTag) {
+        // Compute the size needed for the final NetworkStats object to avoid
+        // overallocation and intermediate copies. Performance experiments
+        // suggest we save a little by avoiding getValues calls on unmatched
+        // entries, even at the allocation cost of a temporary BitSet.
+        BitSet matches = new BitSet(size);
         NetworkStats.Entry e = null;
         int filteredSize = 0;
         for (int i = 0; i < size; i++) {
             e = getValues(i, e);
             if (e.matches(limitUid, limitIfaces, limitTag)) {
+                matches.set(i);
                 filteredSize++;
             }
         }
 
         final NetworkStats clone = new NetworkStats(elapsedRealtime, filteredSize);
-        for (int i = 0; i < size; i++) {
-            e = getValues(i, e);
-            if (e.matches(limitUid, limitIfaces, limitTag)) {
-                clone.insertEntry(e);
-            }
+        int i = matches.nextSetBit(0);
+        while (i != -1) {
+            clone.insertEntry(getValues(i, e));
+            i = matches.nextSetBit(i + 1);
         }
         return clone;
     }

From 33b48e47c6101bd120a537e834ae06f8998075f0 Mon Sep 17 00:00:00 2001
From: Julien Desprez <jdesprez@google.com>
Date: Wed, 14 May 2025 13:23:36 -0700
Subject: [PATCH 248/377] Backfill new field host_commong_data

This new field ensures that the dependence is properly packaged with the module.
(original context: b/262397555)

Test: presubmit
Bug: 413525819
Flag: TEST_ONLY
Change-Id: Ifca931a4ee7fa671f2316ae731b207404a8edd3d
---
 tests/cts/net/Android.bp                                 | 1 +
 tests/cts/net/native/dns/Android.bp                      | 1 +
 tests/cts/netpermission/internetpermission/Android.bp    | 1 +
 tests/cts/netpermission/updatestatspermission/Android.bp | 1 +
 tests/cts/tethering/Android.bp                           | 1 +
 5 files changed, 5 insertions(+)

diff --git a/tests/cts/net/Android.bp b/tests/cts/net/Android.bp
index 3fc0e33be8..9aa4f8036f 100644
--- a/tests/cts/net/Android.bp
+++ b/tests/cts/net/Android.bp
@@ -82,6 +82,7 @@ java_defaults {
     min_sdk_version: "30",
     per_testcase_directory: true,
     host_required: ["net-tests-utils-host-common"],
+    host_common_data: [":net-tests-utils-host-common"],
     test_config_template: "AndroidTestTemplate.xml",
     data: [
         ":ConnectivityTestPreparer",
diff --git a/tests/cts/net/native/dns/Android.bp b/tests/cts/net/native/dns/Android.bp
index 8138598f0b..a9d0440e69 100644
--- a/tests/cts/net/native/dns/Android.bp
+++ b/tests/cts/net/native/dns/Android.bp
@@ -45,6 +45,7 @@ cc_defaults {
     // To be compatible with R devices, the min_sdk_version must be 30.
     min_sdk_version: "30",
     host_required: ["net-tests-utils-host-common"],
+    host_common_data: [":net-tests-utils-host-common"],
 }
 
 cc_test {
diff --git a/tests/cts/netpermission/internetpermission/Android.bp b/tests/cts/netpermission/internetpermission/Android.bp
index 71d2b6e032..82f8c30f26 100644
--- a/tests/cts/netpermission/internetpermission/Android.bp
+++ b/tests/cts/netpermission/internetpermission/Android.bp
@@ -31,6 +31,7 @@ android_test {
         "general-tests",
     ],
     host_required: ["net-tests-utils-host-common"],
+    host_common_data: [":net-tests-utils-host-common"],
     sdk_version: "test_current",
     data: [
         ":ConnectivityTestPreparer",
diff --git a/tests/cts/netpermission/updatestatspermission/Android.bp b/tests/cts/netpermission/updatestatspermission/Android.bp
index 0ff98e701c..ba8a7d7102 100644
--- a/tests/cts/netpermission/updatestatspermission/Android.bp
+++ b/tests/cts/netpermission/updatestatspermission/Android.bp
@@ -39,4 +39,5 @@ android_test {
     ],
     data: [":ConnectivityTestPreparer"],
     host_required: ["net-tests-utils-host-common"],
+    host_common_data: [":net-tests-utils-host-common"],
 }
diff --git a/tests/cts/tethering/Android.bp b/tests/cts/tethering/Android.bp
index fffc3c7ccd..b14e7e0065 100644
--- a/tests/cts/tethering/Android.bp
+++ b/tests/cts/tethering/Android.bp
@@ -56,6 +56,7 @@ java_defaults {
     platform_apis: true,
     min_sdk_version: "30",
     host_required: ["net-tests-utils-host-common"],
+    host_common_data: [":net-tests-utils-host-common"],
 }
 
 // Tethering CTS tests for development and release. These tests always target the platform SDK

From 9373e3442e8a0f231e6e41a43e3eff27e3a3b4ce Mon Sep 17 00:00:00 2001
From: Chalard Jean <jchalard@google.com>
Date: Fri, 9 May 2025 14:18:12 +0900
Subject: [PATCH 249/377] Remove deprecated SC_V2 constant

Test: TH
Flag: EXEMPT test-only
Change-Id: I3444fad305f49294ed8c3a850b631f385678c117
---
 .../tethering/EntitlementManagerTest.java     | 14 +++++-----
 .../android/net/module/util/NetUtilsTest.java |  6 ++---
 .../com/android/testutils/DevSdkIgnoreRule.kt |  4 +--
 ...thernetNetworkManagementExceptionTest.java |  5 ++--
 .../android/net/NetworkCapabilitiesTest.java  |  9 +++----
 .../netstats/NetworkStatsCollectionTest.kt    |  4 +--
 .../net/netstats/NetworkStatsHistoryTest.kt   |  4 +--
 .../net/netstats/NetworkTemplateTest.kt       |  3 +--
 ...ctivityFrameworkInitializerTiramisuTest.kt |  4 +--
 .../net/cts/ConnectivityManagerTest.java      | 23 ++++++++--------
 .../net/src/android/net/cts/DhcpOptionTest.kt |  4 +--
 .../src/android/net/cts/DnsResolverTest.java  |  4 +--
 .../net/src/android/net/cts/DscpPolicyTest.kt |  3 ++-
 .../cts/EthernetNetworkUpdateRequestTest.java |  5 ++--
 .../net/src/android/net/cts/Ikev2VpnTest.java | 23 ++++++++--------
 .../net/cts/NetworkStatsManagerTest.java      |  4 +--
 .../src/android/net/cts/RateLimitTest.java    |  4 +--
 .../net/EthernetNetworkUpdateRequestTest.java |  5 ++--
 .../android/net/NetworkStatsAccessTest.java   |  5 ++--
 .../net/NetworkStatsCollectionTest.java       |  4 +--
 .../android/net/NetworkStatsRecorderTest.java |  4 +--
 .../NetworkStatsDataMigrationUtilsTest.kt     |  4 +--
 .../server/ConnectivityServiceTest.java       | 27 +++++++++----------
 .../MultipathPolicyTrackerTest.java           |  3 +--
 ...tyMonitorWithConnectivityManagerTests.java |  5 ++--
 .../mdns/MdnsDiscoveryManagerTests.java       |  5 ++--
 .../mdns/MdnsPacketReaderTests.java           |  6 ++---
 .../connectivity/mdns/MdnsRecordTests.java    |  4 +--
 .../mdns/MdnsResponseDecoderTests.java        |  4 +--
 .../connectivity/mdns/MdnsResponseTests.java  |  5 ++--
 .../mdns/MdnsServiceInfoTest.java             |  4 +--
 .../mdns/MdnsServiceTypeClientTests.java      |  4 +--
 .../mdns/MdnsSocketClientTests.java           |  4 +--
 .../connectivity/mdns/MdnsSocketTests.java    |  6 ++---
 ...ulticastNetworkInterfaceProviderTests.java |  5 ++--
 .../server/net/NetworkStatsFactoryTest.java   |  4 +--
 .../server/net/NetworkStatsObserversTest.java |  5 ++--
 .../server/net/NetworkStatsServiceTest.java   |  3 +--
 .../NetworkStatsSubscriptionsMonitorTest.java |  5 ++--
 .../android/server/net/PersistentIntTest.kt   |  4 +--
 40 files changed, 115 insertions(+), 133 deletions(-)

diff --git a/Tethering/tests/unit/src/com/android/networkstack/tethering/EntitlementManagerTest.java b/Tethering/tests/unit/src/com/android/networkstack/tethering/EntitlementManagerTest.java
index 7bfdb22cfc..de39665ca3 100644
--- a/Tethering/tests/unit/src/com/android/networkstack/tethering/EntitlementManagerTest.java
+++ b/Tethering/tests/unit/src/com/android/networkstack/tethering/EntitlementManagerTest.java
@@ -40,7 +40,6 @@ import static com.android.dx.mockito.inline.extended.ExtendedMockito.mockitoSess
 import static com.android.networkstack.apishim.ConstantsShim.KEY_CARRIER_SUPPORTS_TETHERING_BOOL;
 import static com.android.testutils.DevSdkIgnoreRule.IgnoreAfter;
 import static com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo;
-import static com.android.testutils.DevSdkIgnoreRuleKt.SC_V2;
 
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
@@ -67,6 +66,7 @@ import android.content.pm.ModuleInfo;
 import android.content.pm.PackageInfo;
 import android.content.pm.PackageManager;
 import android.content.res.Resources;
+import android.os.Build;
 import android.os.Bundle;
 import android.os.Handler;
 import android.os.PersistableBundle;
@@ -603,7 +603,7 @@ public final class EntitlementManagerTest {
                 .onTetherProvisioningFailed(TETHERING_WIFI, FAILED_TETHERING_REASON);
     }
 
-    @IgnoreUpTo(SC_V2)
+    @IgnoreUpTo(Build.VERSION_CODES.S_V2)
     @Test
     public void testUiProvisioningMultiUser_aboveT_createContextAsUserThrows() {
         mMockContext.setCreateContextAsUserException(new IllegalStateException());
@@ -611,14 +611,14 @@ public final class EntitlementManagerTest {
         doTestUiProvisioningMultiUser(false, 1);
     }
 
-    @IgnoreUpTo(SC_V2)
+    @IgnoreUpTo(Build.VERSION_CODES.S_V2)
     @Test
     public void testUiProvisioningMultiUser_aboveT() {
         doTestUiProvisioningMultiUser(true, 1);
         doTestUiProvisioningMultiUser(false, 0);
     }
 
-    @IgnoreAfter(SC_V2)
+    @IgnoreAfter(Build.VERSION_CODES.S_V2)
     @Test
     public void testUiProvisioningMultiUser_belowT() {
         doTestUiProvisioningMultiUser(true, 1);
@@ -734,7 +734,7 @@ public final class EntitlementManagerTest {
     }
 
     @Test
-    @IgnoreUpTo(SC_V2)
+    @IgnoreUpTo(Build.VERSION_CODES.S_V2)
     public void requestLatestTetheringEntitlementResult_carrierDoesNotSupport_noProvisionCount()
             throws Exception {
         setupCarrierConfig(false);
@@ -746,7 +746,7 @@ public final class EntitlementManagerTest {
     }
 
     @Test
-    @IgnoreUpTo(SC_V2)
+    @IgnoreUpTo(Build.VERSION_CODES.S_V2)
     public void reevaluateSimCardProvisioning_carrierUnsupportAndSimswitch() {
         setupForRequiredProvisioning();
 
@@ -771,7 +771,7 @@ public final class EntitlementManagerTest {
     }
 
     @Test
-    @IgnoreUpTo(SC_V2)
+    @IgnoreUpTo(Build.VERSION_CODES.S_V2)
     public void startProvisioningIfNeeded_carrierUnsupport()
             throws Exception {
         setupCarrierConfig(false);
diff --git a/staticlibs/tests/unit/src/com/android/net/module/util/NetUtilsTest.java b/staticlibs/tests/unit/src/com/android/net/module/util/NetUtilsTest.java
index 9e635c2124..c12dfe0497 100644
--- a/staticlibs/tests/unit/src/com/android/net/module/util/NetUtilsTest.java
+++ b/staticlibs/tests/unit/src/com/android/net/module/util/NetUtilsTest.java
@@ -16,8 +16,6 @@
 
 package com.android.net.module.util;
 
-import static com.android.testutils.DevSdkIgnoreRuleKt.SC_V2;
-
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertNotEquals;
@@ -27,6 +25,7 @@ import static org.junit.Assert.assertTrue;
 import android.net.InetAddresses;
 import android.net.IpPrefix;
 import android.net.RouteInfo;
+import android.os.Build;
 
 import androidx.test.runner.AndroidJUnit4;
 
@@ -115,7 +114,7 @@ public final class NetUtilsTest {
         assertNotEquals(V6_EXPECTED, route);
     }
 
-    @Test @IgnoreUpTo(SC_V2)
+    @Test @IgnoreUpTo(Build.VERSION_CODES.S_V2)
     public void testSelectBestRouteWithExcludedRoutes() {
         final List<RouteInfo> routes = new ArrayList<>();
 
@@ -140,4 +139,3 @@ public final class NetUtilsTest {
         assertNull(route);
     }
 }
-
diff --git a/staticlibs/testutils/devicetests/com/android/testutils/DevSdkIgnoreRule.kt b/staticlibs/testutils/devicetests/com/android/testutils/DevSdkIgnoreRule.kt
index 46229b0cd2..ebeb590922 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/DevSdkIgnoreRule.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/DevSdkIgnoreRule.kt
@@ -25,11 +25,9 @@ import org.junit.rules.TestRule
 import org.junit.runner.Description
 import org.junit.runners.model.Statement
 
+// TODO : remove uses in /cts/ and remove
 @Deprecated("Use Build.VERSION_CODES", ReplaceWith("Build.VERSION_CODES.S_V2"))
 const val SC_V2 = Build.VERSION_CODES.S_V2
-// TODO: Remove this when Build.VERSION_CODES.VANILLA_ICE_CREAM is available in all branches
-// where this code builds
-const val VANILLA_ICE_CREAM = 35 // Bui1ld.VERSION_CODES.VANILLA_ICE_CREAM
 
 private val MAX_TARGET_SDK_ANNOTATION_RE = Pattern.compile("MaxTargetSdk([0-9]+)$")
 private val targetSdk = InstrumentationRegistry.getContext().applicationInfo.targetSdkVersion
diff --git a/tests/common/java/android/net/EthernetNetworkManagementExceptionTest.java b/tests/common/java/android/net/EthernetNetworkManagementExceptionTest.java
index 84b6e54daa..c7dfb7d037 100644
--- a/tests/common/java/android/net/EthernetNetworkManagementExceptionTest.java
+++ b/tests/common/java/android/net/EthernetNetworkManagementExceptionTest.java
@@ -16,11 +16,12 @@
 
 package android.net;
 
-import static com.android.testutils.DevSdkIgnoreRuleKt.SC_V2;
 import static com.android.testutils.ParcelUtils.assertParcelingIsLossless;
 
 import static org.junit.Assert.assertEquals;
 
+import android.os.Build;
+
 import androidx.test.filters.SmallTest;
 
 import com.android.testutils.DevSdkIgnoreRule;
@@ -29,7 +30,7 @@ import com.android.testutils.DevSdkIgnoreRunner;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 
-@DevSdkIgnoreRule.IgnoreUpTo(SC_V2) // TODO: Use to Build.VERSION_CODES.SC_V2 when available
+@DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.S_V2)
 @RunWith(DevSdkIgnoreRunner.class)
 @SmallTest
 public class EthernetNetworkManagementExceptionTest {
diff --git a/tests/common/java/android/net/NetworkCapabilitiesTest.java b/tests/common/java/android/net/NetworkCapabilitiesTest.java
index 3fc2af0fb0..499b52d3be 100644
--- a/tests/common/java/android/net/NetworkCapabilitiesTest.java
+++ b/tests/common/java/android/net/NetworkCapabilitiesTest.java
@@ -66,7 +66,6 @@ import static android.os.Process.INVALID_UID;
 import static com.android.modules.utils.build.SdkLevel.isAtLeastS;
 import static com.android.modules.utils.build.SdkLevel.isAtLeastT;
 import static com.android.modules.utils.build.SdkLevel.isAtLeastV;
-import static com.android.testutils.DevSdkIgnoreRuleKt.SC_V2;
 import static com.android.testutils.MiscAsserts.assertEmpty;
 import static com.android.testutils.MiscAsserts.assertThrows;
 import static com.android.testutils.ParcelUtils.assertParcelingIsLossless;
@@ -322,7 +321,7 @@ public class NetworkCapabilitiesTest {
         }
     }
 
-    @Test @IgnoreUpTo(SC_V2)
+    @Test @IgnoreUpTo(Build.VERSION_CODES.S_V2)
     public void testSetAllowedUids() {
         final NetworkCapabilities nc = new NetworkCapabilities();
         assertThrows(NullPointerException.class, () -> nc.setAllowedUids(null));
@@ -478,7 +477,7 @@ public class NetworkCapabilitiesTest {
         assertFalse(nr.satisfiedByNetworkCapabilities(new NetworkCapabilities()));
     }
 
-    @Test @IgnoreUpTo(SC_V2) // TODO: Use to Build.VERSION_CODES.SC_V2 when available
+    @Test @IgnoreUpTo(Build.VERSION_CODES.S_V2)
     public void testPrioritizeLatencyAndBandwidth() {
         NetworkCapabilities netCap = new NetworkCapabilities();
         netCap.addCapability(NET_CAPABILITY_PRIORITIZE_LATENCY);
@@ -927,7 +926,7 @@ public class NetworkCapabilitiesTest {
         } catch (IllegalStateException expected) { }
     }
 
-    @Test @IgnoreUpTo(SC_V2) // TODO: Use to Build.VERSION_CODES.SC_V2 when available
+    @Test @IgnoreUpTo(Build.VERSION_CODES.S_V2)
     public void testEnterpriseId() {
         final NetworkCapabilities nc1 = new NetworkCapabilities.Builder()
                 .addCapability(NET_CAPABILITY_ENTERPRISE)
@@ -1522,7 +1521,7 @@ public class NetworkCapabilitiesTest {
         assertTrue(reservationNc.satisfiedByNetworkCapabilities(offerNc));
     }
 
-    @Test @IgnoreUpTo(SC_V2)
+    @Test @IgnoreUpTo(Build.VERSION_CODES.S_V2)
     public void testReservationIdEquals() {
         final NetworkCapabilities nc = new NetworkCapabilities();
         nc.setReservationId(42);
diff --git a/tests/common/java/android/net/netstats/NetworkStatsCollectionTest.kt b/tests/common/java/android/net/netstats/NetworkStatsCollectionTest.kt
index 368a519552..2b7e52fa9d 100644
--- a/tests/common/java/android/net/netstats/NetworkStatsCollectionTest.kt
+++ b/tests/common/java/android/net/netstats/NetworkStatsCollectionTest.kt
@@ -19,10 +19,10 @@ package android.net.netstats
 import android.net.NetworkIdentity
 import android.net.NetworkStatsCollection
 import android.net.NetworkStatsHistory
+import android.os.Build
 import androidx.test.filters.SmallTest
 import com.android.testutils.ConnectivityModuleTest
 import com.android.testutils.DevSdkIgnoreRule
-import com.android.testutils.SC_V2
 import org.junit.Rule
 import org.junit.Test
 import org.junit.runner.RunWith
@@ -36,7 +36,7 @@ import kotlin.test.fail
 class NetworkStatsCollectionTest {
     @Rule
     @JvmField
-    val ignoreRule = DevSdkIgnoreRule(ignoreClassUpTo = SC_V2)
+    val ignoreRule = DevSdkIgnoreRule(ignoreClassUpTo = Build.VERSION_CODES.S_V2)
 
     @Test
     fun testBuilder() {
diff --git a/tests/common/java/android/net/netstats/NetworkStatsHistoryTest.kt b/tests/common/java/android/net/netstats/NetworkStatsHistoryTest.kt
index a6c9f3cebd..a001dfcac2 100644
--- a/tests/common/java/android/net/netstats/NetworkStatsHistoryTest.kt
+++ b/tests/common/java/android/net/netstats/NetworkStatsHistoryTest.kt
@@ -17,11 +17,11 @@
 package android.net.netstats
 
 import android.net.NetworkStatsHistory
+import android.os.Build
 import android.text.format.DateUtils
 import androidx.test.filters.SmallTest
 import com.android.testutils.ConnectivityModuleTest
 import com.android.testutils.DevSdkIgnoreRule
-import com.android.testutils.SC_V2
 import org.junit.Rule
 import org.junit.Test
 import org.junit.runner.RunWith
@@ -34,7 +34,7 @@ import kotlin.test.assertEquals
 class NetworkStatsHistoryTest {
     @Rule
     @JvmField
-    val ignoreRule = DevSdkIgnoreRule(ignoreClassUpTo = SC_V2)
+    val ignoreRule = DevSdkIgnoreRule(ignoreClassUpTo = Build.VERSION_CODES.S_V2)
 
     @Test
     fun testBuilder() {
diff --git a/tests/common/java/android/net/netstats/NetworkTemplateTest.kt b/tests/common/java/android/net/netstats/NetworkTemplateTest.kt
index 1b55be9725..f6b655586d 100644
--- a/tests/common/java/android/net/netstats/NetworkTemplateTest.kt
+++ b/tests/common/java/android/net/netstats/NetworkTemplateTest.kt
@@ -34,7 +34,6 @@ import android.os.Build
 import android.telephony.TelephonyManager
 import com.android.testutils.ConnectivityModuleTest
 import com.android.testutils.DevSdkIgnoreRule
-import com.android.testutils.SC_V2
 import kotlin.test.assertEquals
 import kotlin.test.assertFailsWith
 import org.junit.Rule
@@ -51,7 +50,7 @@ private const val TEST_WIFI_KEY2 = "wifiKey2"
 class NetworkTemplateTest {
     @Rule
     @JvmField
-    val ignoreRule = DevSdkIgnoreRule(ignoreClassUpTo = SC_V2)
+    val ignoreRule = DevSdkIgnoreRule(ignoreClassUpTo = Build.VERSION_CODES.S_V2)
 
     @Test
     fun testBuilderMatchRules() {
diff --git a/tests/cts/net/src/android/net/cts/ConnectivityFrameworkInitializerTiramisuTest.kt b/tests/cts/net/src/android/net/cts/ConnectivityFrameworkInitializerTiramisuTest.kt
index 049372f576..61139330c3 100644
--- a/tests/cts/net/src/android/net/cts/ConnectivityFrameworkInitializerTiramisuTest.kt
+++ b/tests/cts/net/src/android/net/cts/ConnectivityFrameworkInitializerTiramisuTest.kt
@@ -17,11 +17,11 @@
 package android.net.cts
 
 import android.net.nsd.NsdManager
+import android.os.Build
 import androidx.test.platform.app.InstrumentationRegistry
 import com.android.networkstack.apishim.ConnectivityFrameworkInitShimImpl
 import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
 import com.android.testutils.DevSdkIgnoreRunner
-import com.android.testutils.SC_V2
 import org.junit.Test
 import org.junit.runner.RunWith
 import kotlin.test.assertNotNull
@@ -30,7 +30,7 @@ private val cfiShim = ConnectivityFrameworkInitShimImpl.newInstance()
 
 @RunWith(DevSdkIgnoreRunner::class)
 // ConnectivityFrameworkInitializerTiramisu was added in T
-@IgnoreUpTo(SC_V2) // TODO: Use to Build.VERSION_CODES.SC_V2 when available
+@IgnoreUpTo(Build.VERSION_CODES.S_V2)
 class ConnectivityFrameworkInitializerTiramisuTest {
     @Test
     fun testServicesRegistered() {
diff --git a/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java b/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
index bdb5283df8..e86259e075 100644
--- a/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
+++ b/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
@@ -118,7 +118,6 @@ import static com.android.networkstack.apishim.ConstantsShim.BLOCKED_REASON_NONE
 import static com.android.networkstack.apishim.ConstantsShim.RECEIVER_EXPORTED;
 import static com.android.networkstack.apishim.ConstantsShim.RECEIVER_NOT_EXPORTED;
 import static com.android.testutils.Cleanup.testAndCleanup;
-import static com.android.testutils.DevSdkIgnoreRuleKt.SC_V2;
 import static com.android.testutils.MiscAsserts.assertEventuallyTrue;
 import static com.android.testutils.MiscAsserts.assertThrows;
 import static com.android.testutils.TestNetworkTrackerKt.initTestNetwork;
@@ -692,7 +691,7 @@ public class ConnectivityManagerTest {
         return null;
     }
 
-    @DevSdkIgnoreRule.IgnoreUpTo(SC_V2)
+    @DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.S_V2)
     @AppModeFull(reason = "Cannot get installed packages in instant app mode")
     @Test
     public void testGetRedactedLinkPropertiesForPackage() throws Exception {
@@ -781,7 +780,7 @@ public class ConnectivityManagerTest {
     }
 
     @ConnectivityModuleTest
-    @DevSdkIgnoreRule.IgnoreUpTo(SC_V2)
+    @DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.S_V2)
     @AppModeFull(reason = "Cannot get installed packages in instant app mode")
     @Test
     public void testGetRedactedNetworkCapabilitiesForPackage() throws Exception {
@@ -3619,7 +3618,7 @@ public class ConnectivityManagerTest {
         assertTrue(dumpOutput, dumpOutput.contains("Active default network"));
     }
 
-    @Test @IgnoreUpTo(SC_V2)
+    @Test @IgnoreUpTo(Build.VERSION_CODES.S_V2)
     public void testDumpBpfNetMaps() throws Exception {
         final String[] args = new String[] {"--short", "trafficcontroller"};
         String dumpOutput = DumpTestUtils.dumpServiceWithShellPermission(
@@ -3734,7 +3733,7 @@ public class ConnectivityManagerTest {
         }, NETWORK_SETTINGS);
     }
 
-    @Test @IgnoreUpTo(SC_V2) @ConnectivityModuleTest
+    @Test @IgnoreUpTo(Build.VERSION_CODES.S_V2) @ConnectivityModuleTest
     @AppModeFull(reason = "Socket cannot bind in instant app mode")
     public void testFirewallBlockingDozable() {
         doTestFirewallBlocking(FIREWALL_CHAIN_DOZABLE, ALLOWLIST);
@@ -3748,43 +3747,43 @@ public class ConnectivityManagerTest {
         doTestFirewallBlocking(FIREWALL_CHAIN_BACKGROUND, ALLOWLIST);
     }
 
-    @Test @IgnoreUpTo(SC_V2) @ConnectivityModuleTest
+    @Test @IgnoreUpTo(Build.VERSION_CODES.S_V2) @ConnectivityModuleTest
     @AppModeFull(reason = "Socket cannot bind in instant app mode")
     public void testFirewallBlockingPowersave() {
         doTestFirewallBlocking(FIREWALL_CHAIN_POWERSAVE, ALLOWLIST);
     }
 
-    @Test @IgnoreUpTo(SC_V2) @ConnectivityModuleTest
+    @Test @IgnoreUpTo(Build.VERSION_CODES.S_V2) @ConnectivityModuleTest
     @AppModeFull(reason = "Socket cannot bind in instant app mode")
     public void testFirewallBlockingRestricted() {
         doTestFirewallBlocking(FIREWALL_CHAIN_RESTRICTED, ALLOWLIST);
     }
 
-    @Test @IgnoreUpTo(SC_V2) @ConnectivityModuleTest
+    @Test @IgnoreUpTo(Build.VERSION_CODES.S_V2) @ConnectivityModuleTest
     @AppModeFull(reason = "Socket cannot bind in instant app mode")
     public void testFirewallBlockingLowPowerStandby() {
         doTestFirewallBlocking(FIREWALL_CHAIN_LOW_POWER_STANDBY, ALLOWLIST);
     }
 
-    @Test @IgnoreUpTo(SC_V2) @ConnectivityModuleTest
+    @Test @IgnoreUpTo(Build.VERSION_CODES.S_V2) @ConnectivityModuleTest
     @AppModeFull(reason = "Socket cannot bind in instant app mode")
     public void testFirewallBlockingStandby() {
         doTestFirewallBlocking(FIREWALL_CHAIN_STANDBY, DENYLIST);
     }
 
-    @Test @IgnoreUpTo(SC_V2) @ConnectivityModuleTest
+    @Test @IgnoreUpTo(Build.VERSION_CODES.S_V2) @ConnectivityModuleTest
     @AppModeFull(reason = "Socket cannot bind in instant app mode")
     public void testFirewallBlockingOemDeny1() {
         doTestFirewallBlocking(FIREWALL_CHAIN_OEM_DENY_1, DENYLIST);
     }
 
-    @Test @IgnoreUpTo(SC_V2) @ConnectivityModuleTest
+    @Test @IgnoreUpTo(Build.VERSION_CODES.S_V2) @ConnectivityModuleTest
     @AppModeFull(reason = "Socket cannot bind in instant app mode")
     public void testFirewallBlockingOemDeny2() {
         doTestFirewallBlocking(FIREWALL_CHAIN_OEM_DENY_2, DENYLIST);
     }
 
-    @Test @IgnoreUpTo(SC_V2) @ConnectivityModuleTest
+    @Test @IgnoreUpTo(Build.VERSION_CODES.S_V2) @ConnectivityModuleTest
     @AppModeFull(reason = "Socket cannot bind in instant app mode")
     public void testFirewallBlockingOemDeny3() {
         doTestFirewallBlocking(FIREWALL_CHAIN_OEM_DENY_3, DENYLIST);
diff --git a/tests/cts/net/src/android/net/cts/DhcpOptionTest.kt b/tests/cts/net/src/android/net/cts/DhcpOptionTest.kt
index 555dd87bc8..a6b4c2e091 100644
--- a/tests/cts/net/src/android/net/cts/DhcpOptionTest.kt
+++ b/tests/cts/net/src/android/net/cts/DhcpOptionTest.kt
@@ -17,10 +17,10 @@
 package android.net.cts
 
 import android.net.DhcpOption
+import android.os.Build
 import androidx.test.filters.SmallTest
 import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
 import com.android.testutils.DevSdkIgnoreRunner
-import com.android.testutils.SC_V2
 import org.junit.Assert.assertArrayEquals
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertNull
@@ -28,7 +28,7 @@ import org.junit.runner.RunWith
 import org.junit.Test
 
 @SmallTest
-@IgnoreUpTo(SC_V2) // TODO: Use to Build.VERSION_CODES.SC_V2 when available
+@IgnoreUpTo(Build.VERSION_CODES.S_V2)
 @RunWith(DevSdkIgnoreRunner::class)
 class DhcpOptionTest {
     private val DHCP_OPTION_TYPE: Byte = 2
diff --git a/tests/cts/net/src/android/net/cts/DnsResolverTest.java b/tests/cts/net/src/android/net/cts/DnsResolverTest.java
index 396f043c1a..28c25c0583 100644
--- a/tests/cts/net/src/android/net/cts/DnsResolverTest.java
+++ b/tests/cts/net/src/android/net/cts/DnsResolverTest.java
@@ -26,7 +26,6 @@ import static android.provider.DeviceConfig.NAMESPACE_CONNECTIVITY;
 import static android.system.OsConstants.ETIMEDOUT;
 
 import static com.android.testutils.Cleanup.testAndCleanup;
-import static com.android.testutils.DevSdkIgnoreRuleKt.SC_V2;
 
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertNotNull;
@@ -44,6 +43,7 @@ import android.net.Network;
 import android.net.NetworkCapabilities;
 import android.net.ParseException;
 import android.net.cts.util.CtsNetUtils;
+import android.os.Build;
 import android.os.CancellationSignal;
 import android.os.Handler;
 import android.os.Looper;
@@ -878,7 +878,7 @@ public class DnsResolverTest {
     }
 
     /** Verifies that DnsResolver.DnsException can be subclassed and its constructor re-used. */
-    @Test @IgnoreUpTo(SC_V2) // TODO: Use to Build.VERSION_CODES.SC_V2 when available
+    @Test @IgnoreUpTo(Build.VERSION_CODES.S_V2)
     public void testDnsExceptionConstructor() throws InterruptedException {
         class TestDnsException extends DnsResolver.DnsException {
             TestDnsException(int code, @Nullable Throwable cause) {
diff --git a/tests/cts/net/src/android/net/cts/DscpPolicyTest.kt b/tests/cts/net/src/android/net/cts/DscpPolicyTest.kt
index 631fdd25ef..3409ecc1a8 100644
--- a/tests/cts/net/src/android/net/cts/DscpPolicyTest.kt
+++ b/tests/cts/net/src/android/net/cts/DscpPolicyTest.kt
@@ -46,6 +46,7 @@ import android.net.TestNetworkInterface
 import android.net.TestNetworkManager
 import android.net.TestNetworkManager.TestInterfaceRequest
 import android.net.cts.util.CtsNetUtils.TestNetworkCallback
+import android.os.Build
 import android.os.Handler
 import android.os.HandlerThread
 import android.os.SystemClock
@@ -115,7 +116,7 @@ private const val IPV6_ADDRESS_WAIT_TIME_MS = 10_000L
 class DscpPolicyTest {
     @JvmField
     @Rule
-    val ignoreRule = DevSdkIgnoreRule(ignoreClassUpTo = SC_V2)
+    val ignoreRule = DevSdkIgnoreRule(ignoreClassUpTo = Build.VERSION_CODES.S_V2)
 
     private val LOCAL_IPV4_ADDRESS = InetAddresses.parseNumericAddress("192.0.2.1")
     private val TEST_TARGET_IPV4_ADDR =
diff --git a/tests/cts/net/src/android/net/cts/EthernetNetworkUpdateRequestTest.java b/tests/cts/net/src/android/net/cts/EthernetNetworkUpdateRequestTest.java
index c8ee0c7202..11ac24b2da 100644
--- a/tests/cts/net/src/android/net/cts/EthernetNetworkUpdateRequestTest.java
+++ b/tests/cts/net/src/android/net/cts/EthernetNetworkUpdateRequestTest.java
@@ -18,8 +18,6 @@ package android.net.cts;
 
 import static android.net.NetworkCapabilities.NET_CAPABILITY_NOT_RESTRICTED;
 
-import static com.android.testutils.DevSdkIgnoreRuleKt.SC_V2;
-
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertNotSame;
 import static org.junit.Assert.assertThrows;
@@ -29,6 +27,7 @@ import android.net.EthernetNetworkUpdateRequest;
 import android.net.IpConfiguration;
 import android.net.NetworkCapabilities;
 import android.net.StaticIpConfiguration;
+import android.os.Build;
 
 import androidx.test.filters.SmallTest;
 
@@ -39,7 +38,7 @@ import org.junit.Test;
 import org.junit.runner.RunWith;
 
 @SmallTest
-@DevSdkIgnoreRule.IgnoreUpTo(SC_V2) // TODO: Use to Build.VERSION_CODES.SC_V2 when available
+@DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.S_V2)
 @RunWith(DevSdkIgnoreRunner.class)
 public class EthernetNetworkUpdateRequestTest {
     private static final NetworkCapabilities DEFAULT_CAPS =
diff --git a/tests/cts/net/src/android/net/cts/Ikev2VpnTest.java b/tests/cts/net/src/android/net/cts/Ikev2VpnTest.java
index 3289385b5d..493cb078c7 100644
--- a/tests/cts/net/src/android/net/cts/Ikev2VpnTest.java
+++ b/tests/cts/net/src/android/net/cts/Ikev2VpnTest.java
@@ -24,7 +24,6 @@ import static android.net.cts.util.CtsNetUtils.TestNetworkCallback;
 import static com.android.compatibility.common.util.SystemUtil.runWithShellPermissionIdentity;
 import static com.android.modules.utils.build.SdkLevel.isAtLeastT;
 import static com.android.modules.utils.build.SdkLevel.isAtLeastU;
-import static com.android.testutils.DevSdkIgnoreRuleKt.SC_V2;
 
 import static org.junit.Assert.assertArrayEquals;
 import static org.junit.Assert.assertEquals;
@@ -369,7 +368,7 @@ public class Ikev2VpnTest {
         }
     }
 
-    @IgnoreUpTo(SC_V2)
+    @IgnoreUpTo(Build.VERSION_CODES.S_V2)
     @Test
     public void testBuildIkev2VpnProfileWithIkeTunnelConnectionParams() throws Exception {
         assumeTrue(mCtsNetUtils.hasIpsecTunnelsFeature());
@@ -664,62 +663,62 @@ public class Ikev2VpnTest {
                         testIpv6Only, requiresValidation, testSessionKey , testIkeTunConnParams)));
     }
 
-    @Test @IgnoreUpTo(SC_V2)
+    @Test @IgnoreUpTo(Build.VERSION_CODES.S_V2)
     public void testStartStopVpnProfileV4() throws Exception {
         doTestStartStopVpnProfile(false /* testIpv6Only */, false /* requiresValidation */,
                 false /* testSessionKey */, false /* testIkeTunConnParams */);
     }
 
-    @Test @IgnoreUpTo(SC_V2)
+    @Test @IgnoreUpTo(Build.VERSION_CODES.S_V2)
     public void testStartStopVpnProfileV4WithValidation() throws Exception {
         doTestStartStopVpnProfile(false /* testIpv6Only */, true /* requiresValidation */,
                 false /* testSessionKey */, false /* testIkeTunConnParams */);
     }
 
-    @Test @IgnoreUpTo(SC_V2)
+    @Test @IgnoreUpTo(Build.VERSION_CODES.S_V2)
     public void testStartStopVpnProfileV6() throws Exception {
         doTestStartStopVpnProfile(true /* testIpv6Only */, false /* requiresValidation */,
                 false /* testSessionKey */, false /* testIkeTunConnParams */);
     }
 
-    @Test @IgnoreUpTo(SC_V2)
+    @Test @IgnoreUpTo(Build.VERSION_CODES.S_V2)
     public void testStartStopVpnProfileV6WithValidation() throws Exception {
         doTestStartStopVpnProfile(true /* testIpv6Only */, true /* requiresValidation */,
                 false /* testSessionKey */, false /* testIkeTunConnParams */);
     }
 
-    @Test @IgnoreUpTo(SC_V2)
+    @Test @IgnoreUpTo(Build.VERSION_CODES.S_V2)
     public void testStartStopVpnProfileIkeTunConnParamsV4() throws Exception {
         doTestStartStopVpnProfile(false /* testIpv6Only */, false /* requiresValidation */,
                 false /* testSessionKey */, true /* testIkeTunConnParams */);
     }
 
-    @Test @IgnoreUpTo(SC_V2)
+    @Test @IgnoreUpTo(Build.VERSION_CODES.S_V2)
     public void testStartStopVpnProfileIkeTunConnParamsV4WithValidation() throws Exception {
         doTestStartStopVpnProfile(false /* testIpv6Only */, true /* requiresValidation */,
                 false /* testSessionKey */, true /* testIkeTunConnParams */);
     }
 
-    @Test @IgnoreUpTo(SC_V2)
+    @Test @IgnoreUpTo(Build.VERSION_CODES.S_V2)
     public void testStartStopVpnProfileIkeTunConnParamsV6() throws Exception {
         doTestStartStopVpnProfile(true /* testIpv6Only */, false /* requiresValidation */,
                 false /* testSessionKey */, true /* testIkeTunConnParams */);
     }
 
-    @Test @IgnoreUpTo(SC_V2)
+    @Test @IgnoreUpTo(Build.VERSION_CODES.S_V2)
     public void testStartStopVpnProfileIkeTunConnParamsV6WithValidation() throws Exception {
         doTestStartStopVpnProfile(true /* testIpv6Only */, true /* requiresValidation */,
                 false /* testSessionKey */, true /* testIkeTunConnParams */);
     }
 
-    @IgnoreUpTo(SC_V2)
+    @IgnoreUpTo(Build.VERSION_CODES.S_V2)
     @Test
     public void testStartProvisionedVpnV4ProfileSession() throws Exception {
         doTestStartStopVpnProfile(false /* testIpv6Only */, false /* requiresValidation */,
                 true /* testSessionKey */, false /* testIkeTunConnParams */);
     }
 
-    @IgnoreUpTo(SC_V2)
+    @IgnoreUpTo(Build.VERSION_CODES.S_V2)
     @Test
     public void testStartProvisionedVpnV6ProfileSession() throws Exception {
         doTestStartStopVpnProfile(true /* testIpv6Only */, false /* requiresValidation */,
diff --git a/tests/cts/net/src/android/net/cts/NetworkStatsManagerTest.java b/tests/cts/net/src/android/net/cts/NetworkStatsManagerTest.java
index eb2dbf7a98..ff43aa072c 100644
--- a/tests/cts/net/src/android/net/cts/NetworkStatsManagerTest.java
+++ b/tests/cts/net/src/android/net/cts/NetworkStatsManagerTest.java
@@ -33,8 +33,6 @@ import static android.net.netstats.NetworkStatsDataMigrationUtils.PREFIX_UID;
 import static android.net.netstats.NetworkStatsDataMigrationUtils.PREFIX_UID_TAG;
 import static android.net.netstats.NetworkStatsDataMigrationUtils.PREFIX_XT;
 
-import static com.android.testutils.DevSdkIgnoreRuleKt.SC_V2;
-
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertNotNull;
@@ -915,7 +913,7 @@ public class NetworkStatsManagerTest {
         }
     }
 
-    @DevSdkIgnoreRule.IgnoreUpTo(SC_V2)
+    @DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.S_V2)
     @Test
     public void testDataMigrationUtils() throws Exception {
         final List<String> prefixes = List.of(PREFIX_UID, PREFIX_XT, PREFIX_UID_TAG);
diff --git a/tests/cts/net/src/android/net/cts/RateLimitTest.java b/tests/cts/net/src/android/net/cts/RateLimitTest.java
index 36b98fc570..bd1698bd8a 100644
--- a/tests/cts/net/src/android/net/cts/RateLimitTest.java
+++ b/tests/cts/net/src/android/net/cts/RateLimitTest.java
@@ -24,7 +24,6 @@ import static androidx.test.InstrumentationRegistry.getContext;
 
 import static com.android.net.module.util.NetworkStackConstants.ETHER_MTU;
 import static com.android.net.module.util.NetworkStackConstants.IPV4_ADDR_ANY;
-import static com.android.testutils.DevSdkIgnoreRuleKt.SC_V2;
 import static com.android.testutils.TestPermissionUtil.runAsShell;
 
 import static org.junit.Assert.assertEquals;
@@ -48,6 +47,7 @@ import android.net.RouteInfo;
 import android.net.TestNetworkInterface;
 import android.net.TestNetworkManager;
 import android.net.TestNetworkSpecifier;
+import android.os.Build;
 import android.os.Handler;
 import android.os.Looper;
 import android.os.SystemClock;
@@ -81,7 +81,7 @@ import java.util.stream.Collectors;
 
 @AppModeFull(reason = "Instant apps cannot access /dev/tun, so createTunInterface fails")
 @RunWith(DevSdkIgnoreRunner.class)
-@DevSdkIgnoreRule.IgnoreUpTo(SC_V2)
+@DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.S_V2)
 public class RateLimitTest {
     // cannot be final as it gets initialized inside ensureKernelConfigLoaded().
     private static HashSet<String> sKernelConfig;
diff --git a/tests/unit/java/android/net/EthernetNetworkUpdateRequestTest.java b/tests/unit/java/android/net/EthernetNetworkUpdateRequestTest.java
index ca9558b7f7..718ca0a73d 100644
--- a/tests/unit/java/android/net/EthernetNetworkUpdateRequestTest.java
+++ b/tests/unit/java/android/net/EthernetNetworkUpdateRequestTest.java
@@ -16,11 +16,12 @@
 
 package android.net;
 
-import static com.android.testutils.DevSdkIgnoreRuleKt.SC_V2;
 import static com.android.testutils.ParcelUtils.assertParcelingIsLossless;
 
 import static org.junit.Assert.assertThrows;
 
+import android.os.Build;
+
 import com.android.testutils.DevSdkIgnoreRule;
 import com.android.testutils.DevSdkIgnoreRunner;
 
@@ -28,7 +29,7 @@ import org.junit.Test;
 import org.junit.runner.RunWith;
 
 @RunWith(DevSdkIgnoreRunner.class)
-@DevSdkIgnoreRule.IgnoreUpTo(SC_V2)
+@DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.S_V2)
 public class EthernetNetworkUpdateRequestTest {
     private IpConfiguration buildIpConfiguration() {
         return new IpConfiguration.Builder().setHttpProxy(
diff --git a/tests/unit/java/android/net/NetworkStatsAccessTest.java b/tests/unit/java/android/net/NetworkStatsAccessTest.java
index 8b86211112..616faeae44 100644
--- a/tests/unit/java/android/net/NetworkStatsAccessTest.java
+++ b/tests/unit/java/android/net/NetworkStatsAccessTest.java
@@ -16,8 +16,6 @@
 
 package android.net;
 
-import static com.android.testutils.DevSdkIgnoreRuleKt.SC_V2;
-
 import static org.junit.Assert.assertEquals;
 import static org.mockito.Mockito.doCallRealMethod;
 import static org.mockito.Mockito.when;
@@ -28,6 +26,7 @@ import android.app.AppOpsManager;
 import android.app.admin.DevicePolicyManager;
 import android.content.Context;
 import android.content.pm.PackageManager;
+import android.os.Build;
 import android.telephony.TelephonyManager;
 
 import androidx.test.filters.SmallTest;
@@ -44,7 +43,7 @@ import org.mockito.MockitoAnnotations;
 
 @RunWith(DevSdkIgnoreRunner.class)
 @SmallTest
-@DevSdkIgnoreRule.IgnoreUpTo(SC_V2) // TODO: Use to Build.VERSION_CODES.SC_V2 when available
+@DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.S_V2)
 public class NetworkStatsAccessTest {
     private static final String TEST_PKG = "com.example.test";
     private static final int TEST_PID = 1234;
diff --git a/tests/unit/java/android/net/NetworkStatsCollectionTest.java b/tests/unit/java/android/net/NetworkStatsCollectionTest.java
index 81557f85c5..1af89adde9 100644
--- a/tests/unit/java/android/net/NetworkStatsCollectionTest.java
+++ b/tests/unit/java/android/net/NetworkStatsCollectionTest.java
@@ -33,7 +33,6 @@ import static android.text.format.DateUtils.HOUR_IN_MILLIS;
 import static android.text.format.DateUtils.MINUTE_IN_MILLIS;
 
 import static com.android.net.module.util.NetworkStatsUtils.multiplySafeByRational;
-import static com.android.testutils.DevSdkIgnoreRuleKt.SC_V2;
 import static com.android.testutils.MiscAsserts.assertThrows;
 
 import static org.junit.Assert.assertArrayEquals;
@@ -44,6 +43,7 @@ import static org.junit.Assert.fail;
 import android.annotation.NonNull;
 import android.content.res.Resources;
 import android.net.NetworkStatsCollection.Key;
+import android.os.Build;
 import android.os.Process;
 import android.os.UserHandle;
 import android.telephony.SubscriptionPlan;
@@ -89,7 +89,7 @@ import java.util.Set;
  */
 @RunWith(DevSdkIgnoreRunner.class)
 @SmallTest
-@DevSdkIgnoreRule.IgnoreUpTo(SC_V2) // TODO: Use to Build.VERSION_CODES.SC_V2 when available
+@DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.S_V2)
 public class NetworkStatsCollectionTest {
     @Rule
     public final DevSdkIgnoreRule ignoreRule = new DevSdkIgnoreRule();
diff --git a/tests/unit/java/android/net/NetworkStatsRecorderTest.java b/tests/unit/java/android/net/NetworkStatsRecorderTest.java
index 7d039b6e02..a0b36bb0e9 100644
--- a/tests/unit/java/android/net/NetworkStatsRecorderTest.java
+++ b/tests/unit/java/android/net/NetworkStatsRecorderTest.java
@@ -27,7 +27,6 @@ import static android.text.format.DateUtils.HOUR_IN_MILLIS;
 import static com.android.server.ConnectivityStatsLog.NETWORK_STATS_RECORDER_FILE_OPERATED__RECORDER_PREFIX__PREFIX_UID;
 import static com.android.server.ConnectivityStatsLog.NETWORK_STATS_RECORDER_FILE_OPERATED__RECORDER_PREFIX__PREFIX_UIDTAG;
 import static com.android.server.ConnectivityStatsLog.NETWORK_STATS_RECORDER_FILE_OPERATED__RECORDER_PREFIX__PREFIX_XT;
-import static com.android.testutils.DevSdkIgnoreRuleKt.SC_V2;
 
 import static org.mockito.Mockito.any;
 import static org.mockito.Mockito.anyLong;
@@ -43,6 +42,7 @@ import android.net.NetworkIdentity;
 import android.net.NetworkIdentitySet;
 import android.net.NetworkStats;
 import android.net.NetworkStatsCollection;
+import android.os.Build;
 import android.os.DropBoxManager;
 
 import androidx.test.filters.SmallTest;
@@ -67,7 +67,7 @@ import java.io.IOException;
 
 @RunWith(DevSdkIgnoreRunner.class)
 @SmallTest
-@DevSdkIgnoreRule.IgnoreUpTo(SC_V2)
+@DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.S_V2)
 public final class NetworkStatsRecorderTest {
     private static final String TAG = NetworkStatsRecorderTest.class.getSimpleName();
 
diff --git a/tests/unit/java/android/net/netstats/NetworkStatsDataMigrationUtilsTest.kt b/tests/unit/java/android/net/netstats/NetworkStatsDataMigrationUtilsTest.kt
index aa5a246aba..8da680a77c 100644
--- a/tests/unit/java/android/net/netstats/NetworkStatsDataMigrationUtilsTest.kt
+++ b/tests/unit/java/android/net/netstats/NetworkStatsDataMigrationUtilsTest.kt
@@ -17,12 +17,12 @@
 package android.net.netstats
 
 import android.net.NetworkStatsCollection
+import android.os.Build
 import androidx.test.InstrumentationRegistry
 import androidx.test.filters.SmallTest
 import com.android.frameworks.tests.net.R
 import com.android.testutils.DevSdkIgnoreRule
 import com.android.testutils.DevSdkIgnoreRunner
-import com.android.testutils.SC_V2
 import org.junit.Before
 import org.junit.Test
 import org.junit.runner.RunWith
@@ -37,7 +37,7 @@ private const val BUCKET_DURATION_MS = 2 * 60 * 60 * 1000L
 
 @RunWith(DevSdkIgnoreRunner::class)
 @SmallTest
-@DevSdkIgnoreRule.IgnoreUpTo(SC_V2) // TODO: Use to Build.VERSION_CODES.SC_V2 when available
+@DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.S_V2)
 class NetworkStatsDataMigrationUtilsTest {
     @Before
     fun setup() {
diff --git a/tests/unit/java/com/android/server/ConnectivityServiceTest.java b/tests/unit/java/com/android/server/ConnectivityServiceTest.java
index b144cd17a3..c519f714f5 100755
--- a/tests/unit/java/com/android/server/ConnectivityServiceTest.java
+++ b/tests/unit/java/com/android/server/ConnectivityServiceTest.java
@@ -179,7 +179,6 @@ import static com.android.testutils.ConcurrentUtils.await;
 import static com.android.testutils.ConcurrentUtils.durationOf;
 import static com.android.testutils.DevSdkIgnoreRule.IgnoreAfter;
 import static com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo;
-import static com.android.testutils.DevSdkIgnoreRuleKt.SC_V2;
 import static com.android.testutils.FunctionalUtils.ignoreExceptions;
 import static com.android.testutils.HandlerUtils.visibleOnHandlerThread;
 import static com.android.testutils.HandlerUtils.waitForIdleSerialExecutor;
@@ -10606,7 +10605,7 @@ public class ConnectivityServiceTest {
         reset(mBpfNetMaps);
     }
 
-    @Test @IgnoreUpTo(SC_V2)
+    @Test @IgnoreUpTo(Build.VERSION_CODES.S_V2)
     public void testSetUidFirewallRule() throws Exception {
         doTestSetUidFirewallRule(FIREWALL_CHAIN_DOZABLE, FIREWALL_RULE_DENY);
         doTestSetUidFirewallRule(FIREWALL_CHAIN_STANDBY, FIREWALL_RULE_ALLOW);
@@ -10625,7 +10624,7 @@ public class ConnectivityServiceTest {
         doTestSetUidFirewallRule(FIREWALL_CHAIN_METERED_DENY_ADMIN, FIREWALL_RULE_ALLOW);
     }
 
-    @Test @IgnoreUpTo(SC_V2)
+    @Test @IgnoreUpTo(Build.VERSION_CODES.S_V2)
     public void testSetFirewallChainEnabled() throws Exception {
         final List<Integer> firewallChains = new ArrayList<>(Arrays.asList(
                 FIREWALL_CHAIN_DOZABLE,
@@ -10704,7 +10703,7 @@ public class ConnectivityServiceTest {
         reset(mBpfNetMaps);
     }
 
-    @Test @IgnoreUpTo(SC_V2)
+    @Test @IgnoreUpTo(Build.VERSION_CODES.S_V2)
     public void testReplaceFirewallChain() {
         doTestReplaceFirewallChain(FIREWALL_CHAIN_DOZABLE);
         doTestReplaceFirewallChain(FIREWALL_CHAIN_STANDBY);
@@ -10720,7 +10719,7 @@ public class ConnectivityServiceTest {
         doTestReplaceFirewallChain(FIREWALL_CHAIN_OEM_DENY_3);
     }
 
-    @Test @IgnoreUpTo(SC_V2)
+    @Test @IgnoreUpTo(Build.VERSION_CODES.S_V2)
     public void testInvalidFirewallChain() throws Exception {
         final int uid = 1001;
         final Class<IllegalArgumentException> expected = IllegalArgumentException.class;
@@ -10730,7 +10729,7 @@ public class ConnectivityServiceTest {
                 () -> mCm.setUidFirewallRule(100 /* chain */, uid, FIREWALL_RULE_ALLOW));
     }
 
-    @Test @IgnoreUpTo(SC_V2)
+    @Test @IgnoreUpTo(Build.VERSION_CODES.S_V2)
     public void testInvalidFirewallRule() throws Exception {
         final Class<IllegalArgumentException> expected = IllegalArgumentException.class;
         assertThrows(expected,
@@ -13956,7 +13955,7 @@ public class ConnectivityServiceTest {
                         && session.getSessionType() == QosSession.TYPE_NR_BEARER));
     }
 
-    @Test @IgnoreUpTo(SC_V2)
+    @Test @IgnoreUpTo(Build.VERSION_CODES.S_V2)
     public void testQosCallbackAvailableOnValidationError() throws Exception {
         mQosCallbackMockHelper = new QosCallbackMockHelper();
         final NetworkAgentWrapper wrapper = mQosCallbackMockHelper.mAgentWrapper;
@@ -13992,7 +13991,7 @@ public class ConnectivityServiceTest {
                 .onError(eq(QosCallbackException.EX_TYPE_FILTER_SOCKET_REMOTE_ADDRESS_CHANGED));
     }
 
-    @Test @IgnoreUpTo(SC_V2)
+    @Test @IgnoreUpTo(Build.VERSION_CODES.S_V2)
     public void testQosCallbackLostOnValidationError() throws Exception {
         mQosCallbackMockHelper = new QosCallbackMockHelper();
         final int sessionId = 10;
@@ -18485,7 +18484,7 @@ public class ConnectivityServiceTest {
                 null /* callingAttributionTag */));
     }
 
-    @Test @IgnoreUpTo(SC_V2)
+    @Test @IgnoreUpTo(Build.VERSION_CODES.S_V2)
     public void testUpdateRateLimit_EnableDisable() throws Exception {
         final LinkProperties wifiLp = new LinkProperties();
         wifiLp.setInterfaceName(WIFI_IFNAME);
@@ -18524,7 +18523,7 @@ public class ConnectivityServiceTest {
                 it -> it.first == cellLp.getInterfaceName() && it.second == -1));
     }
 
-    @Test @IgnoreUpTo(SC_V2)
+    @Test @IgnoreUpTo(Build.VERSION_CODES.S_V2)
     public void testUpdateRateLimit_WhenNewNetworkIsAdded() throws Exception {
         final LinkProperties wifiLp = new LinkProperties();
         wifiLp.setInterfaceName(WIFI_IFNAME);
@@ -18550,7 +18549,7 @@ public class ConnectivityServiceTest {
                 && it.second == rateLimitInBytesPerSec));
     }
 
-    @Test @IgnoreUpTo(SC_V2)
+    @Test @IgnoreUpTo(Build.VERSION_CODES.S_V2)
     public void testUpdateRateLimit_OnlyAffectsInternetCapableNetworks() throws Exception {
         final LinkProperties wifiLp = new LinkProperties();
         wifiLp.setInterfaceName(WIFI_IFNAME);
@@ -18568,7 +18567,7 @@ public class ConnectivityServiceTest {
         assertNull(readHeadWifi.poll(TIMEOUT_MS, it -> it.first == wifiLp.getInterfaceName()));
     }
 
-    @Test @IgnoreUpTo(SC_V2)
+    @Test @IgnoreUpTo(Build.VERSION_CODES.S_V2)
     public void testUpdateRateLimit_DisconnectingResetsRateLimit()
             throws Exception {
         // Steps:
@@ -18604,7 +18603,7 @@ public class ConnectivityServiceTest {
         assertNull(readHeadWifi.poll(TIMEOUT_MS, it -> it.first == wifiLp.getInterfaceName()));
     }
 
-    @Test @IgnoreUpTo(SC_V2)
+    @Test @IgnoreUpTo(Build.VERSION_CODES.S_V2)
     public void testUpdateRateLimit_UpdateExistingRateLimit() throws Exception {
         final LinkProperties wifiLp = new LinkProperties();
         wifiLp.setInterfaceName(WIFI_IFNAME);
@@ -18634,7 +18633,7 @@ public class ConnectivityServiceTest {
                         && it.second == 2000));
     }
 
-    @Test @IgnoreAfter(SC_V2)
+    @Test @IgnoreAfter(Build.VERSION_CODES.S_V2)
     public void testUpdateRateLimit_DoesNothingBeforeT() throws Exception {
         final LinkProperties wifiLp = new LinkProperties();
         wifiLp.setInterfaceName(WIFI_IFNAME);
diff --git a/tests/unit/java/com/android/server/connectivity/MultipathPolicyTrackerTest.java b/tests/unit/java/com/android/server/connectivity/MultipathPolicyTrackerTest.java
index d1bf40ed56..dd4e606028 100644
--- a/tests/unit/java/com/android/server/connectivity/MultipathPolicyTrackerTest.java
+++ b/tests/unit/java/com/android/server/connectivity/MultipathPolicyTrackerTest.java
@@ -27,7 +27,6 @@ import static android.provider.Settings.Global.NETWORK_DEFAULT_DAILY_MULTIPATH_Q
 
 import static com.android.server.net.NetworkPolicyManagerInternal.QUOTA_TYPE_MULTIPATH;
 import static com.android.server.net.NetworkPolicyManagerService.OPPORTUNISTIC_QUOTA_UNKNOWN;
-import static com.android.testutils.DevSdkIgnoreRuleKt.SC_V2;
 
 import static org.junit.Assert.assertNotNull;
 import static org.mockito.ArgumentMatchers.any;
@@ -406,7 +405,7 @@ public class MultipathPolicyTrackerTest {
                 any(), eq(DataUnit.MEGABYTES.toBytes(14)), any(), any());
     }
 
-    @DevSdkIgnoreRule.IgnoreUpTo(SC_V2)
+    @DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.S_V2)
     @Test
     public void testOnThresholdReached() {
         prepareGetMultipathPreferenceTest(
diff --git a/tests/unit/java/com/android/server/connectivity/mdns/ConnectivityMonitorWithConnectivityManagerTests.java b/tests/unit/java/com/android/server/connectivity/mdns/ConnectivityMonitorWithConnectivityManagerTests.java
index fa175b58d4..96951e7bf0 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/ConnectivityMonitorWithConnectivityManagerTests.java
+++ b/tests/unit/java/com/android/server/connectivity/mdns/ConnectivityMonitorWithConnectivityManagerTests.java
@@ -19,8 +19,6 @@ package com.android.server.connectivity.mdns;
 import static android.net.InetAddresses.parseNumericAddress;
 import static android.net.RouteInfo.RTN_UNICAST;
 
-import static com.android.testutils.DevSdkIgnoreRuleKt.SC_V2;
-
 import static org.junit.Assert.assertEquals;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.Mockito.doReturn;
@@ -37,6 +35,7 @@ import android.net.LinkProperties;
 import android.net.Network;
 import android.net.NetworkRequest;
 import android.net.RouteInfo;
+import android.os.Build;
 
 import com.android.net.module.util.SharedLog;
 import com.android.testutils.DevSdkIgnoreRule;
@@ -55,7 +54,7 @@ import java.util.List;
 
 /** Tests for {@link ConnectivityMonitor}. */
 @RunWith(DevSdkIgnoreRunner.class)
-@DevSdkIgnoreRule.IgnoreUpTo(SC_V2)
+@DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.S_V2)
 public class ConnectivityMonitorWithConnectivityManagerTests {
     @Mock private Context mContext;
     @Mock private ConnectivityMonitor.Listener mockListener;
diff --git a/tests/unit/java/com/android/server/connectivity/mdns/MdnsDiscoveryManagerTests.java b/tests/unit/java/com/android/server/connectivity/mdns/MdnsDiscoveryManagerTests.java
index 758b8222f0..6cf5e84fb2 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/MdnsDiscoveryManagerTests.java
+++ b/tests/unit/java/com/android/server/connectivity/mdns/MdnsDiscoveryManagerTests.java
@@ -16,8 +16,6 @@
 
 package com.android.server.connectivity.mdns;
 
-import static com.android.testutils.DevSdkIgnoreRuleKt.SC_V2;
-
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.fail;
 import static org.mockito.ArgumentMatchers.any;
@@ -31,6 +29,7 @@ import static org.mockito.Mockito.when;
 
 import android.annotation.NonNull;
 import android.net.Network;
+import android.os.Build;
 import android.os.Handler;
 import android.os.HandlerThread;
 import android.text.TextUtils;
@@ -61,7 +60,7 @@ import java.util.concurrent.ScheduledExecutorService;
 /** Tests for {@link MdnsDiscoveryManager}. */
 @DevSdkIgnoreRunner.MonitorThreadLeak
 @RunWith(DevSdkIgnoreRunner.class)
-@DevSdkIgnoreRule.IgnoreUpTo(SC_V2)
+@DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.S_V2)
 public class MdnsDiscoveryManagerTests {
     private static final long DEFAULT_TIMEOUT = 2000L;
     private static final String SERVICE_TYPE_1 = "_googlecast._tcp.local";
diff --git a/tests/unit/java/com/android/server/connectivity/mdns/MdnsPacketReaderTests.java b/tests/unit/java/com/android/server/connectivity/mdns/MdnsPacketReaderTests.java
index 0168b61009..ee141d30ca 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/MdnsPacketReaderTests.java
+++ b/tests/unit/java/com/android/server/connectivity/mdns/MdnsPacketReaderTests.java
@@ -16,12 +16,12 @@
 
 package com.android.server.connectivity.mdns;
 
-import static com.android.testutils.DevSdkIgnoreRuleKt.SC_V2;
-
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertThrows;
 import static org.junit.Assert.fail;
 
+import android.os.Build;
+
 import com.android.net.module.util.HexDump;
 import com.android.testutils.DevSdkIgnoreRule;
 import com.android.testutils.DevSdkIgnoreRunner;
@@ -34,7 +34,7 @@ import java.net.DatagramPacket;
 import java.util.Locale;
 
 @RunWith(DevSdkIgnoreRunner.class)
-@DevSdkIgnoreRule.IgnoreUpTo(SC_V2)
+@DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.S_V2)
 public class MdnsPacketReaderTests {
 
     @Test
diff --git a/tests/unit/java/com/android/server/connectivity/mdns/MdnsRecordTests.java b/tests/unit/java/com/android/server/connectivity/mdns/MdnsRecordTests.java
index aeb1966a3a..789a9bd3ab 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/MdnsRecordTests.java
+++ b/tests/unit/java/com/android/server/connectivity/mdns/MdnsRecordTests.java
@@ -17,7 +17,6 @@
 package com.android.server.connectivity.mdns;
 
 import static com.android.server.connectivity.mdns.MdnsConstants.QCLASS_INTERNET;
-import static com.android.testutils.DevSdkIgnoreRuleKt.SC_V2;
 
 import static org.junit.Assert.assertArrayEquals;
 import static org.junit.Assert.assertEquals;
@@ -30,6 +29,7 @@ import static org.junit.Assert.assertTrue;
 
 import static java.util.Collections.emptyList;
 
+import android.os.Build;
 import android.util.Log;
 
 import com.android.net.module.util.HexDump;
@@ -51,7 +51,7 @@ import java.util.List;
 // The record test data does not use compressed names (label pointers), since that would require
 // additional data to populate the label dictionary accordingly.
 @RunWith(DevSdkIgnoreRunner.class)
-@DevSdkIgnoreRule.IgnoreUpTo(SC_V2)
+@DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.S_V2)
 public class MdnsRecordTests {
     private static final String TAG = "MdnsRecordTests";
     private static final int MAX_PACKET_SIZE = 4096;
diff --git a/tests/unit/java/com/android/server/connectivity/mdns/MdnsResponseDecoderTests.java b/tests/unit/java/com/android/server/connectivity/mdns/MdnsResponseDecoderTests.java
index ad0f7efc8d..0c288bcad9 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/MdnsResponseDecoderTests.java
+++ b/tests/unit/java/com/android/server/connectivity/mdns/MdnsResponseDecoderTests.java
@@ -19,7 +19,6 @@ package com.android.server.connectivity.mdns;
 import static android.net.InetAddresses.parseNumericAddress;
 
 import static com.android.server.connectivity.mdns.util.MdnsUtils.Clock;
-import static com.android.testutils.DevSdkIgnoreRuleKt.SC_V2;
 
 import static org.junit.Assert.assertArrayEquals;
 import static org.junit.Assert.assertEquals;
@@ -32,6 +31,7 @@ import static org.mockito.Mockito.doReturn;
 import static org.mockito.Mockito.mock;
 
 import android.net.Network;
+import android.os.Build;
 import android.util.ArraySet;
 
 import com.android.net.module.util.HexDump;
@@ -57,7 +57,7 @@ import java.util.List;
 import java.util.stream.Collectors;
 
 @RunWith(DevSdkIgnoreRunner.class)
-@DevSdkIgnoreRule.IgnoreUpTo(SC_V2)
+@DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.S_V2)
 public class MdnsResponseDecoderTests {
     private static final byte[] data = HexDump.hexStringToByteArray(
             "0000840000000004"
diff --git a/tests/unit/java/com/android/server/connectivity/mdns/MdnsResponseTests.java b/tests/unit/java/com/android/server/connectivity/mdns/MdnsResponseTests.java
index 3e189f12fc..0b5fe91e61 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/MdnsResponseTests.java
+++ b/tests/unit/java/com/android/server/connectivity/mdns/MdnsResponseTests.java
@@ -18,8 +18,6 @@ package com.android.server.connectivity.mdns;
 
 import static android.net.InetAddresses.parseNumericAddress;
 
-import static com.android.testutils.DevSdkIgnoreRuleKt.SC_V2;
-
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertNotNull;
@@ -30,6 +28,7 @@ import static org.mockito.Mockito.mock;
 import static java.util.Collections.emptyList;
 
 import android.net.Network;
+import android.os.Build;
 
 import com.android.net.module.util.HexDump;
 import com.android.testutils.DevSdkIgnoreRule;
@@ -45,7 +44,7 @@ import java.util.List;
 // The record test data does not use compressed names (label pointers), since that would require
 // additional data to populate the label dictionary accordingly.
 @RunWith(DevSdkIgnoreRunner.class)
-@DevSdkIgnoreRule.IgnoreUpTo(SC_V2)
+@DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.S_V2)
 public class MdnsResponseTests {
     private static final String TAG = "MdnsResponseTests";
     // MDNS response packet for name "test" with an IPv4 address of 10.1.2.3
diff --git a/tests/unit/java/com/android/server/connectivity/mdns/MdnsServiceInfoTest.java b/tests/unit/java/com/android/server/connectivity/mdns/MdnsServiceInfoTest.java
index d3989e3123..23553829d4 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/MdnsServiceInfoTest.java
+++ b/tests/unit/java/com/android/server/connectivity/mdns/MdnsServiceInfoTest.java
@@ -17,7 +17,6 @@
 package com.android.server.connectivity.mdns;
 
 import static com.android.server.connectivity.mdns.MdnsSocket.INTERFACE_INDEX_UNSPECIFIED;
-import static com.android.testutils.DevSdkIgnoreRuleKt.SC_V2;
 
 import static org.junit.Assert.assertArrayEquals;
 import static org.junit.Assert.assertEquals;
@@ -26,6 +25,7 @@ import static org.junit.Assert.assertTrue;
 import static org.mockito.Mockito.mock;
 
 import android.net.Network;
+import android.os.Build;
 import android.os.Parcel;
 
 import com.android.server.connectivity.mdns.MdnsServiceInfo.TextEntry;
@@ -39,7 +39,7 @@ import java.time.Instant;
 import java.util.List;
 
 @RunWith(DevSdkIgnoreRunner.class)
-@DevSdkIgnoreRule.IgnoreUpTo(SC_V2)
+@DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.S_V2)
 public class MdnsServiceInfoTest {
     @Test
     public void constructor_createWithTextEntries_correctAttributes() {
diff --git a/tests/unit/java/com/android/server/connectivity/mdns/MdnsServiceTypeClientTests.java b/tests/unit/java/com/android/server/connectivity/mdns/MdnsServiceTypeClientTests.java
index 39e08d06da..27ea3fcb14 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/MdnsServiceTypeClientTests.java
+++ b/tests/unit/java/com/android/server/connectivity/mdns/MdnsServiceTypeClientTests.java
@@ -26,7 +26,6 @@ import static com.android.server.connectivity.mdns.MdnsServiceTypeClient.EVENT_Q
 import static com.android.server.connectivity.mdns.MdnsServiceTypeClient.EVENT_REMOVE_EXPIRED_SERVICES;
 import static com.android.server.connectivity.mdns.MdnsServiceTypeClient.EVENT_START_QUERYTASK;
 import static com.android.server.connectivity.mdns.MdnsServiceTypeClient.REMOVE_SERVICE_AFTER_QUERY_SENT_TIME;
-import static com.android.testutils.DevSdkIgnoreRuleKt.SC_V2;
 
 import static org.junit.Assert.assertArrayEquals;
 import static org.junit.Assert.assertEquals;
@@ -57,6 +56,7 @@ import android.annotation.NonNull;
 import android.annotation.Nullable;
 import android.net.InetAddresses;
 import android.net.Network;
+import android.os.Build;
 import android.os.Handler;
 import android.os.HandlerThread;
 import android.os.Message;
@@ -101,7 +101,7 @@ import java.util.stream.Stream;
 /** Tests for {@link MdnsServiceTypeClient}. */
 @DevSdkIgnoreRunner.MonitorThreadLeak
 @RunWith(DevSdkIgnoreRunner.class)
-@DevSdkIgnoreRule.IgnoreUpTo(SC_V2)
+@DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.S_V2)
 public class MdnsServiceTypeClientTests {
     private static final int INTERFACE_INDEX = 999;
     private static final long DEFAULT_TIMEOUT = 2000L;
diff --git a/tests/unit/java/com/android/server/connectivity/mdns/MdnsSocketClientTests.java b/tests/unit/java/com/android/server/connectivity/mdns/MdnsSocketClientTests.java
index 6c128804e8..3d48302265 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/MdnsSocketClientTests.java
+++ b/tests/unit/java/com/android/server/connectivity/mdns/MdnsSocketClientTests.java
@@ -17,7 +17,6 @@
 package com.android.server.connectivity.mdns;
 
 import static com.android.testutils.Cleanup.testAndCleanup;
-import static com.android.testutils.DevSdkIgnoreRuleKt.SC_V2;
 
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertNull;
@@ -44,6 +43,7 @@ import android.net.ConnectivityManager;
 import android.net.InetAddresses;
 import android.net.wifi.WifiManager;
 import android.net.wifi.WifiManager.MulticastLock;
+import android.os.Build;
 import android.text.format.DateUtils;
 import android.util.Log;
 
@@ -75,7 +75,7 @@ import java.util.concurrent.atomic.AtomicBoolean;
 
 /** Tests for {@link MdnsSocketClient} */
 @RunWith(DevSdkIgnoreRunner.class)
-@DevSdkIgnoreRule.IgnoreUpTo(SC_V2)
+@DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.S_V2)
 public class MdnsSocketClientTests {
     private static final long TIMEOUT = 500;
     private final byte[] buf = new byte[10];
diff --git a/tests/unit/java/com/android/server/connectivity/mdns/MdnsSocketTests.java b/tests/unit/java/com/android/server/connectivity/mdns/MdnsSocketTests.java
index 58096844cc..71779afe29 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/MdnsSocketTests.java
+++ b/tests/unit/java/com/android/server/connectivity/mdns/MdnsSocketTests.java
@@ -16,11 +16,11 @@
 
 package com.android.server.connectivity.mdns;
 
-import static com.android.testutils.DevSdkIgnoreRuleKt.SC_V2;
-
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
+import android.os.Build;
+
 import com.android.net.module.util.SharedLog;
 import com.android.testutils.DevSdkIgnoreRule;
 import com.android.testutils.DevSdkIgnoreRunner;
@@ -45,7 +45,7 @@ import java.util.Collections;
 
 /** Tests for {@link MdnsSocket}. */
 @RunWith(DevSdkIgnoreRunner.class)
-@DevSdkIgnoreRule.IgnoreUpTo(SC_V2)
+@DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.S_V2)
 public class MdnsSocketTests {
 
     @Mock private NetworkInterfaceWrapper mockNetworkInterfaceWrapper;
diff --git a/tests/unit/java/com/android/server/connectivity/mdns/MulticastNetworkInterfaceProviderTests.java b/tests/unit/java/com/android/server/connectivity/mdns/MulticastNetworkInterfaceProviderTests.java
index d36ab6cb57..86fbf6b517 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/MulticastNetworkInterfaceProviderTests.java
+++ b/tests/unit/java/com/android/server/connectivity/mdns/MulticastNetworkInterfaceProviderTests.java
@@ -16,8 +16,6 @@
 
 package com.android.server.connectivity.mdns;
 
-import static com.android.testutils.DevSdkIgnoreRuleKt.SC_V2;
-
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertTrue;
@@ -27,6 +25,7 @@ import static org.mockito.Mockito.when;
 
 import android.annotation.NonNull;
 import android.content.Context;
+import android.os.Build;
 
 import androidx.test.InstrumentationRegistry;
 
@@ -53,7 +52,7 @@ import java.util.List;
 
 /** Tests for {@link MulticastNetworkInterfaceProvider}. */
 @RunWith(DevSdkIgnoreRunner.class)
-@DevSdkIgnoreRule.IgnoreUpTo(SC_V2)
+@DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.S_V2)
 public class MulticastNetworkInterfaceProviderTests {
 
     @Mock private NetworkInterfaceWrapper loopbackInterface;
diff --git a/tests/unit/java/com/android/server/net/NetworkStatsFactoryTest.java b/tests/unit/java/com/android/server/net/NetworkStatsFactoryTest.java
index 89acf69c4f..5099d19914 100644
--- a/tests/unit/java/com/android/server/net/NetworkStatsFactoryTest.java
+++ b/tests/unit/java/com/android/server/net/NetworkStatsFactoryTest.java
@@ -33,7 +33,6 @@ import static android.net.NetworkStats.UID_ALL;
 import static com.android.server.net.NetworkStatsFactory.CONFIG_PER_UID_TAG_THROTTLING;
 import static com.android.server.net.NetworkStatsFactory.CONFIG_PER_UID_TAG_THROTTLING_THRESHOLD;
 import static com.android.server.net.NetworkStatsFactory.kernelToTag;
-import static com.android.testutils.DevSdkIgnoreRuleKt.SC_V2;
 
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.fail;
@@ -48,6 +47,7 @@ import android.content.Context;
 import android.net.NetworkStats;
 import android.net.TrafficStats;
 import android.net.UnderlyingNetworkInfo;
+import android.os.Build;
 import android.os.SystemClock;
 
 import androidx.test.InstrumentationRegistry;
@@ -80,7 +80,7 @@ import java.util.HashMap;
 /** Tests for {@link NetworkStatsFactory}. */
 @RunWith(DevSdkIgnoreRunner.class)
 @SmallTest
-@DevSdkIgnoreRule.IgnoreUpTo(SC_V2)
+@DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.S_V2)
 public class NetworkStatsFactoryTest extends NetworkStatsBaseTest {
     private static final String CLAT_PREFIX = "v4-";
     private static final int TEST_TAGS_PER_UID_THRESHOLD = 10;
diff --git a/tests/unit/java/com/android/server/net/NetworkStatsObserversTest.java b/tests/unit/java/com/android/server/net/NetworkStatsObserversTest.java
index a534c22410..10b1396071 100644
--- a/tests/unit/java/com/android/server/net/NetworkStatsObserversTest.java
+++ b/tests/unit/java/com/android/server/net/NetworkStatsObserversTest.java
@@ -30,8 +30,6 @@ import static android.net.NetworkTemplate.MATCH_WIFI;
 import static android.net.TrafficStats.MB_IN_BYTES;
 import static android.text.format.DateUtils.MINUTE_IN_MILLIS;
 
-import static com.android.testutils.DevSdkIgnoreRuleKt.SC_V2;
-
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertThrows;
 import static org.junit.Assert.assertTrue;
@@ -45,6 +43,7 @@ import android.net.NetworkIdentitySet;
 import android.net.NetworkStats;
 import android.net.NetworkStatsAccess;
 import android.net.NetworkTemplate;
+import android.os.Build;
 import android.os.HandlerThread;
 import android.os.IBinder;
 import android.os.Looper;
@@ -76,7 +75,7 @@ import java.util.Set;
  */
 @RunWith(DevSdkIgnoreRunner.class)
 @SmallTest
-@DevSdkIgnoreRule.IgnoreUpTo(SC_V2) // TODO: Use to Build.VERSION_CODES.SC_V2 when available
+@DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.S_V2)
 public class NetworkStatsObserversTest {
     private static final String TEST_IFACE = "test0";
     private static final String TEST_IFACE2 = "test1";
diff --git a/tests/unit/java/com/android/server/net/NetworkStatsServiceTest.java b/tests/unit/java/com/android/server/net/NetworkStatsServiceTest.java
index 1ce8ffcce5..de54e8d145 100644
--- a/tests/unit/java/com/android/server/net/NetworkStatsServiceTest.java
+++ b/tests/unit/java/com/android/server/net/NetworkStatsServiceTest.java
@@ -79,7 +79,6 @@ import static com.android.server.net.NetworkStatsService.NETSTATS_IMPORT_FALLBAC
 import static com.android.server.net.NetworkStatsService.NETSTATS_IMPORT_SUCCESSES_COUNTER_NAME;
 import static com.android.server.net.NetworkStatsService.TRAFFICSTATS_CLIENT_RATE_LIMIT_CACHE_ENABLED_FLAG;
 import static com.android.server.net.NetworkStatsService.TRAFFICSTATS_SERVICE_RATE_LIMIT_CACHE_ENABLED_FLAG;
-import static com.android.testutils.DevSdkIgnoreRuleKt.SC_V2;
 
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
@@ -224,7 +223,7 @@ import java.util.function.Consumer;
 @RunWith(DevSdkIgnoreRunner.class)
 @SmallTest
 // NetworkStatsService is not updatable before T, so tests do not need to be backwards compatible
-@DevSdkIgnoreRule.IgnoreUpTo(SC_V2)
+@DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.S_V2)
 public class NetworkStatsServiceTest extends NetworkStatsBaseTest {
     @Rule
     public final DevSdkIgnoreRule ignoreRule = new DevSdkIgnoreRule();
diff --git a/tests/unit/java/com/android/server/net/NetworkStatsSubscriptionsMonitorTest.java b/tests/unit/java/com/android/server/net/NetworkStatsSubscriptionsMonitorTest.java
index 622f2be4be..9c432ae3fe 100644
--- a/tests/unit/java/com/android/server/net/NetworkStatsSubscriptionsMonitorTest.java
+++ b/tests/unit/java/com/android/server/net/NetworkStatsSubscriptionsMonitorTest.java
@@ -19,8 +19,6 @@ package com.android.server.net;
 import static android.telephony.TelephonyDisplayInfo.OVERRIDE_NETWORK_TYPE_NONE;
 import static android.telephony.TelephonyDisplayInfo.OVERRIDE_NETWORK_TYPE_NR_NSA;
 
-import static com.android.testutils.DevSdkIgnoreRuleKt.SC_V2;
-
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.fail;
@@ -39,6 +37,7 @@ import android.annotation.NonNull;
 import android.annotation.Nullable;
 import android.app.usage.NetworkStatsManager;
 import android.content.Context;
+import android.os.Build;
 import android.os.Looper;
 import android.os.Parcel;
 import android.telephony.SubscriptionManager;
@@ -64,7 +63,7 @@ import java.util.concurrent.Executor;
 import java.util.concurrent.Executors;
 
 @RunWith(DevSdkIgnoreRunner.class)
-@DevSdkIgnoreRule.IgnoreUpTo(SC_V2)
+@DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.S_V2)
 public final class NetworkStatsSubscriptionsMonitorTest {
     private static final int TEST_SUBID1 = 3;
     private static final int TEST_SUBID2 = 5;
diff --git a/tests/unit/java/com/android/server/net/PersistentIntTest.kt b/tests/unit/java/com/android/server/net/PersistentIntTest.kt
index 92683525ed..5f07e5b6df 100644
--- a/tests/unit/java/com/android/server/net/PersistentIntTest.kt
+++ b/tests/unit/java/com/android/server/net/PersistentIntTest.kt
@@ -16,10 +16,10 @@
 
 package com.android.server.net
 
+import android.os.Build
 import android.util.SystemConfigFileCommitEventLogger
 import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
 import com.android.testutils.DevSdkIgnoreRunner
-import com.android.testutils.SC_V2
 import com.android.testutils.assertThrows
 import org.junit.After
 import org.junit.Before
@@ -37,7 +37,7 @@ import java.util.Random
 import kotlin.test.assertEquals
 
 @RunWith(DevSdkIgnoreRunner::class)
-@IgnoreUpTo(SC_V2)
+@IgnoreUpTo(Build.VERSION_CODES.S_V2)
 class PersistentIntTest {
     val tempFilesCreated = mutableSetOf<Path>()
     lateinit var tempDir: Path

From 87df372535cb8bb71111ca9303208f97c5d9a3e8 Mon Sep 17 00:00:00 2001
From: Chalard Jean <jchalard@google.com>
Date: Fri, 9 May 2025 13:19:11 +0900
Subject: [PATCH 250/377] Don't warn in tests for deprecation

This change removes hundreds of lines of useless warnings, since
tests must check the continued working of old and deprecated methods.

Test: build manually and observe the warnings are gone
Flag: EXEMPT test-only
Change-Id: Ie50b2f35b09041e8e201b30b1e575e66e045bc44
---
 tests/common/Android.bp | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/tests/common/Android.bp b/tests/common/Android.bp
index 60a02fb7be..1600a6a0ec 100644
--- a/tests/common/Android.bp
+++ b/tests/common/Android.bp
@@ -155,6 +155,9 @@ java_defaults {
         // if sdk_version="" this gets automatically included, but here we need to add manually.
         "framework-res",
     ],
+    // Tests must check a large number of deprecated methods and warning about it
+    // sends hundreds of warning lines flooding the useful warnings.
+    kotlincflags: ["-Xsuppress-warning=DEPRECATION"],
 }
 
 // defaults for tests that need to build against framework-connectivity's @hide APIs, but also
@@ -178,6 +181,9 @@ java_defaults {
         // if sdk_version="" this gets automatically included, but here we need to add manually.
         "framework-res",
     ],
+    // Tests must check a large number of deprecated methods and warning about it
+    // sends hundreds of warning lines flooding the useful warnings.
+    kotlincflags: ["-Xsuppress-warning=DEPRECATION"],
     defaults_visibility: ["//packages/modules/Connectivity/tests:__subpackages__"],
 }
 

From ebaef1230baf06c84bcfc33faff7d2636727b110 Mon Sep 17 00:00:00 2001
From: Chalard Jean <jchalard@google.com>
Date: Fri, 9 May 2025 13:20:31 +0900
Subject: [PATCH 251/377] Don't ignore exceptions in
 NsdManagerDownstreamTetheringTest

tryTest{} catches and returns and must be ended with a cleanup{}
block to throw. That is why it's marked with @CheckReturnValue.
The IDE marks the entire block as a huge warning.

Ideally this should really be an error, but that flag only exists
in Kotlin 2.2 and above, which is not out of beta yet, so
add a TODO in the bp file

Test: NsdManagerDownstreamTetheringTest
Flag: EXEMPT test-only
Change-Id: I62a9d0a16926574eb286d45b61d4d5d2e8c870ab
---
 tests/common/Android.bp                                       | 2 ++
 .../src/android/net/cts/NsdManagerDownstreamTetheringTest.kt  | 4 ++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/tests/common/Android.bp b/tests/common/Android.bp
index 1600a6a0ec..4ecb23c043 100644
--- a/tests/common/Android.bp
+++ b/tests/common/Android.bp
@@ -158,6 +158,7 @@ java_defaults {
     // Tests must check a large number of deprecated methods and warning about it
     // sends hundreds of warning lines flooding the useful warnings.
     kotlincflags: ["-Xsuppress-warning=DEPRECATION"],
+    // TODO: add "-Xwarning-level=CheckResult:error" when Kotlin 2.2.0 is out
 }
 
 // defaults for tests that need to build against framework-connectivity's @hide APIs, but also
@@ -184,6 +185,7 @@ java_defaults {
     // Tests must check a large number of deprecated methods and warning about it
     // sends hundreds of warning lines flooding the useful warnings.
     kotlincflags: ["-Xsuppress-warning=DEPRECATION"],
+    // TODO: add "-Xwarning-level=CheckResult:error" when Kotlin 2.2.0 is out
     defaults_visibility: ["//packages/modules/Connectivity/tests:__subpackages__"],
 }
 
diff --git a/tests/cts/net/src/android/net/cts/NsdManagerDownstreamTetheringTest.kt b/tests/cts/net/src/android/net/cts/NsdManagerDownstreamTetheringTest.kt
index 19a40f9502..97556f54a2 100644
--- a/tests/cts/net/src/android/net/cts/NsdManagerDownstreamTetheringTest.kt
+++ b/tests/cts/net/src/android/net/cts/NsdManagerDownstreamTetheringTest.kt
@@ -104,7 +104,7 @@ class NsdManagerDownstreamTetheringTest : EthernetTetheringTestBase() {
             nsdManager.discoverServices(serviceType, NsdManager.PROTOCOL_DNS_SD, discoveryRecord)
             discoveryRecord.expectCallback<NsdDiscoveryRecord.DiscoveryEvent.DiscoveryStarted>()
             assertNotNull(downstreamReader.pollForQuery("$serviceType.local", 12 /* type PTR */))
-        } cleanupStep {
+        } cleanup {
             nsdManager.stopServiceDiscovery(discoveryRecord)
             discoveryRecord.expectCallback<NsdDiscoveryRecord.DiscoveryEvent.DiscoveryStopped>()
         }
@@ -137,7 +137,7 @@ class NsdManagerDownstreamTetheringTest : EthernetTetheringTestBase() {
             val downstreamReader = downstreamIface.packetReader
             assertNotNull(downstreamReader.pollForQuery("$serviceType.local", 12 /* type PTR */))
             // TODO: Add another test to check packet reply can trigger serviceFound.
-        } cleanupStep {
+        } cleanup {
             nsdManager.stopServiceDiscovery(discoveryRecord)
             discoveryRecord.expectCallback<NsdDiscoveryRecord.DiscoveryEvent.DiscoveryStopped>()
         }

From f3aa20f1120c79700bd3a93f2a398f22f5277c07 Mon Sep 17 00:00:00 2001
From: Xiao Ma <xiaom@google.com>
Date: Wed, 14 May 2025 15:51:39 +0900
Subject: [PATCH 252/377] DHCPv6 addr reg: parse OPTION_ADDR_REG_ENABLE option.

Check if the received DHCPv6 message has included this option, if so,
that indicates the DHCPv6 server supports the address registration.

Flag: EXEMPT guarded by an legacy experiment flag
Bug: 293393743
Test: TH
Change-Id: I04370b58e26c09ef764d92d3e211b9619b528cf0
---
 .../com/android/net/module/util/dhcp6/Dhcp6Packet.java      | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java
index 7ea585f764..7d20c6c157 100644
--- a/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java
+++ b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java
@@ -457,6 +457,7 @@ public class Dhcp6Packet {
         byte[] clientDuid = null;
         short statusCode = STATUS_SUCCESS;
         boolean rapidCommit = false;
+        boolean addrRegEnable = false;
         int solMaxRt = 0;
         PrefixDelegation pd = null;
 
@@ -527,6 +528,10 @@ public class Dhcp6Packet {
                         expectedLen = 4;
                         solMaxRt = packet.getInt();
                         break;
+                    case DHCP6_OPTION_ADDR_REG_ENABLE:
+                        expectedLen = 0;
+                        addrRegEnable = true;
+                        break;
                     default:
                         expectedLen = optionLen;
                         // BufferUnderflowException will be thrown if option is truncated.
@@ -582,6 +587,7 @@ public class Dhcp6Packet {
                 (solMaxRt >= 60 && solMaxRt <= 86400)
                         ? OptionalInt.of(solMaxRt * 1000)
                         : OptionalInt.empty();
+        newPacket.mAddrRegEnable = addrRegEnable;
 
         return newPacket;
     }

From 4259f55ef1e032d8e470c41b3cbd428bd6801be8 Mon Sep 17 00:00:00 2001
From: Chuwei He <chuweih@google.com>
Date: Tue, 13 May 2025 18:09:18 +0900
Subject: [PATCH 253/377] Add MAC address support for EthernetNetworkSpecifier

This patch adds MAC address support for EthernetNetworkSpecifier under
@hide flag.
After adding the support, EthernetNetworkSpecifier will be able to be
matched by MAC address in addition to existing interface name match. The
specifier can be satisfied with either MAC address and/or interface
name.

Bug: 397536853
Test: atest CtsNetTestCases:android.net.cts.EthernetNetworkSpecifierTest
Flag: EXEMPT mainline

Change-Id: Ibe55411ad0d3fdded6e25c9f33d9898e3eab3a3c
---
 .../android/net/EthernetNetworkSpecifier.java | 83 +++++++++++++++----
 1 file changed, 68 insertions(+), 15 deletions(-)

diff --git a/framework-t/src/android/net/EthernetNetworkSpecifier.java b/framework-t/src/android/net/EthernetNetworkSpecifier.java
index 90c0361821..30878571cc 100644
--- a/framework-t/src/android/net/EthernetNetworkSpecifier.java
+++ b/framework-t/src/android/net/EthernetNetworkSpecifier.java
@@ -25,57 +25,107 @@ import android.text.TextUtils;
 import java.util.Objects;
 
 /**
- * A {@link NetworkSpecifier} used to identify ethernet interfaces.
+ * A {@link NetworkSpecifier} used to identify ethernet interfaces. Interfaces can be identified
+ * by matching either interface name and/or MAC address.
  */
 public final class EthernetNetworkSpecifier extends NetworkSpecifier implements Parcelable {
-
     /**
-     * Name of the network interface.
+     * Name of the network interface, or null.
      */
-    @NonNull
+    @Nullable
     private final String mInterfaceName;
 
     /**
-     * Create a new EthernetNetworkSpecifier.
+     * MAC address of the network interface, or null.
+     */
+    @Nullable
+    private final MacAddress mMacAddress;
+
+    /**
+     * Create a new EthernetNetworkSpecifier with an interface name.
      * @param interfaceName Name of the ethernet interface the specifier refers to.
      */
     public EthernetNetworkSpecifier(@NonNull String interfaceName) {
         if (TextUtils.isEmpty(interfaceName)) {
-            throw new IllegalArgumentException();
+            throw new IllegalArgumentException("Interface name cannot be null");
         }
         mInterfaceName = interfaceName;
+        mMacAddress = null;
     }
 
     /**
-     * Get the name of the ethernet interface the specifier refers to.
+     * Create a new EthernetNetworkSpecifier. Either interface name or MAC address needs to be
+     * valid.
+     * @param interfaceName Name of the ethernet interface the specifier refers to, or null.
+     * @param macAddress MAC address of the ethernet interface the specifier refers to, or null.
+     * @hide
+     */
+    public EthernetNetworkSpecifier(@Nullable String interfaceName,
+            @Nullable MacAddress macAddress) {
+        if (TextUtils.isEmpty(interfaceName) && macAddress == null) {
+            throw new IllegalArgumentException("Either interface name or MAC address needs to be"
+                    + " valid.");
+        }
+        mInterfaceName = interfaceName;
+        mMacAddress = macAddress;
+    }
+
+    /**
+     * Get the name of the ethernet interface the specifier refers to, or null.
      */
     @Nullable
     public String getInterfaceName() {
-        // This may be null in the future to support specifiers based on data other than the
-        // interface name.
         return mInterfaceName;
     }
 
-    /** @hide */
+    /**
+     * Get the MAC address of the ethernet interface the specifier refers to, or null.
+     * @hide
+     */
+    @Nullable
+    public MacAddress getMacAddress() {
+        return mMacAddress;
+    }
+
+    /**
+     * Check if this specifier can be satisfied by another specifier by interface name or/and MAC
+     * address.
+     * Note that because ethernet Networks always set an EthernetNetworkSpecifier that includes both
+     * interface name and MAC address, the match is asymmetrical.
+     * @hide
+     */
     @Override
     public boolean canBeSatisfiedBy(@Nullable NetworkSpecifier other) {
-        return equals(other);
+        if (!(other instanceof EthernetNetworkSpecifier)) return false;
+        final EthernetNetworkSpecifier rhs = (EthernetNetworkSpecifier) other;
+        // If interface name is specified, match interface name.
+        if (mInterfaceName != null && !mInterfaceName.equals(rhs.mInterfaceName)) {
+            return false;
+        }
+        // If MAC address is specified, match MAC address.
+        if (mMacAddress != null && !mMacAddress.equals(rhs.mMacAddress)) {
+            return false;
+        }
+        return true;
     }
 
     @Override
     public boolean equals(@Nullable Object o) {
         if (!(o instanceof EthernetNetworkSpecifier)) return false;
-        return TextUtils.equals(mInterfaceName, ((EthernetNetworkSpecifier) o).mInterfaceName);
+        EthernetNetworkSpecifier rhs = (EthernetNetworkSpecifier) o;
+        return TextUtils.equals(mInterfaceName, rhs.mInterfaceName)
+                && Objects.equals(mMacAddress, rhs.mMacAddress);
     }
 
     @Override
     public int hashCode() {
-        return Objects.hashCode(mInterfaceName);
+        return Objects.hash(mMacAddress, mInterfaceName);
     }
 
     @Override
     public String toString() {
-        return "EthernetNetworkSpecifier (" + mInterfaceName + ")";
+        return "EthernetNetworkSpecifier ( interface name: " + mInterfaceName
+                + ", MAC address: " + Objects.toString(mMacAddress) + ")";
     }
 
     @Override
@@ -86,12 +136,15 @@ public final class EthernetNetworkSpecifier extends NetworkSpecifier implements
     @Override
     public void writeToParcel(@NonNull Parcel dest, int flags) {
         dest.writeString(mInterfaceName);
+        dest.writeParcelable(mMacAddress, flags);
     }
 
     public static final @NonNull Parcelable.Creator<EthernetNetworkSpecifier> CREATOR =
             new Parcelable.Creator<EthernetNetworkSpecifier>() {
         public EthernetNetworkSpecifier createFromParcel(Parcel in) {
-            return new EthernetNetworkSpecifier(in.readString());
+                    final String ifname = in.readString();
+                    final MacAddress addr = in.readParcelable(MacAddress.class.getClassLoader());
+                    return new EthernetNetworkSpecifier(ifname, addr);
         }
         public EthernetNetworkSpecifier[] newArray(int size) {
             return new EthernetNetworkSpecifier[size];

From 7c5511a62ab4183d536c61a15bd2959a6c173a8d Mon Sep 17 00:00:00 2001
From: Junyu Lai <junyulai@google.com>
Date: Thu, 15 May 2025 10:54:00 +0800
Subject: [PATCH 254/377] Enable TrafficStats Client-Side Cache by default

The TrafficStats Client-Side Cache experiment has delivered
significant improvements in binder call counts for key APIs:
  -38% getUidStats P99
  -86% getUidStats P50
  -26% getIfaceStats P99
  -46% getIfaceStats P50
  -46% getTotalStats P99
  -94% getTotalStats P50

Given these substantial performance gains and positive system
health metrics, this feature is now enabled by default for all
OEM partners.

Flag: EXEMPT conntrolled by a kill switch
Test: atest FrameworksNetTests:android.net.connectivity.android.net.TrafficStatsTest \
      FrameworksNetTests:android.net.connectivity.com.android.server.net.NetworkStatsServiceTest \
      CtsNetTestCases:android.net.cts.NetworkStatsBinderTest \
      FrameworksNetIntegrationTests:com.android.server.net.integrationtests.NetworkStatsIntegrationTest
Bug: 343260158
Change-Id: I2b7791c86a492ff78a250b74dcf818fcc3adf826
---
 service-t/src/com/android/server/net/NetworkStatsService.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/service-t/src/com/android/server/net/NetworkStatsService.java b/service-t/src/com/android/server/net/NetworkStatsService.java
index 75d30a91e6..01ff34d8b4 100644
--- a/service-t/src/com/android/server/net/NetworkStatsService.java
+++ b/service-t/src/com/android/server/net/NetworkStatsService.java
@@ -994,7 +994,7 @@ public class NetworkStatsService extends INetworkStatsService.Stub {
                 @NonNull Context ctx) {
             final TrafficStatsRateLimitCacheConfig config =
                     new TrafficStatsRateLimitCacheConfig.Builder()
-                            .setIsCacheEnabled(DeviceConfigUtils.isTetheringFeatureEnabled(
+                            .setIsCacheEnabled(DeviceConfigUtils.isTetheringFeatureNotChickenedOut(
                                     ctx, TRAFFICSTATS_CLIENT_RATE_LIMIT_CACHE_ENABLED_FLAG))
                             .setExpiryDurationMs(getDeviceConfigPropertyInt(
                                     NAMESPACE_TETHERING, TRAFFIC_STATS_CACHE_EXPIRY_DURATION_NAME,

From b7d0a59107a85c7b1ae22c92c3270b6a10534457 Mon Sep 17 00:00:00 2001
From: Julien Desprez <jdesprez@google.com>
Date: Thu, 24 Apr 2025 21:24:41 -0700
Subject: [PATCH 255/377] add new host_common_data tag in addition to
 host_required

This enables the proper packaging of the dependency along with the test module rather than maintaining a manual mapping the CI infrastructure. The new field introduced in Soong is the right field to properly declare  a host side dependency for a device-test (b/262397555)

Test: presubmit
Bug: 413525819
Flag: TEST_ONLY
Change-Id: If103e32632e4312460d99abd2a5c5b00e877f8ac
---
 tests/cts/net/api23Test/Android.bp | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/cts/net/api23Test/Android.bp b/tests/cts/net/api23Test/Android.bp
index c8e630f863..856f171de8 100644
--- a/tests/cts/net/api23Test/Android.bp
+++ b/tests/cts/net/api23Test/Android.bp
@@ -58,4 +58,5 @@ android_test {
     per_testcase_directory: true,
     sdk_version: "test_current",
     host_required: ["net-tests-utils-host-common"],
+    host_common_data: [":net-tests-utils-host-common"],
 }

From a8f2ea5b372f89a97573a219ac1b73a66e045358 Mon Sep 17 00:00:00 2001
From: Junyu Lai <junyulai@google.com>
Date: Mon, 12 May 2025 13:50:12 +0800
Subject: [PATCH 256/377] Move SSLCertificateSocketFactoryTest out of
 CtsNetTestCases

Problem:
- SSLCertificateSocketFactory has a bug causing socket leaks in
  certain exception scenarios.
- SSLCertificateSocketFactoryTest triggers this, leading to
  leaked sockets during test runs.
- When run within CtsNetTestCases, the network traffic from these
  leaked sockets interferes with
  TrafficStatsTest#testTrafficStatsForLocalhost, which monitors
  traffic by UID within that same suite.
- This interference causes TrafficStatsTest to be flaky.

Solution:
- Moving SSLCertificateSocketFactoryTest to a different suite
  ensures its leaked socket traffic is no longer associated with
  the same UID context monitored by TrafficStatsTest.
- This isolation prevents the test interference and resolves the
  flakiness.

Flag: TEST_ONLY
Test: atest CtsLibcoreNetTestCases
Bug: 393471251
Change-Id: I1cc626ba281939999a7d6978668eefea8531ffec
---
 .../cts/SSLCertificateSocketFactoryTest.java  | 374 ------------------
 1 file changed, 374 deletions(-)
 delete mode 100644 tests/cts/net/src/android/net/cts/SSLCertificateSocketFactoryTest.java

diff --git a/tests/cts/net/src/android/net/cts/SSLCertificateSocketFactoryTest.java b/tests/cts/net/src/android/net/cts/SSLCertificateSocketFactoryTest.java
deleted file mode 100644
index 2fda685ee6..0000000000
--- a/tests/cts/net/src/android/net/cts/SSLCertificateSocketFactoryTest.java
+++ /dev/null
@@ -1,374 +0,0 @@
-/*
- * Copyright (C) 2008 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package android.net.cts;
-
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
-
-import android.net.SSLCertificateSocketFactory;
-import android.platform.test.annotations.AppModeFull;
-
-import libcore.javax.net.ssl.SSLConfigurationAsserts;
-
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.JUnit4;
-
-import java.io.IOException;
-import java.net.InetAddress;
-import java.net.InetSocketAddress;
-import java.net.Socket;
-import java.net.SocketAddress;
-import java.net.UnknownHostException;
-import java.util.Arrays;
-import java.util.List;
-import java.util.stream.Collectors;
-
-import javax.net.ssl.HostnameVerifier;
-import javax.net.ssl.HttpsURLConnection;
-import javax.net.ssl.SSLException;
-import javax.net.ssl.SSLPeerUnverifiedException;
-import javax.net.ssl.SSLSession;
-import javax.net.ssl.SSLSocket;
-
-@RunWith(JUnit4.class)
-public class SSLCertificateSocketFactoryTest {
-    // TEST_HOST should point to a web server with a valid TLS certificate.
-    private static final String TEST_HOST = "www.google.com";
-    private static final int HTTPS_PORT = 443;
-    private HostnameVerifier mDefaultVerifier;
-    private SSLCertificateSocketFactory mSocketFactory;
-    private InetAddress mLocalAddress;
-    // InetAddress obtained by resolving TEST_HOST.
-    private InetAddress mTestHostAddress;
-    // SocketAddress combining mTestHostAddress and HTTPS_PORT.
-    private List<SocketAddress> mTestSocketAddresses;
-
-    @Before
-    public void setUp() {
-        // Expected state before each test method is that
-        // HttpsURLConnection.getDefaultHostnameVerifier() will return the system default.
-        mDefaultVerifier = HttpsURLConnection.getDefaultHostnameVerifier();
-        mSocketFactory = (SSLCertificateSocketFactory)
-            SSLCertificateSocketFactory.getDefault(1000 /* handshakeTimeoutMillis */);
-        assertNotNull(mSocketFactory);
-        InetAddress[] addresses;
-        try {
-            addresses = InetAddress.getAllByName(TEST_HOST);
-        } catch (UnknownHostException uhe) {
-            throw new AssertionError(
-                "Unable to test SSLCertificateSocketFactory: cannot resolve " + TEST_HOST, uhe);
-        }
-
-        mTestSocketAddresses = Arrays.stream(addresses)
-            .map(addr -> new InetSocketAddress(addr, HTTPS_PORT))
-            .collect(Collectors.toList());
-
-        // Find the local and remote IP addresses which will be used to connect to TEST_HOST.
-        try {
-            Socket testSocket = new Socket(TEST_HOST, HTTPS_PORT);
-            mLocalAddress = testSocket.getLocalAddress();
-            mTestHostAddress = testSocket.getInetAddress();
-            testSocket.close();
-        } catch (IOException ioe) {
-            throw new AssertionError(""
-                + "Unable to test SSLCertificateSocketFactory: cannot connect to "
-                + TEST_HOST, ioe);
-        }
-    }
-
-    // Restore the system default hostname verifier after each test.
-    @After
-    public void restoreDefaultHostnameVerifier() {
-        HttpsURLConnection.setDefaultHostnameVerifier(mDefaultVerifier);
-    }
-
-    @Test
-    public void testDefaultConfiguration() throws Exception {
-        SSLConfigurationAsserts.assertSSLSocketFactoryDefaultConfiguration(mSocketFactory);
-    }
-
-    @Test
-    public void testAccessProperties() {
-        mSocketFactory.getSupportedCipherSuites();
-        mSocketFactory.getDefaultCipherSuites();
-    }
-
-    /**
-     * Tests the {@code createSocket()} cases which are expected to fail with {@code IOException}.
-     */
-    @Test
-    @AppModeFull(reason = "Socket cannot bind in instant app mode")
-    public void createSocket_io_error_expected() {
-        // Connect to the localhost HTTPS port. Should result in connection refused IOException
-        // because no service should be listening on that port.
-        InetAddress localhostAddress = InetAddress.getLoopbackAddress();
-        try {
-            mSocketFactory.createSocket(localhostAddress, HTTPS_PORT);
-            fail();
-        } catch (IOException e) {
-            // expected
-        }
-
-        // Same, but also binding to a local address.
-        try {
-            mSocketFactory.createSocket(localhostAddress, HTTPS_PORT, localhostAddress, 0);
-            fail();
-        } catch (IOException e) {
-            // expected
-        }
-
-        // Same, wrapping an existing plain socket which is in an unconnected state.
-        try {
-            Socket socket = new Socket();
-            mSocketFactory.createSocket(socket, "localhost", HTTPS_PORT, true);
-            fail();
-        } catch (IOException e) {
-            // expected
-        }
-    }
-
-    /**
-     * Tests hostname verification for
-     * {@link SSLCertificateSocketFactory#createSocket(String, int)}.
-     *
-     * <p>This method should return a socket which is fully connected (i.e. TLS handshake complete)
-     * and whose peer TLS certificate has been verified to have the correct hostname.
-     *
-     * <p>{@link SSLCertificateSocketFactory} is documented to verify hostnames using
-     * the {@link HostnameVerifier} returned by
-     * {@link HttpsURLConnection#getDefaultHostnameVerifier}, so this test connects twice,
-     * once with the system default {@link HostnameVerifier} which is expected to succeed,
-     * and once after installing a {@link NegativeHostnameVerifier} which will cause
-     * {@link #verifyHostname} to throw a {@link SSLPeerUnverifiedException}.
-     *
-     * <p>These tests only test the hostname verification logic in SSLCertificateSocketFactory,
-     * other TLS failure modes and the default HostnameVerifier are tested elsewhere, see
-     * {@link com.squareup.okhttp.internal.tls.HostnameVerifierTest} and
-     * https://android.googlesource.com/platform/external/boringssl/+/refs/heads/master/src/ssl/test
-     *
-     * <p>Tests the following behaviour:-
-     * <ul>
-     * <li>TEST_SERVER is available and has a valid TLS certificate
-     * <li>{@code createSocket()} verifies the remote hostname is correct using
-     *     {@link HttpsURLConnection#getDefaultHostnameVerifier}
-     * <li>{@link SSLPeerUnverifiedException} is thrown when the remote hostname is invalid
-     * </ul>
-     *
-     * <p>See also http://b/2807618.
-     */
-    @Test
-    public void createSocket_simple_with_hostname_verification() throws Exception {
-        Socket socket = mSocketFactory.createSocket(TEST_HOST, HTTPS_PORT);
-        assertConnectedSocket(socket);
-        socket.close();
-
-        HttpsURLConnection.setDefaultHostnameVerifier(new NegativeHostnameVerifier());
-        try {
-            mSocketFactory.createSocket(TEST_HOST, HTTPS_PORT);
-            fail();
-        } catch (SSLPeerUnverifiedException expected) {
-            // expected
-        }
-    }
-
-    /**
-     * Tests hostname verification for
-     * {@link SSLCertificateSocketFactory#createSocket(Socket, String, int, boolean)}.
-     *
-     * <p>This method should return a socket which is fully connected (i.e. TLS handshake complete)
-     * and whose peer TLS certificate has been verified to have the correct hostname.
-     *
-     * <p>The TLS socket returned is wrapped around the plain socket passed into
-     * {@code createSocket()}.
-     *
-     * <p>See {@link #createSocket_simple_with_hostname_verification()} for test methodology.
-     */
-    @Test
-    public void createSocket_wrapped_with_hostname_verification() throws Exception {
-        Socket underlying = new Socket(TEST_HOST, HTTPS_PORT);
-        Socket socket = mSocketFactory.createSocket(underlying, TEST_HOST, HTTPS_PORT, true);
-        assertConnectedSocket(socket);
-        socket.close();
-
-        HttpsURLConnection.setDefaultHostnameVerifier(new NegativeHostnameVerifier());
-        try {
-            underlying = new Socket(TEST_HOST, HTTPS_PORT);
-            mSocketFactory.createSocket(underlying, TEST_HOST, HTTPS_PORT, true);
-            fail();
-        } catch (SSLPeerUnverifiedException expected) {
-            // expected
-        }
-    }
-
-    /**
-     * Tests hostname verification for
-     * {@link SSLCertificateSocketFactory#createSocket(String, int, InetAddress, int)}.
-     *
-     * <p>This method should return a socket which is fully connected (i.e. TLS handshake complete)
-     * and whose peer TLS certificate has been verified to have the correct hostname.
-     *
-     * <p>The TLS socket returned is also bound to the local address determined in {@link #setUp} to
-     * be used for connections to TEST_HOST, and a wildcard port.
-     *
-     * <p>See {@link #createSocket_simple_with_hostname_verification()} for test methodology.
-     */
-    @Test
-    @AppModeFull(reason = "Socket cannot bind in instant app mode")
-    public void createSocket_bound_with_hostname_verification() throws Exception {
-        Socket socket = mSocketFactory.createSocket(TEST_HOST, HTTPS_PORT, mLocalAddress, 0);
-        assertConnectedSocket(socket);
-        socket.close();
-
-        HttpsURLConnection.setDefaultHostnameVerifier(new NegativeHostnameVerifier());
-        try {
-            mSocketFactory.createSocket(TEST_HOST, HTTPS_PORT, mLocalAddress, 0);
-            fail();
-        } catch (SSLPeerUnverifiedException expected) {
-            // expected
-        }
-    }
-
-    /**
-     * Tests hostname verification for
-     * {@link SSLCertificateSocketFactory#createSocket(InetAddress, int)}.
-     *
-     * <p>This method should return a socket which the documentation describes as "unconnected",
-     * which actually means that the socket is fully connected at the TCP layer but TLS handshaking
-     * and hostname verification have not yet taken place.
-     *
-     * <p>Behaviour is tested by installing a {@link NegativeHostnameVerifier} and by calling
-     * {@link #assertConnectedSocket} to ensure TLS handshaking but no hostname verification takes
-     * place.  Next, {@link #verifyHostname} is called to ensure that hostname verification is using
-     * the {@link HostnameVerifier} returned by
-     * {@link HttpsURLConnection#getDefaultHostnameVerifier} as documented.
-     *
-     * <p>Tests the following behaviour:-
-     * <ul>
-     * <li>TEST_SERVER is available and has a valid TLS certificate
-     * <li>{@code createSocket()} does not verify the remote hostname
-     * <li>Calling {@link #verifyHostname} on the returned socket throws
-     * {@link SSLPeerUnverifiedException} if the remote hostname is invalid
-     * </ul>
-     */
-    @Test
-    public void createSocket_simple_no_hostname_verification() throws Exception{
-        HttpsURLConnection.setDefaultHostnameVerifier(new NegativeHostnameVerifier());
-        Socket socket = mSocketFactory.createSocket(mTestHostAddress, HTTPS_PORT);
-        // Need to provide the expected hostname here or the TLS handshake will
-        // be unable to supply SNI to the remote host.
-        mSocketFactory.setHostname(socket, TEST_HOST);
-        assertConnectedSocket(socket);
-        try {
-            verifyHostname(socket, TEST_HOST);
-            fail();
-        } catch (SSLPeerUnverifiedException expected) {
-            // expected
-        }
-        HttpsURLConnection.setDefaultHostnameVerifier(mDefaultVerifier);
-        verifyHostname(socket, TEST_HOST);
-        socket.close();
-    }
-
-    /**
-     * Tests hostname verification for
-     * {@link SSLCertificateSocketFactory#createSocket(InetAddress, int, InetAddress, int)}.
-     *
-     * <p>This method should return a socket which the documentation describes as "unconnected",
-     * which actually means that the socket is fully connected at the TCP layer but TLS handshaking
-     * and hostname verification have not yet taken place.
-     *
-     * <p>The TLS socket returned is also bound to the local address determined in {@link #setUp} to
-     * be used for connections to TEST_HOST, and a wildcard port.
-     *
-     * <p>See {@link #createSocket_simple_no_hostname_verification()} for test methodology.
-     */
-    @Test
-    @AppModeFull(reason = "Socket cannot bind in instant app mode")
-    public void createSocket_bound_no_hostname_verification() throws Exception{
-        HttpsURLConnection.setDefaultHostnameVerifier(new NegativeHostnameVerifier());
-        Socket socket =
-            mSocketFactory.createSocket(mTestHostAddress, HTTPS_PORT, mLocalAddress, 0);
-        // Need to provide the expected hostname here or the TLS handshake will
-        // be unable to supply SNI to the peer.
-        mSocketFactory.setHostname(socket, TEST_HOST);
-        assertConnectedSocket(socket);
-        try {
-            verifyHostname(socket, TEST_HOST);
-            fail();
-        } catch (SSLPeerUnverifiedException expected) {
-            // expected
-        }
-        HttpsURLConnection.setDefaultHostnameVerifier(mDefaultVerifier);
-        verifyHostname(socket, TEST_HOST);
-        socket.close();
-    }
-
-    // This is copied from SSLCertificateSocketFactory#verifyHostname given that
-    // the method is @hide.
-    private static void verifyHostname(Socket socket, String hostname) throws Exception {
-        if (!(socket instanceof SSLSocket)) {
-            throw new IllegalArgumentException("Attempt to verify non-SSL socket");
-        }
-
-        // The code at the start of OpenSSLSocketImpl.startHandshake()
-        // ensures that the call is idempotent, so we can safely call it.
-        SSLSocket ssl = (SSLSocket) socket;
-        ssl.startHandshake();
-
-        SSLSession session = ssl.getSession();
-        if (session == null) {
-            throw new SSLException("Cannot verify SSL socket without session");
-        }
-        if (!HttpsURLConnection.getDefaultHostnameVerifier().verify(hostname, session)) {
-            throw new SSLPeerUnverifiedException("Cannot verify hostname: " + hostname);
-        }
-    }
-
-    /**
-     * Asserts a socket is fully connected to the expected peer.
-     *
-     * <p>For the variants of createSocket which verify the remote hostname,
-     * {@code socket} should already be fully connected.
-     *
-     * <p>For the non-verifying variants, retrieving the input stream will trigger a TLS handshake
-     * and so may throw an exception, for example if the peer's certificate is invalid.
-     *
-     * <p>Does no hostname verification.
-     */
-    private void assertConnectedSocket(Socket socket) throws Exception {
-        assertNotNull(socket);
-        assertTrue(socket.isConnected());
-        assertNotNull(socket.getInputStream());
-        assertNotNull(socket.getOutputStream());
-        assertTrue(mTestSocketAddresses.contains(socket.getRemoteSocketAddress()));
-    }
-
-    /**
-     * A HostnameVerifier which always returns false to simulate a server returning a
-     * certificate which does not match the expected hostname.
-     */
-    private static class NegativeHostnameVerifier implements HostnameVerifier {
-        @Override
-        public boolean verify(String hostname, SSLSession sslSession) {
-            return false;
-        }
-    }
-}

From 82ce2ca21cdf067dae9cb87d2c3d1c3b5ea2566f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Wed, 14 May 2025 14:49:28 -0700
Subject: [PATCH 257/377] NetBpfLoad: eliminate directory scanning
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The full set of 5 .o's is known at build time, and basically almost
never changes (and indeed is likely to shrink, with clatd.o merged
into offload.o && dscpPolicy.c merged into netd.c).

We might as well just code this knowledge straight into the mainline
loader.

This also allows us to move all the files to an apex subdirectory
that old platform bpfloaders don't even look at, which eliminates
the need for any backward compatibility with them.

Test: TreeHugger
Flag: EXEMPT mainline
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ie3d27178c31a68ed7cf5173b5983ad3009a3cf94
---
 bpf/loader/NetBpfLoad.cpp | 116 +++++++++++++++-----------------------
 bpf/progs/Android.bp      |  32 +++++------
 2 files changed, 59 insertions(+), 89 deletions(-)

diff --git a/bpf/loader/NetBpfLoad.cpp b/bpf/loader/NetBpfLoad.cpp
index 43c4d2a650..631f5c51da 100644
--- a/bpf/loader/NetBpfLoad.cpp
+++ b/bpf/loader/NetBpfLoad.cpp
@@ -122,12 +122,6 @@ static constexpr bool specified(domain d) {
     return d != domain::unspecified;
 }
 
-struct Location {
-    const char* const dir = "";
-    const char* const prefix = "";
-    const bool t_plus = true;
-};
-
 // Returns the build type string (from ro.build.type).
 const std::string& getBuildType() {
     static std::string t = GetProperty("ro.build.type", "unknown");
@@ -1422,63 +1416,44 @@ static bool exists(const char* const path) {
 }
 
 #define APEXROOT "/apex/com.android.tethering"
-#define BPFROOT APEXROOT "/etc/bpf"
+#define BPFROOT APEXROOT "/etc/bpf/mainline/"
 
-const Location locations[] = {
-        // S+ Tethering mainline module (network_stack): tether offload
-        {
-                .dir = BPFROOT "/tethering/",
-                .prefix = "tethering/",
-                .t_plus = false,
-        },
-        // T+ Tethering mainline module (shared with netd & system server)
-        // netutils_wrapper (for iptables xt_bpf) has access to programs
-        {
-                .dir = BPFROOT "/netd_shared/",
-                .prefix = "netd_shared/",
-        },
-        // T+ Tethering mainline module (shared with netd & system server)
-        // netutils_wrapper has no access, netd has read only access
-        {
-                .dir = BPFROOT "/netd_readonly/",
-                .prefix = "netd_readonly/",
-        },
-        // T+ Tethering mainline module (shared with system server)
-        {
-                .dir = BPFROOT "/net_shared/",
-                .prefix = "net_shared/",
-        },
-        // T+ Tethering mainline module (not shared, just network_stack)
-        {
-                .dir = BPFROOT "/net_private/",
-                .prefix = "net_private/",
-        },
-};
-
-static int loadAllElfObjects(const unsigned int bpfloader_ver, const Location& location) {
-    int retVal = 0;
-    DIR* dir;
-    struct dirent* ent;
-
-    if ((dir = opendir(location.dir)) != NULL) {
-        while ((ent = readdir(dir)) != NULL) {
-            string s = ent->d_name;
-            if (!EndsWith(s, ".o")) continue;
-
-            string progPath(location.dir);
-            progPath += s;
-
-            int ret = loadProg(progPath.c_str(), bpfloader_ver, location.prefix);
-            if (ret) {
-                retVal = ret;
-                ALOGE("Failed to load object: %s, ret: %s", progPath.c_str(), std::strerror(-ret));
-            } else {
-                ALOGD("Loaded object: %s", progPath.c_str());
-            }
-        }
-        closedir(dir);
+static int loadObject(const unsigned int bpfloader_ver, const char* const prefix,
+                      const char* const fname) {
+    string progPath = string(BPFROOT) + fname;
+    int ret = loadProg(progPath.c_str(), bpfloader_ver, prefix);
+    if (ret) {
+        ALOGE("Failed to load object: %s, ret: %s", progPath.c_str(), std::strerror(-ret));
+        return 1;
     }
-    return retVal;
+    ALOGD("Loaded object: %s", progPath.c_str());
+    return 0;
+}
+
+static int loadAllObjects(const unsigned int bpfloader_ver) {
+    // S+ Tethering mainline module (network_stack): tether offload
+    // loads under /sys/fs/bpf/tethering:
+    if (loadObject(bpfloader_ver, "tethering/", "offload.o")) return 1;
+    if (loadObject(bpfloader_ver, "tethering/", "test.o")) return 1;
+    if (isAtLeastT) {
+        // T+ Tethering mainline module loads under:
+        // /sys/fs/bpf/net_shared: shared with netd & system server
+        if (loadObject(bpfloader_ver, "net_shared/", "clatd.o")) return 1;
+        if (loadObject(bpfloader_ver, "net_shared/", "dscpPolicy.o")) return 1;
+
+        // /sys/fs/bpf/netd_shared: shared with netd & system server
+        // - netutils_wrapper (for iptables xt_bpf) has access to programs
+
+        // WARNING: Android T+ non-updatable netd depends on both of the
+        // 'netd_shared' & 'netd' strings for xt_bpf programs it loads
+        if (loadObject(bpfloader_ver, "netd_shared/", "netd.o")) return 1;
+
+        // /sys/fs/bpf/netd_readonly: shared with netd & system server
+        // - netutils_wrapper has no access, netd has read only access
+
+        // /sys/fs/bpf/net_private: not shared, just network_stack
+    }
+    return 0;
 }
 
 static int createDir(const char* const dir) {
@@ -1894,17 +1869,14 @@ static int doLoad(char** argv, char * const envp[]) {
     }
 
     // Load all ELF objects, create programs and maps, and pin them
-    for (const auto& location : locations) {
-        if (location.t_plus && !isAtLeastT) continue;
-        if (loadAllElfObjects(bpfloader_ver, location) != 0) {
-            ALOGE("=== CRITICAL FAILURE LOADING BPF PROGRAMS FROM %s ===", location.dir);
-            ALOGE("If this triggers reliably, you're probably missing kernel options or patches.");
-            ALOGE("If this triggers randomly, you might be hitting some memory allocation "
-                  "problems or startup script race.");
-            ALOGE("--- DO NOT EXPECT SYSTEM TO BOOT SUCCESSFULLY ---");
-            sleep(20);
-            return 2;
-        }
+    if (loadAllObjects(bpfloader_ver)) {
+        ALOGE("=== CRITICAL FAILURE LOADING BPF PROGRAMS ===");
+        ALOGE("If this triggers reliably, you're probably missing kernel options or patches.");
+        ALOGE("If this triggers randomly, you might be hitting some memory allocation "
+              "problems or startup script race.");
+        ALOGE("--- DO NOT EXPECT SYSTEM TO BOOT SUCCESSFULLY ---");
+        sleep(20);
+        return 2;
     }
 
     int key = 1;
diff --git a/bpf/progs/Android.bp b/bpf/progs/Android.bp
index 2bfe613bb0..960efda2b8 100644
--- a/bpf/progs/Android.bp
+++ b/bpf/progs/Android.bp
@@ -63,34 +63,32 @@ cc_library_headers {
 //
 // bpf kernel programs
 //
+bpf {
+    name: "clatd.o",
+    srcs: ["clatd.c"],
+    sub_dir: "mainline",
+}
+
 bpf {
     name: "dscpPolicy.o",
     srcs: ["dscpPolicy.c"],
-    sub_dir: "net_shared",
+    sub_dir: "mainline",
+}
+
+bpf {
+    name: "netd.o",
+    srcs: ["netd.c"],
+    sub_dir: "mainline",
 }
 
 bpf {
     name: "offload.o",
     srcs: ["offload.c"],
-    sub_dir: "tethering",
+    sub_dir: "mainline",
 }
 
 bpf {
     name: "test.o",
     srcs: ["test.c"],
-    sub_dir: "tethering",
-}
-
-bpf {
-    name: "clatd.o",
-    srcs: ["clatd.c"],
-    sub_dir: "net_shared",
-}
-
-bpf {
-    // WARNING: Android T's non-updatable netd depends on 'netd' string for xt_bpf programs it loads
-    name: "netd.o",
-    srcs: ["netd.c"],
-    // WARNING: Android T's non-updatable netd depends on 'netd_shared' string for xt_bpf programs
-    sub_dir: "netd_shared",
+    sub_dir: "mainline",
 }

From eb0a6a3f25683568135a76ffa6af72374bcb44fa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Thu, 15 May 2025 03:50:24 -0700
Subject: [PATCH 258/377] NetBpfLoad: move .rc docs into .35rc
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The .rc file is just a placeholder, and isn't
truly used, so just move the documentation over
into the apex location which is actually used.

Test: TreeHugger
Flag: EXEMPT comments only
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I505b90f27208ac5b217aca949b8ef044d3a39226
---
 bpf/loader/netbpfload.35rc | 58 +++++++++++++++++++++++++++++++++++
 bpf/loader/netbpfload.rc   | 63 +-------------------------------------
 2 files changed, 59 insertions(+), 62 deletions(-)

diff --git a/bpf/loader/netbpfload.35rc b/bpf/loader/netbpfload.35rc
index 0fbcb5abdd..683abceb5d 100644
--- a/bpf/loader/netbpfload.35rc
+++ b/bpf/loader/netbpfload.35rc
@@ -1,9 +1,67 @@
 service bpfloader /apex/com.android.tethering/bin/netbpfload
+    # netbpfload will do network bpf loading, then execute /system/bin/bpfloader
     capabilities CHOWN SYS_ADMIN NET_ADMIN
+    # The following group memberships are a workaround for lack of DAC_OVERRIDE
+    # and allow us to open (among other things) files that we created and are
+    # no longer root owned (due to CHOWN) but still have group read access to
+    # one of the following groups.  This is not perfect, but a more correct
+    # solution requires significantly more effort to implement.
     group root graphics network_stack net_admin net_bw_acct net_bw_stats net_raw system
     user root
     file /dev/kmsg w
+    #
+    # Set RLIMIT_MEMLOCK to 1GiB for bpfloader
+    #
+    # Actually only 8MiB would be needed if bpfloader ran as its own uid.
+    #
+    # However, while the rlimit is per-thread, the accounting is system wide.
+    # So, for example, if the graphics stack has already allocated 10MiB of
+    # memlock data before bpfloader even gets a chance to run, it would fail
+    # if its memlock rlimit is only 8MiB - since there would be none left for it.
+    #
+    # bpfloader succeeding is critical to system health, since a failure will
+    # cause netd crashloop and thus system server crashloop... and the only
+    # recovery is a full kernel reboot.
+    #
+    # We've had issues where devices would sometimes (rarely) boot into
+    # a crashloop because bpfloader would occasionally lose a boot time
+    # race against the graphics stack's boot time locked memory allocation.
+    #
+    # Thus bpfloader's memlock has to be 8MB higher then the locked memory
+    # consumption of the root uid anywhere else in the system...
+    # But we don't know what that is for all possible devices...
+    #
+    # Ideally, we'd simply grant bpfloader the IPC_LOCK capability and it
+    # would simply ignore it's memlock rlimit... but it turns that this
+    # capability is not even checked by the kernel's bpf system call.
+    #
+    # As such we simply use 1GiB as a reasonable approximation of infinity.
+    #
     rlimit memlock 1073741824 1073741824
     oneshot
+    #
+    # How to debug bootloops caused by 'bpfloader-failed'.
+    #
+    # 1. On some lower RAM devices (like wembley) you may need to first enable developer mode
+    #    (from the Settings app UI), and change the developer option "Logger buffer sizes"
+    #    from the default (wembley: 64kB) to the maximum (1M) per log buffer.
+    #    Otherwise buffer will overflow before you manage to dump it and you'll get useless logs.
+    #
+    # 2. comment out 'reboot_on_failure reboot,bpfloader-failed' below
+    # 3. rebuild/reflash/reboot
+    # 4. as the device is booting up capture bpfloader logs via:
+    #    adb logcat -s 'bpfloader:*' 'LibBpfLoader:*' 'NetBpfLoad:*' 'NetBpfLoader:*'
+    #
+    # something like:
+    #   $ adb reboot; sleep 1; adb wait-for-device; adb root; sleep 1; adb wait-for-device; adb logcat -s 'bpfloader:*' 'LibBpfLoader:*' 'NetBpfLoad:*' 'NetBpfLoader:*'
+    # will take care of capturing logs as early as possible
+    #
+    # 5. look through the logs from the kernel's bpf verifier that bpfloader dumps out,
+    #    it usually makes sense to search back from the end and find the particular
+    #    bpf verifier failure that caused bpfloader to terminate early with an error code.
+    #    This will probably be something along the lines of 'too many jumps' or
+    #    'cannot prove return value is 0 or 1' or 'unsupported / unknown operation / helper',
+    #    'invalid bpf_context access', etc.
+    #
     reboot_on_failure reboot,bpfloader-failed
     override
diff --git a/bpf/loader/netbpfload.rc b/bpf/loader/netbpfload.rc
index 4cc6284cfc..3dedabb559 100644
--- a/bpf/loader/netbpfload.rc
+++ b/bpf/loader/netbpfload.rc
@@ -2,70 +2,9 @@
 
 # Note: This will actually execute /apex/com.android.tethering/bin/netbpfload
 # by virtue of 'service bpfloader' being overridden by the apex shipped .rc
-# Warning: most of the below settings are irrelevant unless the apex is missing.
+# Warning: the below settings are irrelevant unless the apex is missing.
 service bpfloader /system/bin/false
-    # netbpfload will do network bpf loading, then execute /system/bin/bpfloader
-    #! capabilities CHOWN SYS_ADMIN NET_ADMIN
-    # The following group memberships are a workaround for lack of DAC_OVERRIDE
-    # and allow us to open (among other things) files that we created and are
-    # no longer root owned (due to CHOWN) but still have group read access to
-    # one of the following groups.  This is not perfect, but a more correct
-    # solution requires significantly more effort to implement.
-    #! group root graphics network_stack net_admin net_bw_acct net_bw_stats net_raw system
     user root
-    #
-    # Set RLIMIT_MEMLOCK to 1GiB for bpfloader
-    #
-    # Actually only 8MiB would be needed if bpfloader ran as its own uid.
-    #
-    # However, while the rlimit is per-thread, the accounting is system wide.
-    # So, for example, if the graphics stack has already allocated 10MiB of
-    # memlock data before bpfloader even gets a chance to run, it would fail
-    # if its memlock rlimit is only 8MiB - since there would be none left for it.
-    #
-    # bpfloader succeeding is critical to system health, since a failure will
-    # cause netd crashloop and thus system server crashloop... and the only
-    # recovery is a full kernel reboot.
-    #
-    # We've had issues where devices would sometimes (rarely) boot into
-    # a crashloop because bpfloader would occasionally lose a boot time
-    # race against the graphics stack's boot time locked memory allocation.
-    #
-    # Thus bpfloader's memlock has to be 8MB higher then the locked memory
-    # consumption of the root uid anywhere else in the system...
-    # But we don't know what that is for all possible devices...
-    #
-    # Ideally, we'd simply grant bpfloader the IPC_LOCK capability and it
-    # would simply ignore it's memlock rlimit... but it turns that this
-    # capability is not even checked by the kernel's bpf system call.
-    #
-    # As such we simply use 1GiB as a reasonable approximation of infinity.
-    #
-    #! rlimit memlock 1073741824 1073741824
     oneshot
-    #
-    # How to debug bootloops caused by 'bpfloader-failed'.
-    #
-    # 1. On some lower RAM devices (like wembley) you may need to first enable developer mode
-    #    (from the Settings app UI), and change the developer option "Logger buffer sizes"
-    #    from the default (wembley: 64kB) to the maximum (1M) per log buffer.
-    #    Otherwise buffer will overflow before you manage to dump it and you'll get useless logs.
-    #
-    # 2. comment out 'reboot_on_failure reboot,bpfloader-failed' below
-    # 3. rebuild/reflash/reboot
-    # 4. as the device is booting up capture bpfloader logs via:
-    #    adb logcat -s 'bpfloader:*' 'LibBpfLoader:*' 'NetBpfLoad:*' 'NetBpfLoader:*'
-    #
-    # something like:
-    #   $ adb reboot; sleep 1; adb wait-for-device; adb root; sleep 1; adb wait-for-device; adb logcat -s 'bpfloader:*' 'LibBpfLoader:*' 'NetBpfLoad:*' 'NetBpfLoader:*'
-    # will take care of capturing logs as early as possible
-    #
-    # 5. look through the logs from the kernel's bpf verifier that bpfloader dumps out,
-    #    it usually makes sense to search back from the end and find the particular
-    #    bpf verifier failure that caused bpfloader to terminate early with an error code.
-    #    This will probably be something along the lines of 'too many jumps' or
-    #    'cannot prove return value is 0 or 1' or 'unsupported / unknown operation / helper',
-    #    'invalid bpf_context access', etc.
-    #
     reboot_on_failure reboot,netbpfload-missing
     updatable

From 82d5add0c2e738adab217585ef10475ac7043a5f Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Thu, 15 May 2025 18:41:48 -0700
Subject: [PATCH 259/377] Add a test to ensure link-local prefix does not
 trigger PD

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I77993cf154d4a3351294574735a238bd9db2da71
---
 .../src/android/net/Dhcp6PdTest.kt            | 26 +++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/tests/integration/src/android/net/Dhcp6PdTest.kt b/tests/integration/src/android/net/Dhcp6PdTest.kt
index cd1b340753..e40956c40c 100644
--- a/tests/integration/src/android/net/Dhcp6PdTest.kt
+++ b/tests/integration/src/android/net/Dhcp6PdTest.kt
@@ -54,6 +54,7 @@ import java.net.InetAddress
 import java.nio.ByteBuffer
 import kotlin.test.assertIs
 import kotlin.test.assertNotNull
+import kotlin.test.assertNull
 import org.junit.After
 import org.junit.Rule
 import org.junit.Test
@@ -132,6 +133,17 @@ class Dhcp6PdTest {
         return p
     }
 
+    private fun assertNoPacket(predicate: (ByteArray) -> Boolean) {
+        val p = iface.packetReader.poll(SHORT_TIMEOUT_MS) {
+            it != null && predicate(it)
+        }
+        assertNull(p)
+    }
+
+    private fun assertNoDhcp6Packet() {
+        assertNoPacket(::isDhcp6Packet)
+    }
+
     private fun isDhcp6Packet(p: ByteArray): Boolean {
         val bb = ByteBuffer.wrap(p)
         bb.position(6 + 6)
@@ -296,4 +308,18 @@ class Dhcp6PdTest {
                 IpPrefix("2001:db8:2:1234::/64")
         )
     }
+
+    @Test
+    fun testSolicit_notTriggeredByLinkLocalPrefix() {
+        // RA includes a SLAAC prefix to ensure the heuristic does not trigger.
+        val ra = RaPkt()
+            .addPioOption(prefix = "2001:db8:1::/64", flags = "LA")
+            .addPioOption(prefix = "fe80:42::/64", flags = "LP")
+            .addRdnssOption(dns = "2001:4860::8888")
+        ndResponder.addRouterEntry(ROUTER_MAC, ROUTER_V6, ra)
+        // Expect network Available to wait for RA arrival
+        networkCallback.expect<Available>()
+        // Ensure that no Solicit was sent.
+        assertNoDhcp6Packet()
+    }
 }

From bcd9653ed3b5c14bb7165aa31ca1ae994a2017c3 Mon Sep 17 00:00:00 2001
From: Richard Uhler <ruhler@google.com>
Date: Fri, 9 May 2025 11:32:48 -0700
Subject: [PATCH 260/377] Add a performance test for filteredClone.

atest ConnectivityCoverageTests:android.net.connectivity.android.net.NetworkStatsTest#testFilteredPerformance -- --auto-collect DEVICE_TRACE

Flag: TEST_ONLY
Change-Id: Id47edc05bb39ce334da819129d4ee13b0796cbb5
---
 .../java/android/net/NetworkStatsTest.java    | 29 +++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/tests/unit/java/android/net/NetworkStatsTest.java b/tests/unit/java/android/net/NetworkStatsTest.java
index 37a0e576e1..ca88f6d627 100644
--- a/tests/unit/java/android/net/NetworkStatsTest.java
+++ b/tests/unit/java/android/net/NetworkStatsTest.java
@@ -42,6 +42,7 @@ import static org.junit.Assert.assertTrue;
 
 import android.os.Build;
 import android.os.Process;
+import android.os.Trace;
 import android.util.ArrayMap;
 
 import androidx.test.filters.SmallTest;
@@ -876,6 +877,34 @@ public class NetworkStatsTest {
         assertEquals(entry3, filtered.getValues(1, null));
     }
 
+    @Test
+    public void testFilteredPerformance() {
+        final int size = 100000;
+        NetworkStats stats = new NetworkStats(TEST_START, size);
+        for (int i = 0; i < size; ++i) {
+          NetworkStats.Entry entry = new NetworkStats.Entry(
+              "test", 10100 + i % 100, SET_DEFAULT, i % 2, METERED_NO, ROAMING_NO,
+              DEFAULT_NETWORK_NO, 50000L, 25L, 100000L, 50L, 0L);
+          stats.insertEntry(entry);
+        }
+
+        final int iterations = 1000;
+        final int filterTag = 0;
+        final int filterUid = 10100;
+
+        Trace.beginSection("MajorityFilter");
+        for (int i = 0; i < iterations; ++i) {
+          stats.filteredClone(UID_ALL, INTERFACES_ALL, filterTag);
+        }
+        Trace.endSection();
+
+        Trace.beginSection("MinorityFilter");
+        for (int i = 0; i < iterations; ++i) {
+          stats.filteredClone(filterUid, INTERFACES_ALL, TAG_ALL);
+        }
+        Trace.endSection();
+    }
+
     @Test
     public void testFilter_InterfaceFilter() {
         final String testIf1 = "testif1";

From 76330fa8a2bb5b7a8bc6499c804c1598e4ce091f Mon Sep 17 00:00:00 2001
From: Chuwei He <chuweih@google.com>
Date: Wed, 16 Apr 2025 16:58:36 +0900
Subject: [PATCH 261/377] Add EthernetPortInfo class

This patch adds EthernetPortInfo class which represents information of
an EthernetPort object.
This class is mainlt used in network callbacks.

Bug: 397536853
Test: atest ConnectivityCoverageTests
Flag: EXEMPT mainline

Change-Id: I8ab9fa934a710080163d951bb6619050ca38a2ee
---
 .../src/android/net/EthernetPortInfo.java     | 215 +++++++++++++++
 .../android/net/EthernetPortInfoTest.java     | 245 ++++++++++++++++++
 2 files changed, 460 insertions(+)
 create mode 100644 framework-t/src/android/net/EthernetPortInfo.java
 create mode 100644 tests/unit/java/android/net/EthernetPortInfoTest.java

diff --git a/framework-t/src/android/net/EthernetPortInfo.java b/framework-t/src/android/net/EthernetPortInfo.java
new file mode 100644
index 0000000000..ba811eeb4c
--- /dev/null
+++ b/framework-t/src/android/net/EthernetPortInfo.java
@@ -0,0 +1,215 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.net;
+
+import android.annotation.Nullable;
+import android.net.EthernetManager.InterfaceState;
+import android.net.EthernetManager.Role;
+import android.os.Parcel;
+import android.os.Parcelable;
+import android.text.TextUtils;
+
+import java.util.Objects;
+
+/**
+ * A class representing information of an ethernet interface.
+ * EthernetPortInfo is mainly used in network callbacks.
+ * @hide
+ */
+public final class EthernetPortInfo implements Parcelable {
+    // Role of this ethernet interface, one of {@link EthernetManager.ROLE_SERVER},
+    // {@link EthernetManager.ROLE_CLIENT}, or {@link EthernetManager.ROLE_NONE}.
+    @Role
+    private final int mRole;
+
+    // State of this ethernet interface, one of {@link EthernetManager.STATE_LINK_UP},
+    // {@link EthernetManager.STATE_LINK_DOWN}, or {@link EthernetManager.STATE_ABSENT}.
+    @InterfaceState
+    private final int mState;
+
+    // Configuration of this ethernet interface.
+    private final EthernetConfiguration mConfig;
+
+    // Name of this ethernet interface.
+    private final String mInterfaceName;
+
+    // MAC address of this ethernet interface.
+    private final MacAddress mMacAddress;
+
+    // Interface index of this ethernet interface.
+    private final int mInterfaceIndex;
+
+    public EthernetPortInfo(String interfaceName, MacAddress macAddress,
+            int interfaceIndex, EthernetConfiguration config, @Role int role,
+            @InterfaceState int state) {
+        if (role != EthernetManager.ROLE_CLIENT && role != EthernetManager.ROLE_SERVER
+                && role != EthernetManager.ROLE_NONE) {
+            throw new IllegalArgumentException("Interface role is not valid, should be one of "
+                    + "{EthernetManager.ROLE_SERVER, EthernetManager.ROLE_CLIENT, "
+                    + "EthernetManager.ROLE_NONE}.");
+        }
+        mRole = role;
+
+        if (state != EthernetManager.STATE_ABSENT && state != EthernetManager.STATE_LINK_DOWN
+                && state != EthernetManager.STATE_LINK_UP) {
+            throw new IllegalArgumentException("Interface state is not valid, should be one of "
+                    + "{EthernetManager.STATE_ABSENT, EthernetManager.STATE_LINK_DOWN, "
+                    + "EthernetManager.STATE_LINK_UP}.");
+        }
+        mState = state;
+
+        if (TextUtils.isEmpty(interfaceName) || macAddress == null || interfaceIndex <= 0) {
+            throw new IllegalArgumentException("All of interface name, MAC address and interface"
+                    + " index need to be valid.");
+        }
+        mInterfaceName = interfaceName;
+        mMacAddress = macAddress;
+        mInterfaceIndex = interfaceIndex;
+
+        Objects.requireNonNull(config);
+        mConfig = config;
+    }
+
+    /**
+     * Returns role of this ethernet interface, one of {@link EthernetManager.ROLE_SERVER},
+     * {@link EthernetManager.ROLE_CLIENT}, or {@link EthernetManager.ROLE_NONE}.
+     */
+    @Role
+    public int getRole() {
+        return mRole;
+    }
+
+
+    /**
+     * Returns state of this ethernet interface, one of {@link EthernetManager.STATE_LINK_UP},
+     * {@link EthernetManager.STATE_LINK_DOWN}, or {@link EthernetManager.STATE_ABSENT}.
+     */
+    @InterfaceState
+    public int getState() {
+        return mState;
+    }
+
+    /**
+     * Returns the static configuration regarding meteredness. Note that this meteredness is only
+     * configured meteredness, while real meteredness state is only retrievable via
+     * {@link ConnectivityManager}.
+     */
+    public boolean getMeteredConfiguration() {
+        return mConfig.getNetworkCapabilities()
+                .hasCapability(NetworkCapabilities.NET_CAPABILITY_NOT_METERED);
+    }
+
+    /** Returns the name of this ethernet interface */
+    public String getInterfaceName() {
+        return mInterfaceName;
+    }
+
+    /** Returns the MAC address of this ethernet interface */
+    public MacAddress getMacAddress() {
+        return mMacAddress;
+    }
+
+    /** Returns the interface index of this ethernet interface */
+    public int getInterfaceIndex() {
+        return mInterfaceIndex;
+    }
+
+    /** Returns the configuration of this ethernet interface */
+    public EthernetConfiguration getConfiguration() {
+        return mConfig;
+    }
+
+    /** Returns a NetworkSpecifier that is guaranteed to match with this ethernet interface. */
+    public NetworkSpecifier getNetworkSpecifier() {
+        return new EthernetNetworkSpecifier(mInterfaceName, mMacAddress);
+    }
+
+    @Override
+    public String toString() {
+        return  "Role:" + mRole
+                + ", State:" + mState
+                + ", Configurations: " + mConfig
+                + ", Interface name:" + mInterfaceName
+                + ", MAC address:" + Objects.toString(mMacAddress)
+                + ", Interface index:" + mInterfaceIndex;
+    }
+
+    @Override
+    public int hashCode() {
+        return Objects.hash(mRole, mState, mConfig,
+                mInterfaceName, mMacAddress, mInterfaceIndex);
+    }
+
+    @Override
+    public boolean equals(@Nullable Object o) {
+        if (o == this) {
+            return true;
+        }
+
+        if (!(o instanceof EthernetPortInfo)) {
+            return false;
+        }
+
+        final EthernetPortInfo other = (EthernetPortInfo) o;
+        return (this.mRole == other.mRole)
+                && (this.mState == other.mState)
+                && Objects.equals(this.mConfig, other.mConfig)
+                && TextUtils.equals(this.mInterfaceName, other.mInterfaceName)
+                && Objects.equals(this.mMacAddress, other.mMacAddress)
+                && (this.mInterfaceIndex == other.mInterfaceIndex);
+    }
+
+    /** Implement the Parcelable interface */
+    @Override
+    public void writeToParcel(Parcel dest, int flags) {
+        dest.writeInt(mRole);
+        dest.writeInt(mState);
+        dest.writeParcelable(mConfig, flags);
+        dest.writeString(mInterfaceName);
+        dest.writeParcelable(mMacAddress, flags);
+        dest.writeInt(mInterfaceIndex);
+    }
+
+    /** Implement the Parcelable interface */
+    public static final Creator<EthernetPortInfo> CREATOR =
+            new Creator<EthernetPortInfo>() {
+                @Override
+                public EthernetPortInfo createFromParcel(Parcel in) {
+                    int role = in.readInt();
+                    int state = in.readInt();
+                    EthernetConfiguration config = in.readParcelable(
+                            EthernetConfiguration.class.getClassLoader());
+                    String ifname = in.readString();
+                    MacAddress hwaddr = in.readParcelable(
+                            MacAddress.class.getClassLoader());
+                    int index = in.readInt();
+                    return new EthernetPortInfo(
+                            ifname, hwaddr, index, config, role, state);
+                }
+
+                @Override
+                public EthernetPortInfo[] newArray(int size) {
+                    return new EthernetPortInfo[size];
+                }
+            };
+
+    /** Implement the Parcelable interface */
+    @Override
+    public int describeContents() {
+        return 0;
+    }
+}
diff --git a/tests/unit/java/android/net/EthernetPortInfoTest.java b/tests/unit/java/android/net/EthernetPortInfoTest.java
new file mode 100644
index 0000000000..6061f091f5
--- /dev/null
+++ b/tests/unit/java/android/net/EthernetPortInfoTest.java
@@ -0,0 +1,245 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.net;
+
+import static com.android.testutils.ParcelUtils.assertParcelingIsLossless;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotEquals;
+import static org.junit.Assert.assertThrows;
+
+import android.os.Build;
+
+import androidx.test.filters.SmallTest;
+
+import com.android.modules.utils.build.SdkLevel;
+import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo;
+import com.android.testutils.DevSdkIgnoreRunner;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import java.net.InetAddress;
+import java.util.ArrayList;
+
+@SmallTest
+@IgnoreUpTo(Build.VERSION_CODES.S_V2)
+@RunWith(DevSdkIgnoreRunner.class)
+public class EthernetPortInfoTest {
+    private final String mTestInterfaceName1 = "eth0";
+    private final MacAddress mTestMacAddress1 = MacAddress.fromString("0A:1B:2C:3D:4E:5F");
+    private final int mTestInterfaceIndex1 = 1;
+
+    private final String mTestInterfaceName2 = "eth1";
+    private final MacAddress mTestMacAddress2 = MacAddress.fromString("DE:AD:BE:EF:00:01");
+    private final int mTestInterfaceIndex2 = 2;
+
+    private EthernetConfiguration mConfig1;
+    private EthernetConfiguration mConfig2;
+    private NetworkCapabilities mNetworkCapabilities;
+    private EthernetPortInfo mEthernetPortInfo1;
+    private EthernetPortInfo mEthernetPortInfo2;
+
+    @Before
+    public void setUp() {
+        LinkAddress linkAddr = new LinkAddress("192.168.1.100/25");
+        InetAddress gateway = InetAddresses.parseNumericAddress("192.168.1.1");
+        InetAddress dns1 = InetAddresses.parseNumericAddress("8.8.8.8");
+        InetAddress dns2 = InetAddresses.parseNumericAddress("8.8.4.4");
+        ArrayList<InetAddress> dnsServers = new ArrayList<>();
+        dnsServers.add(dns1);
+        dnsServers.add(dns2);
+        StaticIpConfiguration staticIpConfig = new StaticIpConfiguration.Builder()
+                .setIpAddress(linkAddr)
+                .setGateway(gateway)
+                .setDnsServers(dnsServers)
+                .build();
+        ProxyInfo proxy1 = ProxyInfo.buildDirectProxy("test1", 8888);
+        ProxyInfo proxy2 = ProxyInfo.buildDirectProxy("test2", 8888);
+
+        IpConfiguration ipConfig1 = new IpConfiguration.Builder()
+                .setStaticIpConfiguration(staticIpConfig)
+                .setHttpProxy(proxy1)
+                .build();
+        IpConfiguration ipConfig2 = new IpConfiguration.Builder()
+                .setStaticIpConfiguration(staticIpConfig)
+                .setHttpProxy(proxy2)
+                .build();
+
+        mNetworkCapabilities = new NetworkCapabilities.Builder()
+                .addTransportType(NetworkCapabilities.TRANSPORT_ETHERNET)
+                .build();
+        mConfig1 = new EthernetConfiguration(ipConfig1, mNetworkCapabilities);
+        mConfig2 = new EthernetConfiguration(ipConfig2, mNetworkCapabilities);
+
+        mEthernetPortInfo1 = new EthernetPortInfo(
+                mTestInterfaceName1, mTestMacAddress1, mTestInterfaceIndex1, mConfig1,
+                EthernetManager.ROLE_CLIENT, EthernetManager.STATE_LINK_UP);
+        mEthernetPortInfo2 = new EthernetPortInfo(
+                mTestInterfaceName2, mTestMacAddress2, mTestInterfaceIndex2, mConfig2,
+                EthernetManager.ROLE_CLIENT, EthernetManager.STATE_LINK_UP);
+    }
+
+    @Test
+    public void testConstructor() {
+        EthernetPortInfo portInfo = new EthernetPortInfo(
+                mTestInterfaceName1, mTestMacAddress1, mTestInterfaceIndex1, mConfig1,
+                EthernetManager.ROLE_CLIENT, EthernetManager.STATE_LINK_UP);
+        assertEquals(portInfo.getInterfaceName(), mTestInterfaceName1);
+        assertEquals(portInfo.getMacAddress(), mTestMacAddress1);
+        assertEquals(portInfo.getInterfaceIndex(), mTestInterfaceIndex1);
+        assertEquals(portInfo.getConfiguration(), mConfig1);
+        assertEquals(portInfo.getMeteredConfiguration(),
+                mNetworkCapabilities.hasCapability(NetworkCapabilities.NET_CAPABILITY_NOT_METERED));
+        assertEquals(portInfo.getRole(), EthernetManager.ROLE_CLIENT);
+        assertEquals(portInfo.getState(), EthernetManager.STATE_LINK_UP);
+    }
+
+    @Test
+    public void testConstructorWithNullIfname() {
+        assertThrows("All of interface name, MAC address and interface"
+                        + " index need to be valid.",
+                IllegalArgumentException.class,
+                () -> new EthernetPortInfo(
+                        null, mTestMacAddress1, mTestInterfaceIndex1, mConfig1,
+                        EthernetManager.ROLE_CLIENT, EthernetManager.STATE_LINK_UP));
+    }
+
+    @Test
+    public void testConstructorWithEmptyIfname() {
+        assertThrows("All of interface name, MAC address and interface"
+                        + " index need to be valid.",
+                IllegalArgumentException.class,
+                () -> new EthernetPortInfo(
+                        "", mTestMacAddress1, mTestInterfaceIndex1, mConfig1,
+                        EthernetManager.ROLE_CLIENT, EthernetManager.STATE_LINK_UP));
+    }
+
+    @Test
+    public void testConstructorWithNullAddress() {
+        assertThrows("All of interface name, MAC address and interface"
+                        + " index need to be valid.",
+                IllegalArgumentException.class,
+                () -> new EthernetPortInfo(
+                        mTestInterfaceName1, null, mTestInterfaceIndex1, mConfig1,
+                        EthernetManager.ROLE_CLIENT, EthernetManager.STATE_LINK_UP));
+    }
+
+    @Test
+    public void testConstructorWithInvalidIndex() {
+        assertThrows("All of interface name, MAC address and interface"
+                        + " index need to be valid.",
+                IllegalArgumentException.class,
+                () -> new EthernetPortInfo(
+                        mTestInterfaceName1, mTestMacAddress1, 0, mConfig1,
+                        EthernetManager.ROLE_CLIENT, EthernetManager.STATE_LINK_UP));
+    }
+
+    @Test
+    public void testConstructorWithNullConfig() {
+        assertThrows(NullPointerException.class,
+                () -> new EthernetPortInfo(
+                        mTestInterfaceName1, mTestMacAddress1, mTestInterfaceIndex1, null,
+                        EthernetManager.ROLE_CLIENT, EthernetManager.STATE_LINK_UP));
+    }
+
+    @Test
+    public void testConstructorWithInvalidRole() {
+        assertThrows("Interface role is not valid, should be one of "
+                        + "{EthernetManager.ROLE_SERVER, EthernetManager.ROLE_CLIENT, "
+                        + "EthernetManager.ROLE_NONE}.",
+                IllegalArgumentException.class,
+                () -> new EthernetPortInfo(
+                        mTestInterfaceName1, mTestMacAddress1, mTestInterfaceIndex1, mConfig1,
+                        -1, EthernetManager.STATE_LINK_UP));
+    }
+
+    @Test
+    public void testConstructorWithInvalidInterfaceState() {
+        assertThrows("Interface state is not valid, should be one of "
+                        + "{EthernetManager.STATE_ABSENT, EthernetManager.STATE_LINK_DOWN, "
+                        + "EthernetManager.STATE_LINK_UP}.",
+                IllegalArgumentException.class,
+                () -> new EthernetPortInfo(
+                mTestInterfaceName1, mTestMacAddress1, mTestInterfaceIndex1, mConfig1,
+                EthernetManager.ROLE_CLIENT, -1));
+    }
+
+    @Test
+    public void testHashCodeConsistency() {
+        int hash1 = mEthernetPortInfo1.hashCode();
+        int hash2 = mEthernetPortInfo1.hashCode();
+        assertEquals(hash1, hash2);
+    }
+
+    @Test
+    public void testHashCodeOfDifferentConfig() {
+        int hash1 = mEthernetPortInfo1.hashCode();
+        int hash2 = mEthernetPortInfo2.hashCode();
+        assertNotEquals(hash1, hash2);
+    }
+
+    @Test
+    public void testHashCodeOfTheSameConfig() {
+        EthernetPortInfo portInfo1 = new EthernetPortInfo(
+                mTestInterfaceName1, mTestMacAddress1, mTestInterfaceIndex1, mConfig1,
+                EthernetManager.ROLE_CLIENT, EthernetManager.STATE_LINK_UP);
+        EthernetPortInfo portInfo2 = new EthernetPortInfo(
+                mTestInterfaceName1, mTestMacAddress1, mTestInterfaceIndex1, mConfig1,
+                EthernetManager.ROLE_CLIENT, EthernetManager.STATE_LINK_UP);
+        int hash1 = portInfo1.hashCode();
+        int hash2 = portInfo2.hashCode();
+        assertEquals(hash1, hash2);
+    }
+
+    @Test
+    public void testToString() {
+        String expect;
+        // For devices with SDK level at least V, NOT_BANDWIDTH_CONSTRAINED is included as a
+        // default capability.
+        if (SdkLevel.isAtLeastV()) {
+            expect = "Role:1, State:2, Configurations: IP configurations: "
+                    + "IP assignment: STATIC\n"
+                    + "Static configuration: IP address 192.168.1.100/25 Gateway 192.168.1.1 "
+                    + " DNS servers: [ 8.8.8.8 8.8.4.4 ] Domains \n"
+                    + "Proxy settings: PAC\n"
+                    + "HTTP proxy: [test1] 8888\n"
+                    + "Network capabilities: [ Transports: ETHERNET Capabilities: "
+                    + "NOT_RESTRICTED&TRUSTED&NOT_VPN&NOT_BANDWIDTH_CONSTRAINED "
+                    + "UnderlyingNetworks: Null], Interface name:eth0, "
+                    + "MAC address:0a:1b:2c:3d:4e:5f, Interface index:1";
+        } else {
+            expect = "Role:1, State:2, Configurations: IP configurations: "
+                    + "IP assignment: STATIC\n"
+                    + "Static configuration: IP address 192.168.1.100/25 Gateway 192.168.1.1 "
+                    + " DNS servers: [ 8.8.8.8 8.8.4.4 ] Domains \n"
+                    + "Proxy settings: PAC\n"
+                    + "HTTP proxy: [test1] 8888\n"
+                    + "Network capabilities: [ Transports: ETHERNET Capabilities: "
+                    + "NOT_RESTRICTED&TRUSTED&NOT_VPN UnderlyingNetworks: Nu"
+                    + "ll], Interface name:eth0, MAC address:0a:1b:2c:3d:4e:5f, Interface index:1";
+
+        }
+        assertEquals(mEthernetPortInfo1.toString(), expect);
+    }
+
+    @Test
+    public void testParcel() {
+        assertParcelingIsLossless(mEthernetPortInfo1);
+    }
+}

From 18a0131a4c1dac0a6652c5a9d454d018a56ed132 Mon Sep 17 00:00:00 2001
From: Lorenzo Colitti <lorenzo@google.com>
Date: Fri, 16 May 2025 12:55:57 +0900
Subject: [PATCH 262/377] Rename the methods in the legacy codepath for
 clarity.

This is a no-op change.

ensureIpServerStartedForInterface -> ensureIpServerStartedLegacy
ensureIpServerStartedForType -> ensureIpServerStarted

Also pass in the type to ensureIpServerStartedLegacy. There's
no point reading calling ifaceNameToType again, the only thing
this can possibly do is get a new type that disagrees with the
previous one.

Bug: 408087033
Flag: EXEMPT refactor
Test: no-op covered by existing tests
Change-Id: Ie6f3859eab46a085c0d332b5de12473180032102
---
 .../networkstack/tethering/Tethering.java       | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/Tethering/src/com/android/networkstack/tethering/Tethering.java b/Tethering/src/com/android/networkstack/tethering/Tethering.java
index f7e9c3ba99..014166f180 100644
--- a/Tethering/src/com/android/networkstack/tethering/Tethering.java
+++ b/Tethering/src/com/android/networkstack/tethering/Tethering.java
@@ -640,7 +640,7 @@ public class Tethering {
         }
 
         if (enabled) {
-            ensureIpServerStartedForInterface(iface);
+            ensureIpServerStartedLegacy(iface, type);
         } else {
             ensureIpServerStopped(iface);
         }
@@ -1662,7 +1662,7 @@ public class Tethering {
     }
 
     private void enableIpServing(@NonNull TetheringRequest request, String ifname, boolean isNcm) {
-        ensureIpServerStartedForType(ifname, request.getTetheringType(), isNcm);
+        ensureIpServerStarted(ifname, request.getTetheringType(), isNcm);
         if (tetherInternal(request, ifname) != TETHER_ERROR_NO_ERROR) {
             Log.e(TAG, "unable start tethering on iface " + ifname);
         }
@@ -3053,20 +3053,23 @@ public class Tethering {
         return type != TETHERING_INVALID;
     }
 
-    private void ensureIpServerStartedForInterface(final String iface) {
+    /**
+     * Creates an IpServer, but does not enable it. Only used by legacy codepaths:
+     * - Pre-T BLUETOOTH
+     * - (Pre-S) WIGIG
+     */
+    private void ensureIpServerStartedLegacy(final String iface, int interfaceType) {
         // If we don't care about this type of interface, ignore.
-        final int interfaceType = ifaceNameToType(iface);
         if (!checkTetherableType(interfaceType)) {
             mLog.log(iface + " is used for " + interfaceType + " which is not tetherable"
                      + " (-1 == INVALID is expected on upstream interface)");
             return;
         }
 
-        ensureIpServerStartedForType(iface, interfaceType, false /* isNcm */);
+        ensureIpServerStarted(iface, interfaceType, false /* isNcm */);
     }
 
-    private void ensureIpServerStartedForType(final String iface, int interfaceType,
-            boolean isNcm) {
+    private void ensureIpServerStarted(final String iface, int interfaceType, boolean isNcm) {
         // If we have already started a TISM for this interface, skip.
         if (mTetherStates.containsKey(iface)) {
             mLog.log("active iface (" + iface + ") reported as added, ignoring");

From 981a4f35c581583bd28b73b1baa022c1cc12305c Mon Sep 17 00:00:00 2001
From: Lorenzo Colitti <lorenzo@google.com>
Date: Fri, 16 May 2025 12:56:06 +0900
Subject: [PATCH 263/377] Never create IpServers based on interface up for WIFI
 and WIFI_P2P.

This is not necessary because creating the IpServer based on
interface events is only necessary for the tether() API, and
field metrics indicate that that API is unused for WIFI and
WIFI_P2P.

Also add comments to clarify when the legacy codepath is taken.

Bug: 408087033
Test: updated unit tests
Flag: EXEMPT refactor
Change-Id: I64734ee710e9782903d4422efb0370d6fec77dd7
---
 .../networkstack/tethering/Tethering.java     | 30 +++++++------
 .../networkstack/tethering/TetheringTest.java | 42 ++++++-------------
 2 files changed, 30 insertions(+), 42 deletions(-)

diff --git a/Tethering/src/com/android/networkstack/tethering/Tethering.java b/Tethering/src/com/android/networkstack/tethering/Tethering.java
index 014166f180..8c1167cb32 100644
--- a/Tethering/src/com/android/networkstack/tethering/Tethering.java
+++ b/Tethering/src/com/android/networkstack/tethering/Tethering.java
@@ -616,28 +616,32 @@ public class Tethering {
         // Cannot happen: on S+, tetherableWigigRegexps is always empty.
         if (type == TETHERING_WIGIG && SdkLevel.isAtLeastS()) return;
 
-        // After V, disallow this legacy codepath from starting tethering of any type:
-        // everything must call ensureIpServerStarted directly.
+        // After V, don't allow this legacy codepath to create IpServers for any tethering type:
+        // everything must call ensureIpServerStarted directly. Also, on any release, don't create
+        // IpServers for WIFI or WIFI_P2P. These types always use the enableIpServing path.
         //
         // Don't touch the teardown path for now. It's more complicated because:
         // - ensureIpServerStarted and ensureIpServerStopped act on different
-        //   tethering types.
+        //   tethering types, and ensureIpServerStopped doesn't look at the type at all.
         // - Depending on the type, ensureIpServerStopped is either called twice (once
         //   on interface down and once on interface removed) or just once (on
-        //   interface removed).
+        //   interface removed). It's not clear whether it's possible to remove one of
+        //   these two calls without causing breakage in the field - for example, it's
+        //   possible that if the code did not call ensureIpServerStopped on wifi, then
+        //   when wifi tethering is disabled and wifi goes into client mode, tethering
+        //   has not brought down the IpServer because the WIFI_AP_STATE_CHANGED_ACTION
+        //   was delayed.
         //
-        // Note that this only affects WIFI and WIFI_P2P. The other types are either
-        // ignored above, or ignored by ensureIpServerStarted. Note that even for WIFI
-        // and WIFI_P2P, this code should not ever run in normal use, because the
-        // hotspot and p2p code do not call tether(). It's possible that this could
-        // happen in the field due to unforeseen OEM modifications. If it does happen,
-        // a terrible error is logged in tether().
         // TODO: fix the teardown path to stop depending on interface state notifications.
         // These are not necessary since most/all link layers have their own teardown
         // notifications, and can race with those notifications.
-        if (enabled && SdkLevel.isAtLeastB()) {
-            return;
-        }
+        if (enabled && SdkLevel.isAtLeastB()) return;
+
+        if (enabled && (type == TETHERING_WIFI || type == TETHERING_WIFI_P2P))  return;
+
+        // In this method, INVALID includes ETHERNET and VIRTUAL, because ifaceNameToType never
+        // returns these. The legacy codepath does not support these.
+        if (enabled && type == TETHERING_INVALID) return;
 
         if (enabled) {
             ensureIpServerStartedLegacy(iface, type);
diff --git a/Tethering/tests/unit/src/com/android/networkstack/tethering/TetheringTest.java b/Tethering/tests/unit/src/com/android/networkstack/tethering/TetheringTest.java
index cb25145a4d..a68bc51be9 100644
--- a/Tethering/tests/unit/src/com/android/networkstack/tethering/TetheringTest.java
+++ b/Tethering/tests/unit/src/com/android/networkstack/tethering/TetheringTest.java
@@ -1008,23 +1008,11 @@ public class TetheringTest {
         }
         sendWifiApStateChanged(WIFI_AP_STATE_ENABLED);
 
-        // If, and only if, Tethering received an interface status changed then
-        // it creates a IpServer and sends out a broadcast indicating that the
-        // interface is "available".
-        if (emulateInterfaceStatusChanged) {
-            if (!SdkLevel.isAtLeastB()) {
-                // There is 1 IpServer state change event: STATE_AVAILABLE
-                verify(mNotificationUpdater, times(1)).onDownstreamChanged(DOWNSTREAM_NONE);
-                verifyTetheringBroadcast(TEST_WLAN_IFNAME, EXTRA_AVAILABLE_TETHER);
-                verify(mWifiManager).updateInterfaceIpState(
-                        TEST_WLAN_IFNAME, WifiManager.IFACE_IP_MODE_UNSPECIFIED);
-            } else {
-                // Starting in B, ignore the interfaceStatusChanged
-                verify(mNotificationUpdater, never()).onDownstreamChanged(DOWNSTREAM_NONE);
-                verify(mWifiManager, never()).updateInterfaceIpState(
-                        TEST_WLAN_IFNAME, WifiManager.IFACE_IP_MODE_UNSPECIFIED);
-            }
-        }
+        // Wi-Fi tethering ignores interface up events. The behaviour is the same
+        // regardless of whether the interface up event was received or not.
+        verify(mNotificationUpdater, never()).onDownstreamChanged(DOWNSTREAM_NONE);
+        verify(mWifiManager, never()).updateInterfaceIpState(
+                TEST_WLAN_IFNAME, WifiManager.IFACE_IP_MODE_UNSPECIFIED);
         verifyNoMoreInteractions(mNetd);
         verifyNoMoreInteractions(mWifiManager);
     }
@@ -2046,18 +2034,10 @@ public class TetheringTest {
         sendWifiApStateChanged(WIFI_AP_STATE_ENABLED);
         mLooper.dispatchAll();
 
-        if (!SdkLevel.isAtLeastB()) {
-            // There is 1 IpServer state change event: STATE_AVAILABLE from interfaceStatusChanged
-            verify(mNotificationUpdater, times(1)).onDownstreamChanged(DOWNSTREAM_NONE);
-            verifyTetheringBroadcast(TEST_WLAN_IFNAME, EXTRA_AVAILABLE_TETHER);
-            verify(mWifiManager).updateInterfaceIpState(
-                    TEST_WLAN_IFNAME, WifiManager.IFACE_IP_MODE_UNSPECIFIED);
-        } else {
-            // Starting in B, ignore the interfaceStatusChanged
-            verify(mNotificationUpdater, never()).onDownstreamChanged(DOWNSTREAM_NONE);
-            verify(mWifiManager, never()).updateInterfaceIpState(
-                    TEST_WLAN_IFNAME, WifiManager.IFACE_IP_MODE_UNSPECIFIED);
-        }
+        // Wi-Fi tethering ignores interface up events.
+        verify(mNotificationUpdater, never()).onDownstreamChanged(DOWNSTREAM_NONE);
+        verify(mWifiManager, never()).updateInterfaceIpState(
+                TEST_WLAN_IFNAME, WifiManager.IFACE_IP_MODE_UNSPECIFIED);
         verifyNoMoreInteractions(mNetd);
         verifyNoMoreInteractions(mWifiManager);
     }
@@ -3428,6 +3408,10 @@ public class TetheringTest {
         mTethering.legacyTether(TEST_WIFI_IFNAME, result);
         mLooper.dispatchAll();
         result.assertHasResult();
+
+        // No IpServer should have been started, so no STATE_AVAILABLE should have been sent, and no
+        // tethering broadcasts should have been sent.
+        assertEquals(0, mIntents.size());
     }
 
     @Test

From 71c181382708abc0f87648924fdb29507ea5411b Mon Sep 17 00:00:00 2001
From: Lorenzo Colitti <lorenzo@google.com>
Date: Fri, 16 May 2025 13:16:03 +0900
Subject: [PATCH 264/377] Remove ensureIpServerStartedLegacy.

Fold the method into its only caller. This is a no-op change.

The only types that could previously make it to this method are
BLUETOOTH pre-T and WIGIG pre-S. Therefore the call to
checkTetherableType is mostly redundant, except for the check
that WIGIG should not be brought up if the device does not
have FEATURE_WIFI. Put that check into the caller as well.

Bug: 408087033
Flag: EXEMPT refactor
Test: no-op covered by existing tests
Change-Id: I380d649c2fd8af8b00a55a5bb7d2254c8b126a34
---
 .../networkstack/tethering/Tethering.java     | 23 ++++---------------
 1 file changed, 5 insertions(+), 18 deletions(-)

diff --git a/Tethering/src/com/android/networkstack/tethering/Tethering.java b/Tethering/src/com/android/networkstack/tethering/Tethering.java
index 8c1167cb32..4bbe130a8a 100644
--- a/Tethering/src/com/android/networkstack/tethering/Tethering.java
+++ b/Tethering/src/com/android/networkstack/tethering/Tethering.java
@@ -614,7 +614,10 @@ public class Tethering {
         if (type == TETHERING_BLUETOOTH && SdkLevel.isAtLeastT()) return;
 
         // Cannot happen: on S+, tetherableWigigRegexps is always empty.
-        if (type == TETHERING_WIGIG && SdkLevel.isAtLeastS()) return;
+        if (type == TETHERING_WIGIG
+                && (SdkLevel.isAtLeastS() || !hasSystemFeature(PackageManager.FEATURE_WIFI))) {
+            return;
+        }
 
         // After V, don't allow this legacy codepath to create IpServers for any tethering type:
         // everything must call ensureIpServerStarted directly. Also, on any release, don't create
@@ -644,7 +647,7 @@ public class Tethering {
         if (enabled && type == TETHERING_INVALID) return;
 
         if (enabled) {
-            ensureIpServerStartedLegacy(iface, type);
+            ensureIpServerStarted(iface, type, false /* isNcm */);
         } else {
             ensureIpServerStopped(iface);
         }
@@ -3057,22 +3060,6 @@ public class Tethering {
         return type != TETHERING_INVALID;
     }
 
-    /**
-     * Creates an IpServer, but does not enable it. Only used by legacy codepaths:
-     * - Pre-T BLUETOOTH
-     * - (Pre-S) WIGIG
-     */
-    private void ensureIpServerStartedLegacy(final String iface, int interfaceType) {
-        // If we don't care about this type of interface, ignore.
-        if (!checkTetherableType(interfaceType)) {
-            mLog.log(iface + " is used for " + interfaceType + " which is not tetherable"
-                     + " (-1 == INVALID is expected on upstream interface)");
-            return;
-        }
-
-        ensureIpServerStarted(iface, interfaceType, false /* isNcm */);
-    }
-
     private void ensureIpServerStarted(final String iface, int interfaceType, boolean isNcm) {
         // If we have already started a TISM for this interface, skip.
         if (mTetherStates.containsKey(iface)) {

From d1c8cc126ed368dd7aa4ddc1de3948a680eba2f2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Wed, 2 Apr 2025 12:53:02 -0700
Subject: [PATCH 265/377] netbpfload.rc: bump to 25q3
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

(from https://android-review.git.corp.google.com/c/platform/packages/modules/Connectivity/+/3560067)

Flag: EXEMPT mainline
Bug: 407617658
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I12007e5113594ad6bba8bcd43bb137471e4698dc
---
 bpf/loader/netbpfload.rc | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/bpf/loader/netbpfload.rc b/bpf/loader/netbpfload.rc
index 3dedabb559..420976a39c 100644
--- a/bpf/loader/netbpfload.rc
+++ b/bpf/loader/netbpfload.rc
@@ -1,4 +1,8 @@
+# 2025 2 36 0 0 1 # 25q3 sdk/api level 36.0 - Android 16 QPR1
+
+# Previous versions (for documentation)
 # 2025 2 36 0 0 # 25q2 sdk/api level 36.0 - Android 16 Baklava QPR0
+# (versions before A16 do not include anything here)
 
 # Note: This will actually execute /apex/com.android.tethering/bin/netbpfload
 # by virtue of 'service bpfloader' being overridden by the apex shipped .rc

From 1daafe04f107a2e2968e933314efa59c21ef03af Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Sat, 17 May 2025 02:47:31 -0700
Subject: [PATCH 266/377] bpf: remove unused tethering xdp programs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We can always trivially add it back if we ever manage
to make XDP work, but that will likely be on at least 6.1+
as that's the minimum kernel version on Pixel 6+ now.

In the mean time, we can just delete it, and very
slightly speed up boot time (less things to verify).

Note: code search in android for
  xdp_tether -file:kernel_logs/
  xdp/tether -file:kernel_logs/
doesn't find any hits outside this one file.

Test: TreeHugger
Flag: EXEMPT dead code removal
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I39c040d79b4f175cafc141e8f0c9e631e372ebd2
---
 bpf/progs/offload.c | 68 +--------------------------------------------
 1 file changed, 1 insertion(+), 67 deletions(-)

diff --git a/bpf/progs/offload.c b/bpf/progs/offload.c
index b34fe6fd88..16fc393b5d 100644
--- a/bpf/progs/offload.c
+++ b/bpf/progs/offload.c
@@ -750,74 +750,8 @@ DEFINE_BPF_PROG_KVER_RANGE("schedcls/tether_upstream4_ether$stub", AID_ROOT, AID
 
 // ----- XDP Support -----
 
+// java populates this map, and bpf_existence_test requires it on S+
 DEFINE_BPF_MAP_GRW(tether_dev_map, DEVMAP_HASH, uint32_t, uint32_t, 64, AID_NETWORK_STACK)
 
-static inline __always_inline int do_xdp_forward6(__unused struct xdp_md *ctx,
-        __unused const struct rawip_bool rawip, __unused const struct stream_bool stream) {
-    return XDP_PASS;
-}
-
-static inline __always_inline int do_xdp_forward4(__unused struct xdp_md *ctx,
-        __unused const struct rawip_bool rawip, __unused const struct stream_bool stream) {
-    return XDP_PASS;
-}
-
-static inline __always_inline int do_xdp_forward_ether(struct xdp_md *ctx,
-                                                       const struct stream_bool stream) {
-    const void* data = (void*)(long)ctx->data;
-    const void* data_end = (void*)(long)ctx->data_end;
-    const struct ethhdr* eth = data;
-
-    // Make sure we actually have an ethernet header
-    if ((void*)(eth + 1) > data_end) return XDP_PASS;
-
-    if (eth->h_proto == htons(ETH_P_IPV6))
-        return do_xdp_forward6(ctx, ETHER, stream);
-    if (eth->h_proto == htons(ETH_P_IP))
-        return do_xdp_forward4(ctx, ETHER, stream);
-
-    // Anything else we don't know how to handle...
-    return XDP_PASS;
-}
-
-static inline __always_inline int do_xdp_forward_rawip(struct xdp_md *ctx,
-                                                       const struct stream_bool stream) {
-    const void* data = (void*)(long)ctx->data;
-    const void* data_end = (void*)(long)ctx->data_end;
-
-    // The top nibble of both IPv4 and IPv6 headers is the IP version.
-    if (data_end - data < 1) return XDP_PASS;
-    const uint8_t v = (*(uint8_t*)data) >> 4;
-
-    if (v == 6) return do_xdp_forward6(ctx, RAWIP, stream);
-    if (v == 4) return do_xdp_forward4(ctx, RAWIP, stream);
-
-    // Anything else we don't know how to handle...
-    return XDP_PASS;
-}
-
-#define DEFINE_XDP_PROG(str, func) \
-    DEFINE_BPF_PROG_KVER(str, AID_ROOT, AID_NETWORK_STACK, func, KVER_5_10)(struct xdp_md *ctx)
-
-DEFINE_XDP_PROG("xdp/tether_downstream_ether",
-                 xdp_tether_downstream_ether) {
-    return do_xdp_forward_ether(ctx, DOWNSTREAM);
-}
-
-DEFINE_XDP_PROG("xdp/tether_downstream_rawip",
-                 xdp_tether_downstream_rawip) {
-    return do_xdp_forward_rawip(ctx, DOWNSTREAM);
-}
-
-DEFINE_XDP_PROG("xdp/tether_upstream_ether",
-                 xdp_tether_upstream_ether) {
-    return do_xdp_forward_ether(ctx, UPSTREAM);
-}
-
-DEFINE_XDP_PROG("xdp/tether_upstream_rawip",
-                 xdp_tether_upstream_rawip) {
-    return do_xdp_forward_rawip(ctx, UPSTREAM);
-}
-
 LICENSE("Apache 2.0");
 CRITICAL("Connectivity (Tethering)");

From 501c9de9eff7fd65c135f6a525abefbf3e1a6a21 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Sat, 17 May 2025 03:11:49 -0700
Subject: [PATCH 267/377] bpf: remove CRITICAL sections from mainline
 networking programs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All mainline networking programs are critical by default.

It is still parsed by the platform and uprobestats bpf loaders,
but not by NetBpfLoad, where criticality is simply hardcoded.

You can cs/ for
  ["]critical["] file:bpf
in android and it'll find the relevant:
  ret = readSectionByName("critical", elfFile, critical);
lines.

Test: TreeHugger
Flag: EXEMPT dead code removal
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I983d0072168a89d81aa9a1e79a1e6f94bf8e822b
---
 bpf/progs/clatd.c      | 1 -
 bpf/progs/dscpPolicy.c | 1 -
 bpf/progs/netd.c       | 1 -
 bpf/progs/offload.c    | 1 -
 bpf/progs/test.c       | 1 -
 5 files changed, 5 deletions(-)

diff --git a/bpf/progs/clatd.c b/bpf/progs/clatd.c
index 690a57236e..e812e6867f 100644
--- a/bpf/progs/clatd.c
+++ b/bpf/progs/clatd.c
@@ -401,4 +401,3 @@ DEFINE_BPF_PROG("schedcls/egress4/clat_rawip", AID_ROOT, AID_SYSTEM, sched_cls_e
 }
 
 LICENSE("Apache 2.0");
-CRITICAL("Connectivity");
diff --git a/bpf/progs/dscpPolicy.c b/bpf/progs/dscpPolicy.c
index 94d717be5d..fca3fe29e6 100644
--- a/bpf/progs/dscpPolicy.c
+++ b/bpf/progs/dscpPolicy.c
@@ -278,4 +278,3 @@ DEFINE_BPF_PROG_KVER("schedcls/set_dscp_ether", AID_ROOT, AID_SYSTEM, schedcls_s
 }
 
 LICENSE("Apache 2.0");
-CRITICAL("Connectivity");
diff --git a/bpf/progs/netd.c b/bpf/progs/netd.c
index 60c5a1c2ea..223e6c73c3 100644
--- a/bpf/progs/netd.c
+++ b/bpf/progs/netd.c
@@ -902,4 +902,3 @@ DEFINE_NETD_V_BPF_PROG_KVER("setsockopt/prog", setsockopt_prog, KVER_5_4)
 }
 
 LICENSE("Apache 2.0");
-CRITICAL("Connectivity and netd");
diff --git a/bpf/progs/offload.c b/bpf/progs/offload.c
index b34fe6fd88..cb47c85d16 100644
--- a/bpf/progs/offload.c
+++ b/bpf/progs/offload.c
@@ -820,4 +820,3 @@ DEFINE_XDP_PROG("xdp/tether_upstream_rawip",
 }
 
 LICENSE("Apache 2.0");
-CRITICAL("Connectivity (Tethering)");
diff --git a/bpf/progs/test.c b/bpf/progs/test.c
index 4dba6b9878..20a345a524 100644
--- a/bpf/progs/test.c
+++ b/bpf/progs/test.c
@@ -43,4 +43,3 @@ DEFINE_BPF_PROG_KVER("skfilter/match", AID_ROOT, AID_ROOT, match, KVER_INF)
 }
 
 LICENSE("Apache 2.0");
-CRITICAL("Networking xTS tests");

From 1da1945e261b597dbfa94b8eed9494cfeb5669be Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Fri, 16 May 2025 11:07:51 -0700
Subject: [PATCH 268/377] NetBpfLoad: disallow 32-bit userspace on 6.13+
 kernels
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is basically a no-op as 32-bit netd already fails on android-mainline @ 6.13 (we're now at 6.14, 6.15 is coming in a few weeks).
I know this because we had to fix ACK 6.12, and didn't port it forward.

Note: AFAIK TV is planning to release on 25Q2 and then 27Q2,
so this 26Q2+ doesn't actually affect them till a year later in 27Q2.

Modern arm cores are dropping 32-bit cpu instruction decode support.
This already happened on Pixel 8+ (Tensor G3+) and is soon coming
to the GCE cloud machines underpinning our cuttlefish VMs
(this is very much an industry wide trend for modern aarch64 cores,
I believe all new application cores since 2023 have been 64-bit only).

Pixel 6a is AFAIK the last pixel with 32-bit application support,
and that is reaching EOL approximately in July 2027.
(while most test coverage is on Pixel 6/6pro which EOLs in Oct 2026)

Note though that this isn't a great example: AFAIK all Pixels
have had 64-bit system userspace (which is what we care about here)
The transition happened in the final Nexus, the year before Pixel 1.

This means we're going to start losing *any* remaining vestiges
of test coverage that we still (might) have.

Test: TreeHugger
Flag: EXEMPT mainline
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ie8a5a5dafd2f0e20ef4651c3a69957fde374ae4b
---
 bpf/loader/NetBpfLoad.cpp | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/bpf/loader/NetBpfLoad.cpp b/bpf/loader/NetBpfLoad.cpp
index 631f5c51da..d910da2ccd 100644
--- a/bpf/loader/NetBpfLoad.cpp
+++ b/bpf/loader/NetBpfLoad.cpp
@@ -1795,6 +1795,19 @@ static int doLoad(char** argv, char * const envp[]) {
         }
     }
 
+    // Linux 6.12 was an LTS released at the end of 2024 (Nov 17),
+    // and was first supported by Android 16 / 25Q2 (released in June 2025).
+    // The next Linux LTS should be released near the end of 2025,
+    // and will likely be 6.18.
+    // Since officially Android only supports LTS, 6.13+ really means 6.18+,
+    // and won't be supported before 2026, most likely Android 17 / 26Q2.
+    // 6.13+ (implying 26Q2+) requires 64-bit userspace.
+    if (isUserspace32bit() && isAtLeastKernelVersion(6, 13, 0)) {
+        // due to previous check only reachable on Arm && (<=T kernel uprev || TV || Wear)
+        ALOGE("64-bit userspace required on 6.13+ kernels.");
+        return 1;
+    }
+
     if (isAtLeast25Q2) {
         FILE * f = fopen("/system/etc/init/netbpfload.rc", "re");
         if (!f) {

From 57db7c5e7305e7568deb5e36220ebd58eb14e609 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Sun, 18 May 2025 01:44:14 -0700
Subject: [PATCH 269/377] bpf: Update SDK level constants
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is to provide for QPRs and the upcoming future.

Test: TreeHugger
Flag: EXEMPT mainline/no-op
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ia68b5f14ff686ec06155caf022148f6e139bbb5e
---
 bpf/headers/include/bpf_helpers.h | 47 +++++++++++++++++++++++--------
 1 file changed, 35 insertions(+), 12 deletions(-)

diff --git a/bpf/headers/include/bpf_helpers.h b/bpf/headers/include/bpf_helpers.h
index fe64538e60..8526745d94 100644
--- a/bpf/headers/include/bpf_helpers.h
+++ b/bpf/headers/include/bpf_helpers.h
@@ -155,22 +155,45 @@ struct kver_uint { unsigned int kver; };
 
 // Helpers for writing sdk level specific bpf programs
 //
-// Note: we choose to follow sdk api level values, but there is no real need for this:
-// These just need to be monotonically increasing.  We could also use values ten or even
-// a hundred times larger to leave room for quarters or months.  We may also just use
-// dates or something (2502 or 202506 for 25Q2) or even the mainline bpfloader version...
+// Note: we choose to follow 'ro.build.version.sdk_full'
+// (or just 'sdk' if 'sdk_full' is not available) values,
+// multiplied by 100, with 1 added per QPR.
+// This will (eventually) match our bpfloader versioning scheme.
+//
+// This is just for ease of use, really these are only
+// ever compared to each other, so they only need to be
+// monotonically increasing.
+//
 // For now this easily suffices for our use case.
+//
+// Note: 24Q1 is the first trunk stable release,
+// and thus where quarters start possibly mattering.
+//
+// We leave most of these as commented out documentation,
+// as it's probably a bad idea to actually use them.
 
 struct sdk_level_uint { unsigned int sdk_level; };
 #define SDK_LEVEL_(v) ((struct sdk_level_uint){ .sdk_level = (v) })
-#define SDK_LEVEL_NONE SDK_LEVEL_(0)
-#define SDK_LEVEL_S    SDK_LEVEL_(31) // Android 12
-#define SDK_LEVEL_Sv2  SDK_LEVEL_(32) // Android 12L
-#define SDK_LEVEL_T    SDK_LEVEL_(33) // Android 13
-#define SDK_LEVEL_U    SDK_LEVEL_(34) // Android 14
-#define SDK_LEVEL_V    SDK_LEVEL_(35) // Android 15
-#define SDK_LEVEL_24Q3 SDK_LEVEL_V
-#define SDK_LEVEL_25Q2 SDK_LEVEL_(36) // Android 16
+//      SDK_LEVEL_NONE   SDK_LEVEL_(0)    // mainline implies S+
+#define SDK_LEVEL_S      SDK_LEVEL_(3100) // Android 12     [31]
+//      SDK_LEVEL_Sv2    SDK_LEVEL_(3200) // Android 12L    [32]
+#define SDK_LEVEL_T      SDK_LEVEL_(3300) // Android 13     [33]
+#define SDK_LEVEL_U      SDK_LEVEL_(3400) // Android 14/U   [34]
+//      SDK_LEVEL_U_QPR1 SDK_LEVEL_(3401) // Android 14/U QPR1
+//      SDK_LEVEL_24Q1   SDK_LEVEL_(3402) // Android 14/U QPR2
+//      SDK_LEVEL_24Q2   SDK_LEVEL_(3403) // Android 14/U QPR3
+#define SDK_LEVEL_24Q3   SDK_LEVEL_(3500) // Android 15/V   [35]
+//      SDK_LEVEL_24Q4   SDK_LEVEL_(3501) // Android 15/V QPR1
+//      SDK_LEVEL_25Q1   SDK_LEVEL_(3502) // Android 15/V QPR2
+#define SDK_LEVEL_25Q2   SDK_LEVEL_(3600) // Android 16 (B) [36.0]
+//      SDK_LEVEL_25Q3   SDK_LEVEL_(3601) // Android 16 QPR
+#define SDK_LEVEL_25Q4   SDK_LEVEL_(3610) // Android 16.1   [36.1]
+//      SDK_LEVEL_26Q1   SDK_LEVEL_(3611) // Android 16.1 QPR
+#define SDK_LEVEL_26Q2   SDK_LEVEL_(3700) // Android 17 (C) [37.0]
+//      SDK_LEVEL_26Q3   SDK_LEVEL_(3701) // Android 17 QPR
+#define SDK_LEVEL_26Q4   SDK_LEVEL_(3710) // Android 17.1   [37.1]
+//      SDK_LEVEL_27Q1   SDK_LEVEL_(3711) // Android 17.1 QPR
+#define SDK_LEVEL_27Q2   SDK_LEVEL_(3800) // Android 18     [38.0]
 
 #define SDK_LEVEL_IS_AT_LEAST(lvl, v) ((lvl).sdk_level >= (SDK_LEVEL_##v).sdk_level)
 

From f2994122c1e8bd2b84879960b87be89ad7158356 Mon Sep 17 00:00:00 2001
From: Chalard Jean <jchalard@google.com>
Date: Mon, 28 Apr 2025 14:37:03 +0900
Subject: [PATCH 270/377] Remove RecorderCallback.

This class doesn't actually serve a purpose, it only makes
TestableNetworkCallbck more complex.

Test: CtsNetTestCases ConnectivityCoverageTests
Flag: EXEMPT test-only
Change-Id: I39a598b82a3215384bdfe04980f4b280ab2c2716
---
 .../android/net/EthernetTetheringTest.java    |  12 +-
 .../testutils/TestableNetworkCallbackTest.kt  |  52 +++----
 .../TestableNetworkCallbackTestJava.java      |   2 +-
 .../ConnectivityCheckTest.kt                  |   4 +-
 .../AutoReleaseNetworkCallbackRule.kt         |   4 +-
 .../com/android/testutils/ConnectUtil.kt      |   6 +-
 .../testutils/DefaultNetworkRestoreMonitor.kt |   2 +-
 .../testutils/EthernetTestInterface.kt        |   8 +-
 .../com/android/testutils/PacketBridge.kt     |   2 +-
 .../android/testutils/TestableNetworkAgent.kt |  70 ++++-----
 .../testutils/TestableNetworkCallback.kt      | 144 ++++++++----------
 .../testutils/TestableNetworkOfferCallback.kt |  22 +--
 .../java/android/net/NetworkProviderTest.kt   |  24 +--
 .../com/android/cts/net/hostside/VpnTest.java |  35 +++--
 .../ConnectivityMultiDevicesSnippet.kt        |   2 +-
 .../src/android/net/cts/ApfIntegrationTest.kt |   4 +-
 .../src/android/net/cts/CaptivePortalTest.kt  |   2 +-
 .../net/cts/ConnectivityManagerTest.java      | 126 +++++++--------
 .../src/android/net/cts/DnsResolverTapTest.kt |   2 +-
 .../src/android/net/cts/DnsResolverTest.java  |   4 +-
 .../net/src/android/net/cts/DscpPolicyTest.kt |   4 +-
 .../android/net/cts/EthernetManagerTest.kt    |  26 ++--
 .../net/src/android/net/cts/Ikev2VpnTest.java |  14 +-
 .../src/android/net/cts/NetworkAgentTest.kt   |  58 +++----
 .../android/net/cts/NetworkReservationTest.kt |   4 +-
 .../src/android/net/cts/NetworkScoreTest.kt   |   4 +-
 .../net/cts/NetworkStatsManagerTest.java      |   8 +-
 .../android/net/cts/NetworkValidationTest.kt  |   7 +-
 .../net/src/android/net/cts/NsdManagerTest.kt |   4 +-
 .../android/net/cts/util/CtsNetUtils.java     |   4 +-
 .../tethering/cts/TetheringWifiP2pTest.kt     |   6 +-
 tests/integration/src/android/net/ClatTest.kt |   2 +-
 .../src/android/net/Dhcp6PdTest.kt            |   4 +-
 .../ConnectivityServiceIntegrationTest.kt     |   2 +-
 .../NetworkStatsIntegrationTest.kt            |   2 +-
 .../server/ConnectivityServiceTest.java       |  72 ++++-----
 .../CSBlockedReasonsTest.kt                   |   2 +-
 .../CSDeclaredMethodsForCallbacksTest.kt      |   8 +-
 .../CSDestroyedNetworkTests.kt                |   2 +-
 .../CSIngressDiscardRuleTests.kt              |   2 +-
 .../CSInterfaceTrackerTest.kt                 |   3 +-
 .../CSKeepConnectedTest.kt                    |   2 +-
 .../CSL2capProviderTest.kt                    |   7 +-
 .../CSLocalAgentCreationTests.kt              |   2 +-
 .../connectivityservice/CSLocalAgentTests.kt  |   4 +-
 .../CSLocalNetworkProtectionTest.kt           |   4 +-
 .../CSNetworkActivityTest.kt                  |   2 +-
 .../CSNetworkReservationTest.kt               |   8 +-
 .../connectivityservice/CSPreferenceTest.kt   |   6 +-
 .../CSQueuedCallbacksTest.kt                  |  14 +-
 .../CSSatelliteNetworkTest.kt                 |   4 +-
 .../CSShellCommandsTest.kt                    |   4 +-
 .../base/CSAgentWrapper.kt                    |   4 +-
 .../thread/utils/TapTestNetworkTracker.java   |   2 +-
 54 files changed, 408 insertions(+), 420 deletions(-)
 mode change 100755 => 100644 tests/cts/hostside/app/src/com/android/cts/net/hostside/VpnTest.java
 mode change 100755 => 100644 tests/unit/java/com/android/server/ConnectivityServiceTest.java

diff --git a/Tethering/tests/integration/src/android/net/EthernetTetheringTest.java b/Tethering/tests/integration/src/android/net/EthernetTetheringTest.java
index a2bf3a6c99..14795b7320 100644
--- a/Tethering/tests/integration/src/android/net/EthernetTetheringTest.java
+++ b/Tethering/tests/integration/src/android/net/EthernetTetheringTest.java
@@ -93,8 +93,8 @@ import com.android.testutils.DeviceInfoUtils;
 import com.android.testutils.DumpTestUtils;
 import com.android.testutils.NetworkStackModuleTest;
 import com.android.testutils.PollPacketReader;
-import com.android.testutils.RecorderCallback.CallbackEntry;
 import com.android.testutils.TestableNetworkCallback;
+import com.android.testutils.TestableNetworkCallback.Event;
 
 import org.junit.After;
 import org.junit.Rule;
@@ -1297,16 +1297,16 @@ public class EthernetTetheringTest extends EthernetTetheringTestBase {
             }
 
             // Verify NetworkCallback works accordingly.
-            final Network network = networkCallback.expect(CallbackEntry.AVAILABLE).getNetwork();
-            final CallbackEntry.CapabilitiesChanged capEvent =
-                    networkCallback.eventuallyExpect(CallbackEntry.NETWORK_CAPS_UPDATED);
+            final Network network = networkCallback.expect(Event.AVAILABLE).getNetwork();
+            final Event.CapabilitiesChanged capEvent =
+                    networkCallback.eventuallyExpect(Event.NETWORK_CAPS_UPDATED);
             assertEquals(network, capEvent.getNetwork());
             assertTrue(capEvent.getCaps().hasTransport(TRANSPORT_ETHERNET));
             assertTrue(capEvent.getCaps().hasCapability(NET_CAPABILITY_LOCAL_NETWORK));
 
             // Verify details in the LinkPropertiesChanged event.
-            final CallbackEntry.LinkPropertiesChanged lpEvent =
-                    networkCallback.eventuallyExpect(CallbackEntry.LINK_PROPERTIES_CHANGED);
+            final Event.LinkPropertiesChanged lpEvent =
+                    networkCallback.eventuallyExpect(Event.LINK_PROPERTIES_CHANGED);
             assertEquals(network, lpEvent.getNetwork());
             assertEquals(iface, lpEvent.getLp().getInterfaceName());
             assertTrue(lpEvent.getLp().hasIPv4Address());
diff --git a/staticlibs/tests/unit/src/com/android/testutils/TestableNetworkCallbackTest.kt b/staticlibs/tests/unit/src/com/android/testutils/TestableNetworkCallbackTest.kt
index e838bdc564..c35013da86 100644
--- a/staticlibs/tests/unit/src/com/android/testutils/TestableNetworkCallbackTest.kt
+++ b/staticlibs/tests/unit/src/com/android/testutils/TestableNetworkCallbackTest.kt
@@ -21,20 +21,20 @@ import android.net.LinkAddress
 import android.net.LinkProperties
 import android.net.Network
 import android.net.NetworkCapabilities
-import com.android.testutils.RecorderCallback.CallbackEntry
-import com.android.testutils.RecorderCallback.CallbackEntry.Available
-import com.android.testutils.RecorderCallback.CallbackEntry.BlockedStatus
-import com.android.testutils.RecorderCallback.CallbackEntry.CapabilitiesChanged
-import com.android.testutils.RecorderCallback.CallbackEntry.Companion.AVAILABLE
-import com.android.testutils.RecorderCallback.CallbackEntry.Companion.BLOCKED_STATUS
-import com.android.testutils.RecorderCallback.CallbackEntry.Companion.LINK_PROPERTIES_CHANGED
-import com.android.testutils.RecorderCallback.CallbackEntry.Companion.LOSING
-import com.android.testutils.RecorderCallback.CallbackEntry.Companion.LOST
-import com.android.testutils.RecorderCallback.CallbackEntry.Companion.NETWORK_CAPS_UPDATED
-import com.android.testutils.RecorderCallback.CallbackEntry.Companion.RESUMED
-import com.android.testutils.RecorderCallback.CallbackEntry.Companion.SUSPENDED
-import com.android.testutils.RecorderCallback.CallbackEntry.Companion.UNAVAILABLE
-import com.android.testutils.RecorderCallback.CallbackEntry.LinkPropertiesChanged
+import com.android.testutils.TestableNetworkCallback.Event
+import com.android.testutils.TestableNetworkCallback.Event.Available
+import com.android.testutils.TestableNetworkCallback.Event.BlockedStatus
+import com.android.testutils.TestableNetworkCallback.Event.CapabilitiesChanged
+import com.android.testutils.TestableNetworkCallback.Event.Companion.AVAILABLE
+import com.android.testutils.TestableNetworkCallback.Event.Companion.BLOCKED_STATUS
+import com.android.testutils.TestableNetworkCallback.Event.Companion.LINK_PROPERTIES_CHANGED
+import com.android.testutils.TestableNetworkCallback.Event.Companion.LOSING
+import com.android.testutils.TestableNetworkCallback.Event.Companion.LOST
+import com.android.testutils.TestableNetworkCallback.Event.Companion.NETWORK_CAPS_UPDATED
+import com.android.testutils.TestableNetworkCallback.Event.Companion.RESUMED
+import com.android.testutils.TestableNetworkCallback.Event.Companion.SUSPENDED
+import com.android.testutils.TestableNetworkCallback.Event.Companion.UNAVAILABLE
+import com.android.testutils.TestableNetworkCallback.Event.LinkPropertiesChanged
 import kotlin.reflect.KClass
 import kotlin.test.assertEquals
 import kotlin.test.assertFails
@@ -170,19 +170,19 @@ class TestableNetworkCallbackTest {
         val net = Network(193)
         val netCaps = NetworkCapabilities().addTransportType(CELLULAR)
         // Check that expecting callbackThat anything fails when no callback has been received.
-        assertFails { mCallback.expect<CallbackEntry>(timeoutMs = SHORT_TIMEOUT_MS) { true } }
+        assertFails { mCallback.expect<Event>(timeoutMs = SHORT_TIMEOUT_MS) { true } }
 
         // Basic test for true and false
         mCallback.onAvailable(net)
         mCallback.expect<Available> { true }
         mCallback.onAvailable(net)
-        assertFails { mCallback.expect<CallbackEntry>(timeoutMs = SHORT_TIMEOUT_MS) { false } }
+        assertFails { mCallback.expect<Event>(timeoutMs = SHORT_TIMEOUT_MS) { false } }
 
         // Try a positive and a negative case
         mCallback.onBlockedStatusChanged(net, true)
-        mCallback.expect<CallbackEntry> { cb -> cb is BlockedStatus && cb.blocked }
+        mCallback.expect<Event> { cb -> cb is BlockedStatus && cb.blocked }
         mCallback.onCapabilitiesChanged(net, netCaps)
-        assertFails { mCallback.expect<CallbackEntry>(timeoutMs = SHORT_TIMEOUT_MS) { cb ->
+        assertFails { mCallback.expect<Event>(timeoutMs = SHORT_TIMEOUT_MS) { cb ->
             cb is CapabilitiesChanged && cb.caps.hasTransport(WIFI)
         } }
     }
@@ -410,24 +410,24 @@ class TestableNetworkCallbackTest {
 
 private object TNCInterpreter : ConcurrentInterpreter<TestableNetworkCallback>(interpretTable)
 
-val EntryList = CallbackEntry::class.sealedSubclasses.map { it.simpleName }.joinToString("|")
-private fun callbackEntryFromString(name: String): KClass<out CallbackEntry> {
-    return CallbackEntry::class.sealedSubclasses.first { it.simpleName == name }
+val EntryList = Event::class.sealedSubclasses.map { it.simpleName }.joinToString("|")
+private fun callbackEntryFromString(name: String): KClass<out Event> {
+    return Event::class.sealedSubclasses.first { it.simpleName == name }
 }
 
 @SuppressLint("NewApi") // Uses hidden APIs, which the linter would identify as missing APIs.
 private val interpretTable = listOf<InterpretMatcher<TestableNetworkCallback>>(
     // Interpret "Available(xx)" as "call to onAvailable with netId xx", and likewise for
     // all callback types. This is implemented above by enumerating the subclasses of
-    // CallbackEntry and reading their simpleName.
+    // Event and reading their simpleName.
     Regex("""(.*)\s+=\s+($EntryList)\((\d+)\)""") to { i, cb, t ->
         val record = i.interpret(t.strArg(1), cb)
         assertTrue(callbackEntryFromString(t.strArg(2)).isInstance(record))
-        // Strictly speaking testing for is CallbackEntry is useless as it's been tested above
+        // Strictly speaking testing for is Event is useless as it's been tested above
         // but the compiler can't figure things out from the isInstance call. It does understand
-        // from the assertTrue(is CallbackEntry) that this is true, which allows to access
+        // from the assertTrue(is Event) that this is true, which allows to access
         // the 'network' member below.
-        assertTrue(record is CallbackEntry)
+        assertTrue(record is Event)
         assertEquals(record.network.netId, t.intArg(3))
     },
     // Interpret "onAvailable(xx)" as calling "onAvailable" with a netId of xx, and likewise for
@@ -451,7 +451,7 @@ private val interpretTable = listOf<InterpretMatcher<TestableNetworkCallback>>(
     },
     Regex("""poll\((\d+)\)""") to { i, cb, t -> cb.poll(t.timeArg(1)) },
     // Interpret "eventually(Available(xx), timeout)" as calling eventuallyExpect that expects
-    // CallbackEntry.AVAILABLE with netId of xx within timeout*INTERPRET_TIME_UNIT timeout, and
+    // Event.AVAILABLE with netId of xx within timeout*INTERPRET_TIME_UNIT timeout, and
     // likewise for all callback types.
     Regex("""eventually\(($EntryList)\((\d+)\),\s+(\d+)\)""") to { i, cb, t ->
         val net = Network(t.intArg(2))
diff --git a/staticlibs/tests/unit/src/com/android/testutils/TestableNetworkCallbackTestJava.java b/staticlibs/tests/unit/src/com/android/testutils/TestableNetworkCallbackTestJava.java
index 4570d0aecb..da1cbe4dc0 100644
--- a/staticlibs/tests/unit/src/com/android/testutils/TestableNetworkCallbackTestJava.java
+++ b/staticlibs/tests/unit/src/com/android/testutils/TestableNetworkCallbackTestJava.java
@@ -16,7 +16,7 @@
 
 package com.android.testutils;
 
-import static com.android.testutils.RecorderCallback.CallbackEntry.AVAILABLE;
+import static com.android.testutils.TestableNetworkCallback.Event.AVAILABLE;
 import static com.android.testutils.TestableNetworkCallbackKt.anyNetwork;
 
 import static org.junit.Assume.assumeTrue;
diff --git a/staticlibs/testutils/app/connectivitychecker/src/com/android/testutils/connectivitypreparer/ConnectivityCheckTest.kt b/staticlibs/testutils/app/connectivitychecker/src/com/android/testutils/connectivitypreparer/ConnectivityCheckTest.kt
index c42d9e57fc..de175ce15d 100644
--- a/staticlibs/testutils/app/connectivitychecker/src/com/android/testutils/connectivitypreparer/ConnectivityCheckTest.kt
+++ b/staticlibs/testutils/app/connectivitychecker/src/com/android/testutils/connectivitypreparer/ConnectivityCheckTest.kt
@@ -34,8 +34,8 @@ import com.android.net.module.util.NetworkStackConstants.IPV4_ADDR_ANY
 import com.android.net.module.util.NetworkStackConstants.IPV6_ADDR_ANY
 import com.android.testutils.AutoReleaseNetworkCallbackRule
 import com.android.testutils.ConnectUtil
-import com.android.testutils.RecorderCallback.CallbackEntry.CapabilitiesChanged
-import com.android.testutils.RecorderCallback.CallbackEntry.LinkPropertiesChanged
+import com.android.testutils.TestableNetworkCallback.Event.CapabilitiesChanged
+import com.android.testutils.TestableNetworkCallback.Event.LinkPropertiesChanged
 import com.android.testutils.runAsShell
 import com.android.testutils.tryTest
 import java.io.IOException
diff --git a/staticlibs/testutils/devicetests/com/android/testutils/AutoReleaseNetworkCallbackRule.kt b/staticlibs/testutils/devicetests/com/android/testutils/AutoReleaseNetworkCallbackRule.kt
index e42223d7f9..31a12df75f 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/AutoReleaseNetworkCallbackRule.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/AutoReleaseNetworkCallbackRule.kt
@@ -27,7 +27,7 @@ import android.net.NetworkCapabilities.TRANSPORT_WIFI
 import android.net.NetworkRequest
 import android.os.Handler
 import androidx.test.platform.app.InstrumentationRegistry
-import com.android.testutils.RecorderCallback.CallbackEntry
+import com.android.testutils.TestableNetworkCallback.Event.Available
 import java.util.Collections
 import kotlin.test.fail
 import org.junit.rules.TestRule
@@ -84,7 +84,7 @@ open class NetworkCallbackHelper {
         }
         val cb = requestNetwork(getInternetRequest(TRANSPORT_CELLULAR))
         cellRequestCb = cb
-        return cb.expect<CallbackEntry.Available>(
+        return cb.expect<Available>(
             errorMsg = "Cell network not available. " +
                     "Please ensure the device has working mobile data."
         ).network
diff --git a/staticlibs/testutils/devicetests/com/android/testutils/ConnectUtil.kt b/staticlibs/testutils/devicetests/com/android/testutils/ConnectUtil.kt
index d60ab5960f..9045598439 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/ConnectUtil.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/ConnectUtil.kt
@@ -35,8 +35,8 @@ import android.os.ParcelFileDescriptor
 import android.os.SystemClock
 import android.util.Log
 import androidx.test.platform.app.InstrumentationRegistry.getInstrumentation
-import com.android.testutils.RecorderCallback.CallbackEntry
-import com.android.testutils.RecorderCallback.CallbackEntry.CapabilitiesChanged
+import com.android.testutils.TestableNetworkCallback.Event
+import com.android.testutils.TestableNetworkCallback.Event.CapabilitiesChanged
 import java.util.concurrent.CompletableFuture
 import java.util.concurrent.TimeUnit
 import kotlin.test.assertNotNull
@@ -242,7 +242,7 @@ class ConnectUtil(private val context: Context) {
     }
 }
 
-private inline fun <reified T : CallbackEntry> TestableNetworkCallback.eventuallyExpect(
+private inline fun <reified T : Event> TestableNetworkCallback.eventuallyExpect(
     errorMsg: String,
     crossinline predicate: (T) -> Boolean = { true }
 ): T = history.poll(defaultTimeoutMs, mark) { it is T && predicate(it) }.also {
diff --git a/staticlibs/testutils/devicetests/com/android/testutils/DefaultNetworkRestoreMonitor.kt b/staticlibs/testutils/devicetests/com/android/testutils/DefaultNetworkRestoreMonitor.kt
index 4559cb7b09..104ddde447 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/DefaultNetworkRestoreMonitor.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/DefaultNetworkRestoreMonitor.kt
@@ -24,7 +24,7 @@ import android.net.Network
 import android.net.NetworkCapabilities
 import com.android.internal.annotations.VisibleForTesting
 import com.android.net.module.util.BitUtils
-import com.android.testutils.RecorderCallback.CallbackEntry.CapabilitiesChanged
+import com.android.testutils.TestableNetworkCallback.Event.CapabilitiesChanged
 import java.util.concurrent.CompletableFuture
 import java.util.concurrent.TimeUnit
 import org.junit.runner.Description
diff --git a/staticlibs/testutils/devicetests/com/android/testutils/EthernetTestInterface.kt b/staticlibs/testutils/devicetests/com/android/testutils/EthernetTestInterface.kt
index 2dc51a3b3d..1bcfede8a9 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/EthernetTestInterface.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/EthernetTestInterface.kt
@@ -27,7 +27,7 @@ import android.net.TestNetworkInterface
 import android.os.Handler
 import android.util.Log
 import com.android.net.module.util.ArrayTrackRecord
-import com.android.testutils.EthernetTestInterface.EthernetStateListener.CallbackEntry.InterfaceStateChanged
+import com.android.testutils.EthernetTestInterface.EthernetStateListener.Event.InterfaceStateChanged
 import java.net.NetworkInterface
 import kotlin.concurrent.Volatile
 import kotlin.test.assertNotNull
@@ -47,15 +47,15 @@ class EthernetTestInterface(
     val testIface: TestNetworkInterface
 ) {
     private class EthernetStateListener(private val trackedIface: String) : InterfaceStateListener {
-        val events = ArrayTrackRecord<CallbackEntry>().newReadHead()
+        val events = ArrayTrackRecord<Event>().newReadHead()
 
-        sealed class CallbackEntry {
+        sealed class Event {
             data class InterfaceStateChanged(
                 val iface: String,
                 val state: Int,
                 val role: Int,
                 val cfg: IpConfiguration?
-            ) : CallbackEntry()
+            ) : Event()
         }
 
         override fun onInterfaceStateChanged(
diff --git a/staticlibs/testutils/devicetests/com/android/testutils/PacketBridge.kt b/staticlibs/testutils/devicetests/com/android/testutils/PacketBridge.kt
index 0b736d1615..5eeaee38cb 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/PacketBridge.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/PacketBridge.kt
@@ -28,7 +28,7 @@ import android.net.TestNetworkInterface
 import android.net.TestNetworkManager
 import android.net.TestNetworkSpecifier
 import android.os.Binder
-import com.android.testutils.RecorderCallback.CallbackEntry.Available
+import com.android.testutils.TestableNetworkCallback.Event.Available
 import java.net.InetAddress
 import libcore.io.IoUtils
 
diff --git a/staticlibs/testutils/devicetests/com/android/testutils/TestableNetworkAgent.kt b/staticlibs/testutils/devicetests/com/android/testutils/TestableNetworkAgent.kt
index 1a82c5b346..3d00e86b2e 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/TestableNetworkAgent.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/TestableNetworkAgent.kt
@@ -45,21 +45,21 @@ import android.system.OsConstants.SOCK_DGRAM
 import com.android.modules.utils.build.SdkLevel.isAtLeastS
 import com.android.net.module.util.ArrayTrackRecord
 import com.android.testutils.CompatUtil.makeTestNetworkSpecifier
-import com.android.testutils.TestableNetworkAgent.CallbackEntry.OnAddKeepalivePacketFilter
-import com.android.testutils.TestableNetworkAgent.CallbackEntry.OnAutomaticReconnectDisabled
-import com.android.testutils.TestableNetworkAgent.CallbackEntry.OnBandwidthUpdateRequested
-import com.android.testutils.TestableNetworkAgent.CallbackEntry.OnDscpPolicyStatusUpdated
-import com.android.testutils.TestableNetworkAgent.CallbackEntry.OnNetworkCreated
-import com.android.testutils.TestableNetworkAgent.CallbackEntry.OnNetworkDestroyed
-import com.android.testutils.TestableNetworkAgent.CallbackEntry.OnNetworkUnwanted
-import com.android.testutils.TestableNetworkAgent.CallbackEntry.OnRegisterQosCallback
-import com.android.testutils.TestableNetworkAgent.CallbackEntry.OnRemoveKeepalivePacketFilter
-import com.android.testutils.TestableNetworkAgent.CallbackEntry.OnSaveAcceptUnvalidated
-import com.android.testutils.TestableNetworkAgent.CallbackEntry.OnSignalStrengthThresholdsUpdated
-import com.android.testutils.TestableNetworkAgent.CallbackEntry.OnStartSocketKeepalive
-import com.android.testutils.TestableNetworkAgent.CallbackEntry.OnStopSocketKeepalive
-import com.android.testutils.TestableNetworkAgent.CallbackEntry.OnUnregisterQosCallback
-import com.android.testutils.TestableNetworkAgent.CallbackEntry.OnValidationStatus
+import com.android.testutils.TestableNetworkAgent.Event.OnAddKeepalivePacketFilter
+import com.android.testutils.TestableNetworkAgent.Event.OnAutomaticReconnectDisabled
+import com.android.testutils.TestableNetworkAgent.Event.OnBandwidthUpdateRequested
+import com.android.testutils.TestableNetworkAgent.Event.OnDscpPolicyStatusUpdated
+import com.android.testutils.TestableNetworkAgent.Event.OnNetworkCreated
+import com.android.testutils.TestableNetworkAgent.Event.OnNetworkDestroyed
+import com.android.testutils.TestableNetworkAgent.Event.OnNetworkUnwanted
+import com.android.testutils.TestableNetworkAgent.Event.OnRegisterQosCallback
+import com.android.testutils.TestableNetworkAgent.Event.OnRemoveKeepalivePacketFilter
+import com.android.testutils.TestableNetworkAgent.Event.OnSaveAcceptUnvalidated
+import com.android.testutils.TestableNetworkAgent.Event.OnSignalStrengthThresholdsUpdated
+import com.android.testutils.TestableNetworkAgent.Event.OnStartSocketKeepalive
+import com.android.testutils.TestableNetworkAgent.Event.OnStopSocketKeepalive
+import com.android.testutils.TestableNetworkAgent.Event.OnUnregisterQosCallback
+import com.android.testutils.TestableNetworkAgent.Event.OnValidationStatus
 import java.net.NetworkInterface
 import java.net.SocketException
 import java.time.Duration
@@ -193,34 +193,34 @@ public open class TestableNetworkAgent(
 
     val DEFAULT_TIMEOUT_MS = 5000L
 
-    val history = ArrayTrackRecord<CallbackEntry>().newReadHead()
+    val history = ArrayTrackRecord<Event>().newReadHead()
 
-    sealed class CallbackEntry {
-        object OnBandwidthUpdateRequested : CallbackEntry()
-        object OnNetworkUnwanted : CallbackEntry()
+    sealed class Event {
+        object OnBandwidthUpdateRequested : Event()
+        object OnNetworkUnwanted : Event()
         data class OnAddKeepalivePacketFilter(
             val slot: Int,
             val packet: KeepalivePacketData
-        ) : CallbackEntry()
-        data class OnRemoveKeepalivePacketFilter(val slot: Int) : CallbackEntry()
+        ) : Event()
+        data class OnRemoveKeepalivePacketFilter(val slot: Int) : Event()
         data class OnStartSocketKeepalive(
             val slot: Int,
             val interval: Int,
             val packet: KeepalivePacketData
-        ) : CallbackEntry()
-        data class OnStopSocketKeepalive(val slot: Int) : CallbackEntry()
-        data class OnSaveAcceptUnvalidated(val accept: Boolean) : CallbackEntry()
-        object OnAutomaticReconnectDisabled : CallbackEntry()
-        data class OnValidationStatus(val status: Int, val uri: Uri?) : CallbackEntry()
-        data class OnSignalStrengthThresholdsUpdated(val thresholds: IntArray) : CallbackEntry()
-        object OnNetworkCreated : CallbackEntry()
-        object OnNetworkDestroyed : CallbackEntry()
-        data class OnDscpPolicyStatusUpdated(val policyId: Int, val status: Int) : CallbackEntry()
+        ) : Event()
+        data class OnStopSocketKeepalive(val slot: Int) : Event()
+        data class OnSaveAcceptUnvalidated(val accept: Boolean) : Event()
+        object OnAutomaticReconnectDisabled : Event()
+        data class OnValidationStatus(val status: Int, val uri: Uri?) : Event()
+        data class OnSignalStrengthThresholdsUpdated(val thresholds: IntArray) : Event()
+        object OnNetworkCreated : Event()
+        object OnNetworkDestroyed : Event()
+        data class OnDscpPolicyStatusUpdated(val policyId: Int, val status: Int) : Event()
         data class OnRegisterQosCallback(
             val callbackId: Int,
             val filter: QosFilter
-        ) : CallbackEntry()
-        data class OnUnregisterQosCallback(val callbackId: Int) : CallbackEntry()
+        ) : Event()
+        data class OnUnregisterQosCallback(val callbackId: Int) : Event()
     }
 
     override fun onBandwidthUpdateRequested() {
@@ -306,19 +306,19 @@ public open class TestableNetworkAgent(
         assertEquals("", it.uri.toString())
     }
 
-    inline fun <reified T : CallbackEntry> expectCallback(): T {
+    inline fun <reified T : Event> expectCallback(): T {
         val foundCallback = history.poll(DEFAULT_TIMEOUT_MS)
         assertTrue(foundCallback is T, "Expected ${T::class} but found $foundCallback")
         return foundCallback
     }
 
-    inline fun <reified T : CallbackEntry> expectCallback(valid: (T) -> Boolean) {
+    inline fun <reified T : Event> expectCallback(valid: (T) -> Boolean) {
         val foundCallback = history.poll(DEFAULT_TIMEOUT_MS)
         assertTrue(foundCallback is T, "Expected ${T::class} but found $foundCallback")
         assertTrue(valid(foundCallback), "Unexpected callback : $foundCallback")
     }
 
-    inline fun <reified T : CallbackEntry> eventuallyExpect() =
+    inline fun <reified T : Event> eventuallyExpect() =
             history.poll(DEFAULT_TIMEOUT_MS) { it is T }.also {
                 assertNotNull(it, "Callback ${T::class} not received")
     } as T
diff --git a/staticlibs/testutils/devicetests/com/android/testutils/TestableNetworkCallback.kt b/staticlibs/testutils/devicetests/com/android/testutils/TestableNetworkCallback.kt
index c4e236e1d0..1a6eade6c2 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/TestableNetworkCallback.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/TestableNetworkCallback.kt
@@ -24,18 +24,18 @@ import android.net.NetworkCapabilities
 import android.net.NetworkCapabilities.NET_CAPABILITY_VALIDATED
 import android.util.Log
 import com.android.net.module.util.ArrayTrackRecord
-import com.android.testutils.RecorderCallback.CallbackEntry.Available
-import com.android.testutils.RecorderCallback.CallbackEntry.BlockedStatus
-import com.android.testutils.RecorderCallback.CallbackEntry.BlockedStatusInt
-import com.android.testutils.RecorderCallback.CallbackEntry.CapabilitiesChanged
-import com.android.testutils.RecorderCallback.CallbackEntry.LinkPropertiesChanged
-import com.android.testutils.RecorderCallback.CallbackEntry.LocalInfoChanged
-import com.android.testutils.RecorderCallback.CallbackEntry.Losing
-import com.android.testutils.RecorderCallback.CallbackEntry.Lost
-import com.android.testutils.RecorderCallback.CallbackEntry.Reserved
-import com.android.testutils.RecorderCallback.CallbackEntry.Resumed
-import com.android.testutils.RecorderCallback.CallbackEntry.Suspended
-import com.android.testutils.RecorderCallback.CallbackEntry.Unavailable
+import com.android.testutils.TestableNetworkCallback.Event.Available
+import com.android.testutils.TestableNetworkCallback.Event.BlockedStatus
+import com.android.testutils.TestableNetworkCallback.Event.BlockedStatusInt
+import com.android.testutils.TestableNetworkCallback.Event.CapabilitiesChanged
+import com.android.testutils.TestableNetworkCallback.Event.LinkPropertiesChanged
+import com.android.testutils.TestableNetworkCallback.Event.LocalInfoChanged
+import com.android.testutils.TestableNetworkCallback.Event.Losing
+import com.android.testutils.TestableNetworkCallback.Event.Lost
+import com.android.testutils.TestableNetworkCallback.Event.Reserved
+import com.android.testutils.TestableNetworkCallback.Event.Resumed
+import com.android.testutils.TestableNetworkCallback.Event.Suspended
+import com.android.testutils.TestableNetworkCallback.Event.Unavailable
 import kotlin.reflect.KClass
 import kotlin.test.assertEquals
 import kotlin.test.assertNotNull
@@ -45,64 +45,72 @@ object NULL_NETWORK : Network(-1)
 object ANY_NETWORK : Network(-2)
 fun anyNetwork() = ANY_NETWORK
 
-private val DEFAULT_TAG = RecorderCallback::class.simpleName
+private val DEFAULT_TAG = TestableNetworkCallback::class.simpleName
     ?: fail("Could not determine class name")
 
-open class RecorderCallback private constructor(
-    private val backingRecord: ArrayTrackRecord<CallbackEntry>,
-    val logTag: String
-) : NetworkCallback() {
-    public constructor(logTag: String = DEFAULT_TAG) : this(ArrayTrackRecord(), logTag)
-    protected constructor(src: RecorderCallback?, logTag: String) : this(
-        src?.backingRecord ?: ArrayTrackRecord(),
-        logTag
-    )
+private const val DEFAULT_TIMEOUT = 30_000L // ms
+private const val DEFAULT_NO_CALLBACK_TIMEOUT = 200L // ms
+private val NOOP = Runnable {}
 
-    sealed class CallbackEntry {
+/**
+ * See comments on the public constructor below for a description of the arguments.
+ */
+open class TestableNetworkCallback private constructor(
+    src: TestableNetworkCallback?,
+    val defaultTimeoutMs: Long,
+    val defaultNoCallbackTimeoutMs: Long,
+    val waiterFunc: Runnable,
+    private val logTag: String
+) : NetworkCallback() {
+    val backingRecord: ArrayTrackRecord<Event> = src?.backingRecord ?: ArrayTrackRecord()
+    val history: ArrayTrackRecord<Event>.ReadHead = backingRecord.newReadHead()
+    val mark get() = history.mark
+
+    sealed class Event {
         // To get equals(), hashcode(), componentN() etc for free, the child classes of
         // this class are data classes. But while data classes can inherit from other classes,
         // they may only have visible members in the constructors, so they couldn't declare
-        // a constructor with a non-val arg to pass to CallbackEntry. Instead, force all
+        // a constructor with a non-val arg to pass to Event. Instead, force all
         // subclasses to implement a `network' property, which can be done in a data class
         // constructor by specifying override.
         abstract val network: Network
 
         data class Reserved private constructor(
-                override val network: Network,
-                val caps: NetworkCapabilities
-        ) : CallbackEntry() {
+            override val network: Network,
+            val caps: NetworkCapabilities
+        ) : Event() {
             constructor(caps: NetworkCapabilities) : this(NULL_NETWORK, caps)
         }
-        data class Available(override val network: Network) : CallbackEntry()
+        data class Available(override val network: Network) : Event()
         data class CapabilitiesChanged(
             override val network: Network,
             val caps: NetworkCapabilities
-        ) : CallbackEntry()
+        ) : Event()
         data class LinkPropertiesChanged(
             override val network: Network,
             val lp: LinkProperties
-        ) : CallbackEntry()
+        ) : Event()
         data class LocalInfoChanged(
             override val network: Network,
             val info: LocalNetworkInfo
-        ) : CallbackEntry()
-        data class Suspended(override val network: Network) : CallbackEntry()
-        data class Resumed(override val network: Network) : CallbackEntry()
-        data class Losing(override val network: Network, val maxMsToLive: Int) : CallbackEntry()
-        data class Lost(override val network: Network) : CallbackEntry()
+        ) : Event()
+        data class Suspended(override val network: Network) : Event()
+        data class Resumed(override val network: Network) : Event()
+        data class Losing(override val network: Network, val maxMsToLive: Int) : Event()
+        data class Lost(override val network: Network) : Event()
         data class Unavailable private constructor(
             override val network: Network
-        ) : CallbackEntry() {
+        ) : Event() {
             constructor() : this(NULL_NETWORK)
         }
         data class BlockedStatus(
             override val network: Network,
             val blocked: Boolean
-        ) : CallbackEntry()
+        ) : Event()
         data class BlockedStatusInt(
             override val network: Network,
             val reason: Int
-        ) : CallbackEntry()
+        ) : Event()
 
         // Convenience constants for expecting a type
         companion object {
@@ -133,9 +141,6 @@ open class RecorderCallback private constructor(
         }
     }
 
-    val history = backingRecord.newReadHead()
-    val mark get() = history.mark
-
     override fun onReserved(caps: NetworkCapabilities) {
         Log.d(logTag, "onReserved $caps")
         history.add(Reserved(caps))
@@ -196,22 +201,7 @@ open class RecorderCallback private constructor(
         Log.d(logTag, "onUnavailable")
         history.add(Unavailable())
     }
-}
 
-private const val DEFAULT_TIMEOUT = 30_000L // ms
-private const val DEFAULT_NO_CALLBACK_TIMEOUT = 200L // ms
-private val NOOP = Runnable {}
-
-/**
- * See comments on the public constructor below for a description of the arguments.
- */
-open class TestableNetworkCallback private constructor(
-    src: TestableNetworkCallback?,
-    val defaultTimeoutMs: Long,
-    val defaultNoCallbackTimeoutMs: Long,
-    val waiterFunc: Runnable,
-    logTag: String
-) : RecorderCallback(src, logTag) {
     /**
      * Construct a testable network callback.
      * @param timeoutMs the default timeout for expecting a callback. Default 30 seconds. This
@@ -260,7 +250,7 @@ open class TestableNetworkCallback private constructor(
      * Long.MAX_VALUE.
      */
     @JvmOverloads
-    fun poll(timeoutMs: Long = defaultTimeoutMs, predicate: (CallbackEntry) -> Boolean = { true }) =
+    fun poll(timeoutMs: Long = defaultTimeoutMs, predicate: (Event) -> Boolean = { true }) =
             history.poll(timeoutMs, predicate)
 
     /*****
@@ -269,13 +259,13 @@ open class TestableNetworkCallback private constructor(
      * passed predicate. If no callback is received within the timeout, these methods fail.
      */
     @JvmOverloads
-    fun <T : CallbackEntry> expect(
+    fun <T : Event> expect(
         type: KClass<T>,
         network: Network = ANY_NETWORK,
         timeoutMs: Long = defaultTimeoutMs,
         errorMsg: String? = null,
         test: (T) -> Boolean = { true }
-    ) = expect<CallbackEntry>(network, timeoutMs, errorMsg) {
+    ) = expect<Event>(network, timeoutMs, errorMsg) {
         if (type.isInstance(it)) {
             test(it as T) // Cast can't fail since type.isInstance(it) and type: KClass<T>
         } else {
@@ -284,7 +274,7 @@ open class TestableNetworkCallback private constructor(
     } as T
 
     @JvmOverloads
-    fun <T : CallbackEntry> expect(
+    fun <T : Event> expect(
         type: KClass<T>,
         network: HasNetwork,
         timeoutMs: Long = defaultTimeoutMs,
@@ -297,7 +287,7 @@ open class TestableNetworkCallback private constructor(
     // there is no need to explicitly define versions without the test predicate.
     // Without |network|
     @JvmOverloads
-    fun <T : CallbackEntry> expect(
+    fun <T : Event> expect(
         type: KClass<T>,
         timeoutMs: Long,
         errorMsg: String?,
@@ -306,7 +296,7 @@ open class TestableNetworkCallback private constructor(
 
     // Without |timeout|, in Network and HasNetwork versions
     @JvmOverloads
-    fun <T : CallbackEntry> expect(
+    fun <T : Event> expect(
         type: KClass<T>,
         network: Network,
         errorMsg: String?,
@@ -314,7 +304,7 @@ open class TestableNetworkCallback private constructor(
     ) = expect(type, network, defaultTimeoutMs, errorMsg, test)
 
     @JvmOverloads
-    fun <T : CallbackEntry> expect(
+    fun <T : Event> expect(
         type: KClass<T>,
         network: HasNetwork,
         errorMsg: String?,
@@ -323,7 +313,7 @@ open class TestableNetworkCallback private constructor(
 
     // Without |errorMsg|, in Network and HasNetwork versions
     @JvmOverloads
-    fun <T : CallbackEntry> expect(
+    fun <T : Event> expect(
         type: KClass<T>,
         network: Network,
         timeoutMs: Long,
@@ -331,7 +321,7 @@ open class TestableNetworkCallback private constructor(
     ) = expect(type, network, timeoutMs, null, test)
 
     @JvmOverloads
-    fun <T : CallbackEntry> expect(
+    fun <T : Event> expect(
         type: KClass<T>,
         network: HasNetwork,
         timeoutMs: Long,
@@ -340,7 +330,7 @@ open class TestableNetworkCallback private constructor(
 
     // Without |network| or |timeout|
     @JvmOverloads
-    fun <T : CallbackEntry> expect(
+    fun <T : Event> expect(
         type: KClass<T>,
         errorMsg: String?,
         test: (T) -> Boolean = { true }
@@ -348,7 +338,7 @@ open class TestableNetworkCallback private constructor(
 
     // Without |network| or |errorMsg|
     @JvmOverloads
-    fun <T : CallbackEntry> expect(
+    fun <T : Event> expect(
         type: KClass<T>,
         timeoutMs: Long,
         test: (T) -> Boolean = { true }
@@ -356,14 +346,14 @@ open class TestableNetworkCallback private constructor(
 
     // Without |timeout| or |errorMsg|, in Network and HasNetwork versions
     @JvmOverloads
-    fun <T : CallbackEntry> expect(
+    fun <T : Event> expect(
         type: KClass<T>,
         network: Network,
         test: (T) -> Boolean
     ) = expect(type, network, defaultTimeoutMs, null, test)
 
     @JvmOverloads
-    fun <T : CallbackEntry> expect(
+    fun <T : Event> expect(
         type: KClass<T>,
         network: HasNetwork,
         test: (T) -> Boolean
@@ -371,13 +361,13 @@ open class TestableNetworkCallback private constructor(
 
     // Without |network| or |timeout| or |errorMsg|
     @JvmOverloads
-    fun <T : CallbackEntry> expect(
+    fun <T : Event> expect(
         type: KClass<T>,
         test: (T) -> Boolean
     ) = expect(type, ANY_NETWORK, defaultTimeoutMs, null, test)
 
     // Kotlin reified versions. Don't call methods above, or the predicate would need to be noinline
-    inline fun <reified T : CallbackEntry> expect(
+    inline fun <reified T : Event> expect(
         network: Network = ANY_NETWORK,
         timeoutMs: Long = defaultTimeoutMs,
         errorMsg: String? = null,
@@ -399,7 +389,7 @@ open class TestableNetworkCallback private constructor(
                 }
             } as T
 
-    inline fun <reified T : CallbackEntry> expect(
+    inline fun <reified T : Event> expect(
         network: HasNetwork,
         timeoutMs: Long = defaultTimeoutMs,
         errorMsg: String? = null,
@@ -415,13 +405,13 @@ open class TestableNetworkCallback private constructor(
     @JvmOverloads
     fun assertNoCallback(
         timeoutMs: Long = defaultNoCallbackTimeoutMs,
-        valid: (CallbackEntry) -> Boolean = { true }
+        valid: (Event) -> Boolean = { true }
     ) {
         waiterFunc.run()
         history.poll(timeoutMs) { valid(it) }?.let { fail("Expected no callback but got $it") }
     }
 
-    fun assertNoCallback(valid: (CallbackEntry) -> Boolean) =
+    fun assertNoCallback(valid: (Event) -> Boolean) =
             assertNoCallback(defaultNoCallbackTimeoutMs, valid)
 
     /*****
@@ -430,7 +420,7 @@ open class TestableNetworkCallback private constructor(
      * Any callback of the wrong type, or doesn't match the optional predicate, is ignored.
      * They fail if no callback matching the predicate is received within the timeout.
      */
-    inline fun <reified T : CallbackEntry> eventuallyExpect(
+    inline fun <reified T : Event> eventuallyExpect(
         timeoutMs: Long = defaultTimeoutMs,
         from: Int = mark,
         crossinline predicate: (T) -> Boolean = { true }
@@ -443,7 +433,7 @@ open class TestableNetworkCallback private constructor(
     } as T
 
     @JvmOverloads
-    fun <T : CallbackEntry> eventuallyExpect(
+    fun <T : Event> eventuallyExpect(
         type: KClass<T>,
         timeoutMs: Long = defaultTimeoutMs,
         predicate: (cb: T) -> Boolean = { true }
@@ -455,7 +445,7 @@ open class TestableNetworkCallback private constructor(
         )
     } as T
 
-    fun <T : CallbackEntry> eventuallyExpect(
+    fun <T : Event> eventuallyExpect(
         type: KClass<T>,
         timeoutMs: Long = defaultTimeoutMs,
         from: Int = mark,
diff --git a/staticlibs/testutils/devicetests/com/android/testutils/TestableNetworkOfferCallback.kt b/staticlibs/testutils/devicetests/com/android/testutils/TestableNetworkOfferCallback.kt
index 8228440f54..cd0143e318 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/TestableNetworkOfferCallback.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/TestableNetworkOfferCallback.kt
@@ -31,12 +31,12 @@ class TestableNetworkOfferCallback(
     private val noCallbackTimeoutMs: Long = DEFAULT_NO_CALLBACK_TIMEOUT,
 ) : NetworkProvider.NetworkOfferCallback {
     private val TAG = this::class.simpleName
-    val history = ArrayTrackRecord<CallbackEntry>().newReadHead()
+    val history = ArrayTrackRecord<Event>().newReadHead()
     val mark get() = history.mark
 
-    sealed class CallbackEntry {
-        data class Needed(val request: NetworkRequest) : CallbackEntry()
-        data class Unneeded(val request: NetworkRequest) : CallbackEntry()
+    sealed class Event {
+        data class Needed(val request: NetworkRequest) : Event()
+        data class Unneeded(val request: NetworkRequest) : Event()
     }
 
     /**
@@ -45,7 +45,7 @@ class TestableNetworkOfferCallback(
      */
     override fun onNetworkNeeded(request: NetworkRequest) {
         Log.d(TAG, "onNetworkNeeded $request")
-        history.add(CallbackEntry.Needed(request))
+        history.add(Event.Needed(request))
     }
 
     /**
@@ -53,10 +53,10 @@ class TestableNetworkOfferCallback(
      */
     override fun onNetworkUnneeded(request: NetworkRequest) {
         Log.d(TAG, "onNetworkUnneeded $request")
-        history.add(CallbackEntry.Unneeded(request))
+        history.add(Event.Unneeded(request))
     }
 
-    inline fun <reified T : CallbackEntry> expect(
+    inline fun <reified T : Event> expect(
         errorMsg: String? = null,
         predicate: (T) -> Boolean = { true }
     ): T {
@@ -76,11 +76,11 @@ class TestableNetworkOfferCallback(
 
     // TODO : remove when there are no callers
     @Deprecated("Use expect instead of expectCallbackThat")
-    inline fun <reified T : CallbackEntry> expectCallbackThat(
+    inline fun <reified T : Event> expectCallbackThat(
         crossinline predicate: (T) -> Boolean
     ): T = expect<T>(null, predicate)
 
-    inline fun <reified T : CallbackEntry> eventuallyExpect(
+    inline fun <reified T : Event> eventuallyExpect(
         errorMsg: String? = null,
         from: Int = mark,
         crossinline predicate: (T) -> Boolean = { true }
@@ -94,12 +94,12 @@ class TestableNetworkOfferCallback(
     } as T
 
     fun expectOnNetworkNeeded(capabilities: NetworkCapabilities) =
-            expectCallbackThat<CallbackEntry.Needed> {
+            expectCallbackThat<Event.Needed> {
                 it.request.canBeSatisfiedBy(capabilities)
             }
 
     fun expectOnNetworkUnneeded(capabilities: NetworkCapabilities) =
-            expectCallbackThat<CallbackEntry.Unneeded> {
+            expectCallbackThat<Event.Unneeded> {
                 it.request.canBeSatisfiedBy(capabilities)
             }
 
diff --git a/tests/common/java/android/net/NetworkProviderTest.kt b/tests/common/java/android/net/NetworkProviderTest.kt
index 0d35960057..ef1cbcc9b1 100644
--- a/tests/common/java/android/net/NetworkProviderTest.kt
+++ b/tests/common/java/android/net/NetworkProviderTest.kt
@@ -21,9 +21,9 @@ import android.content.Context
 import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_VCN_MANAGED
 import android.net.NetworkCapabilities.NET_CAPABILITY_TRUSTED
 import android.net.NetworkCapabilities.TRANSPORT_TEST
-import android.net.NetworkProviderTest.TestNetworkCallback.CallbackEntry.OnUnavailable
-import android.net.NetworkProviderTest.TestNetworkProvider.CallbackEntry.OnNetworkRequestWithdrawn
-import android.net.NetworkProviderTest.TestNetworkProvider.CallbackEntry.OnNetworkRequested
+import android.net.NetworkProviderTest.TestNetworkCallback.Event.OnUnavailable
+import android.net.NetworkProviderTest.TestNetworkProvider.Event.OnNetworkRequestWithdrawn
+import android.net.NetworkProviderTest.TestNetworkProvider.Event.OnNetworkRequested
 import android.os.Build
 import android.os.Handler
 import android.os.HandlerThread
@@ -85,15 +85,15 @@ class NetworkProviderTest {
     private class TestNetworkProvider(context: Context, looper: Looper) :
             NetworkProvider(context, looper, PROVIDER_NAME) {
         private val TAG = this::class.simpleName
-        private val seenEvents = ArrayTrackRecord<CallbackEntry>().newReadHead()
+        private val seenEvents = ArrayTrackRecord<Event>().newReadHead()
 
-        sealed class CallbackEntry {
+        sealed class Event {
             data class OnNetworkRequested(
                 val request: NetworkRequest,
                 val score: Int,
                 val id: Int
-            ) : CallbackEntry()
-            data class OnNetworkRequestWithdrawn(val request: NetworkRequest) : CallbackEntry()
+            ) : Event()
+            data class OnNetworkRequestWithdrawn(val request: NetworkRequest) : Event()
         }
 
         override fun onNetworkRequested(request: NetworkRequest, score: Int, id: Int) {
@@ -106,7 +106,7 @@ class NetworkProviderTest {
             seenEvents.add(OnNetworkRequestWithdrawn(request))
         }
 
-        inline fun <reified T : CallbackEntry> eventuallyExpectCallbackThat(
+        inline fun <reified T : Event> eventuallyExpectCallbackThat(
             crossinline predicate: (T) -> Boolean
         ) = seenEvents.poll(DEFAULT_TIMEOUT_MS) { it is T && predicate(it) }
                 ?: fail("Did not receive callback after ${DEFAULT_TIMEOUT_MS}ms")
@@ -356,16 +356,16 @@ class NetworkProviderTest {
     }
 
     private class TestNetworkCallback : ConnectivityManager.NetworkCallback() {
-        private val seenEvents = ArrayTrackRecord<CallbackEntry>().newReadHead()
-        sealed class CallbackEntry {
-            object OnUnavailable : CallbackEntry()
+        private val seenEvents = ArrayTrackRecord<Event>().newReadHead()
+        sealed class Event {
+            object OnUnavailable : Event()
         }
 
         override fun onUnavailable() {
             seenEvents.add(OnUnavailable)
         }
 
-        inline fun <reified T : CallbackEntry> expectCallback(
+        inline fun <reified T : Event> expectCallback(
             crossinline predicate: (T) -> Boolean
         ) = seenEvents.poll(DEFAULT_TIMEOUT_MS) { it is T && predicate(it) }
     }
diff --git a/tests/cts/hostside/app/src/com/android/cts/net/hostside/VpnTest.java b/tests/cts/hostside/app/src/com/android/cts/net/hostside/VpnTest.java
old mode 100755
new mode 100644
index 29e2ebb205..b6bceabb70
--- a/tests/cts/hostside/app/src/com/android/cts/net/hostside/VpnTest.java
+++ b/tests/cts/hostside/app/src/com/android/cts/net/hostside/VpnTest.java
@@ -19,8 +19,8 @@ package com.android.cts.net.hostside;
 import static android.Manifest.permission.MANAGE_TEST_NETWORKS;
 import static android.Manifest.permission.NETWORK_SETTINGS;
 import static android.Manifest.permission.READ_DEVICE_CONFIG;
-import static android.Manifest.permission.WRITE_DEVICE_CONFIG;
 import static android.Manifest.permission.WRITE_ALLOWLISTED_DEVICE_CONFIG;
+import static android.Manifest.permission.WRITE_DEVICE_CONFIG;
 import static android.content.Context.RECEIVER_EXPORTED;
 import static android.content.pm.PackageManager.FEATURE_TELEPHONY;
 import static android.content.pm.PackageManager.FEATURE_WIFI;
@@ -52,8 +52,8 @@ import static com.android.cts.net.hostside.VpnTest.TestSocketKeepaliveCallback.C
 import static com.android.cts.net.hostside.VpnTest.TestSocketKeepaliveCallback.CallbackType.ON_STARTED;
 import static com.android.cts.net.hostside.VpnTest.TestSocketKeepaliveCallback.CallbackType.ON_STOPPED;
 import static com.android.testutils.Cleanup.testAndCleanup;
-import static com.android.testutils.RecorderCallback.CallbackEntry.BLOCKED_STATUS_INT;
 import static com.android.testutils.TestPermissionUtil.runAsShell;
+import static com.android.testutils.TestableNetworkCallback.Event.BLOCKED_STATUS_INT;
 
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
@@ -130,9 +130,8 @@ import com.android.testutils.AutoReleaseNetworkCallbackRule;
 import com.android.testutils.ConnectUtil;
 import com.android.testutils.DevSdkIgnoreRule;
 import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo;
-import com.android.testutils.RecorderCallback;
-import com.android.testutils.RecorderCallback.CallbackEntry;
 import com.android.testutils.TestableNetworkCallback;
+import com.android.testutils.TestableNetworkCallback.Event;
 
 import org.junit.After;
 import org.junit.Before;
@@ -886,14 +885,14 @@ public class VpnTest {
 
     private void expectUnderlyingNetworks(TestableNetworkCallback callback,
             @Nullable List<Network> expectUnderlyingNetworks) {
-        callback.eventuallyExpect(RecorderCallback.CallbackEntry.NETWORK_CAPS_UPDATED,
+        callback.eventuallyExpect(TestableNetworkCallback.Event.NETWORK_CAPS_UPDATED,
                 NETWORK_CALLBACK_TIMEOUT_MS,
                 entry -> (Objects.equals(expectUnderlyingNetworks,
                         entry.getCaps().getUnderlyingNetworks())));
     }
 
     private void expectVpnNetwork(TestableNetworkCallback callback) {
-        callback.eventuallyExpect(RecorderCallback.CallbackEntry.NETWORK_CAPS_UPDATED,
+        callback.eventuallyExpect(TestableNetworkCallback.Event.NETWORK_CAPS_UPDATED,
                 NETWORK_CALLBACK_TIMEOUT_MS,
                 entry -> entry.getCaps().hasTransport(TRANSPORT_VPN));
     }
@@ -1009,7 +1008,7 @@ public class VpnTest {
             registerDefaultNetworkCallback(myUidCallback);
             myUidCallback.expectAvailableCallbacks(defaultNetwork, false /* suspended */,
                     true /* validated */, false /* blocked */, TIMEOUT_MS);
-            myUidCallback.expect(CallbackEntry.NETWORK_CAPS_UPDATED, defaultNetwork);
+            myUidCallback.expect(Event.NETWORK_CAPS_UPDATED, defaultNetwork);
         }
 
         FileDescriptor fd = openSocketFdInOtherApp(TEST_HOST, 80, TIMEOUT_MS);
@@ -1030,7 +1029,7 @@ public class VpnTest {
         checkTrafficOnVpn();
 
         final Network vpnNetwork = mCM.getActiveNetwork();
-        myUidCallback.eventuallyExpect(CallbackEntry.NETWORK_CAPS_UPDATED,
+        myUidCallback.eventuallyExpect(Event.NETWORK_CAPS_UPDATED,
                 NETWORK_CALLBACK_TIMEOUT_MS,
                 entry -> entry.getNetwork().equals(vpnNetwork)
                         && entry.getCaps().hasCapability(NET_CAPABILITY_VALIDATED));
@@ -1065,8 +1064,8 @@ public class VpnTest {
     }
 
     private void assertNoCallbackExceptCapOrLpChange(TestableNetworkCallback callback) {
-        callback.assertNoCallback(c -> !(c instanceof CallbackEntry.CapabilitiesChanged
-                || c instanceof CallbackEntry.LinkPropertiesChanged));
+        callback.assertNoCallback(c -> !(c instanceof Event.CapabilitiesChanged
+                || c instanceof Event.LinkPropertiesChanged));
     }
 
     @Test
@@ -1182,12 +1181,12 @@ public class VpnTest {
         final Network defaultNetwork = mCM.getActiveNetwork();
         final TestableNetworkCallback cb = new TestableNetworkCallback();
         registerDefaultNetworkCallback(cb);
-        cb.expect(CallbackEntry.AVAILABLE, defaultNetwork);
+        cb.expect(Event.AVAILABLE, defaultNetwork);
         final NetworkCapabilities cap =
-                cb.expect(CallbackEntry.NETWORK_CAPS_UPDATED, defaultNetwork).getCaps();
+                cb.expect(Event.NETWORK_CAPS_UPDATED, defaultNetwork).getCaps();
         final LinkProperties lp =
-                cb.expect(CallbackEntry.LINK_PROPERTIES_CHANGED, defaultNetwork).getLp();
-        cb.expect(CallbackEntry.BLOCKED_STATUS, defaultNetwork);
+                cb.expect(Event.LINK_PROPERTIES_CHANGED, defaultNetwork).getLp();
+        cb.expect(Event.BLOCKED_STATUS, defaultNetwork);
 
         // Setup VPN
         final FileDescriptor fd = openSocketFdInOtherApp(TEST_HOST, 80, TIMEOUT_MS);
@@ -1932,7 +1931,7 @@ public class VpnTest {
 
             // The VPN will be the only default network for the app, so it's expected to receive
             // onLost() callback.
-            defaultNetworkCallback.eventuallyExpect(CallbackEntry.LOST);
+            defaultNetworkCallback.eventuallyExpect(Event.LOST);
 
             final ArrayList<Network> underlyingNetworks = new ArrayList<>();
             underlyingNetworks.add(defaultNetwork);
@@ -1944,14 +1943,14 @@ public class VpnTest {
             expectVpnNetwork(defaultNetworkCallback);
         }, /* cleanup */ () -> {
                 stopVpn();
-                defaultNetworkCallback.eventuallyExpect(CallbackEntry.LOST);
+                defaultNetworkCallback.eventuallyExpect(Event.LOST);
             }, /* cleanup */ () -> {
                 runWithShellPermissionIdentity(() -> {
                     mCM.setVpnDefaultForUids(session, new ArraySet<>());
                 }, NETWORK_SETTINGS);
                 // The default network of the app will be changed back to wifi when the VPN network
                 // preference feature is disabled.
-                defaultNetworkCallback.eventuallyExpect(CallbackEntry.AVAILABLE,
+                defaultNetworkCallback.eventuallyExpect(Event.AVAILABLE,
                         NETWORK_CALLBACK_TIMEOUT_MS,
                         entry -> defaultNetwork.equals(entry.getNetwork()));
             });
@@ -2133,7 +2132,7 @@ public class VpnTest {
                     BLOCKED_REASON_NONE, NETWORK_CALLBACK_TIMEOUT_MS);
         }
         public void onBlockedStatusChanged(Network network, int blockedReasons) {
-            getHistory().add(new CallbackEntry.BlockedStatusInt(network, blockedReasons));
+            getHistory().add(new Event.BlockedStatusInt(network, blockedReasons));
         }
     }
 }
diff --git a/tests/cts/multidevices/snippet/ConnectivityMultiDevicesSnippet.kt b/tests/cts/multidevices/snippet/ConnectivityMultiDevicesSnippet.kt
index e1c6bf1874..3f3a6d34f0 100644
--- a/tests/cts/multidevices/snippet/ConnectivityMultiDevicesSnippet.kt
+++ b/tests/cts/multidevices/snippet/ConnectivityMultiDevicesSnippet.kt
@@ -41,8 +41,8 @@ import com.android.modules.utils.build.SdkLevel
 import com.android.testutils.AutoReleaseNetworkCallbackRule
 import com.android.testutils.ConnectUtil
 import com.android.testutils.NetworkCallbackHelper
-import com.android.testutils.RecorderCallback.CallbackEntry.CapabilitiesChanged
 import com.android.testutils.TestableNetworkCallback
+import com.android.testutils.TestableNetworkCallback.Event.CapabilitiesChanged
 import com.android.testutils.runAsShell
 import com.google.android.mobly.snippet.Snippet
 import com.google.android.mobly.snippet.rpc.Rpc
diff --git a/tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt b/tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt
index 033092f68f..58dedc2ad3 100644
--- a/tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt
+++ b/tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt
@@ -86,8 +86,8 @@ import com.android.testutils.DevSdkIgnoreRule
 import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
 import com.android.testutils.DevSdkIgnoreRunner
 import com.android.testutils.NetworkStackModuleTest
-import com.android.testutils.RecorderCallback.CallbackEntry.Available
-import com.android.testutils.RecorderCallback.CallbackEntry.LinkPropertiesChanged
+import com.android.testutils.TestableNetworkCallback.Event.Available
+import com.android.testutils.TestableNetworkCallback.Event.LinkPropertiesChanged
 import com.android.testutils.SkipPresubmit
 import com.android.testutils.TestableNetworkCallback
 import com.android.testutils.pollingCheck
diff --git a/tests/cts/net/src/android/net/cts/CaptivePortalTest.kt b/tests/cts/net/src/android/net/cts/CaptivePortalTest.kt
index 1389be7757..460c21b9b9 100644
--- a/tests/cts/net/src/android/net/cts/CaptivePortalTest.kt
+++ b/tests/cts/net/src/android/net/cts/CaptivePortalTest.kt
@@ -48,7 +48,7 @@ import com.android.net.module.util.NetworkStackConstants.TEST_CAPTIVE_PORTAL_HTT
 import com.android.net.module.util.NetworkStackConstants.TEST_CAPTIVE_PORTAL_HTTP_URL
 import com.android.testutils.AutoReleaseNetworkCallbackRule
 import com.android.testutils.DeviceConfigRule
-import com.android.testutils.RecorderCallback.CallbackEntry.CapabilitiesChanged
+import com.android.testutils.TestableNetworkCallback.Event.CapabilitiesChanged
 import com.android.testutils.SkipMainlinePresubmit
 import com.android.testutils.TestHttpServer
 import com.android.testutils.TestHttpServer.Request
diff --git a/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java b/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
index e86259e075..a758b57b6c 100644
--- a/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
+++ b/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
@@ -232,7 +232,7 @@ import com.android.testutils.DevSdkIgnoreRunner;
 import com.android.testutils.DeviceConfigRule;
 import com.android.testutils.DeviceInfoUtils;
 import com.android.testutils.DumpTestUtils;
-import com.android.testutils.RecorderCallback.CallbackEntry;
+import com.android.testutils.TestableNetworkCallback.Event;
 import com.android.testutils.SkipPresubmit;
 import com.android.testutils.TestHttpServer;
 import com.android.testutils.TestNetworkTracker;
@@ -482,9 +482,9 @@ public class ConnectivityManagerTest {
             final TestableNetworkCallback callback =
                     networkCallbackRule.registerDefaultNetworkCallback();
             assertNotNull("Couldn't restore Internet connectivity",
-                    callback.eventuallyExpect(CallbackEntry.NETWORK_CAPS_UPDATED,
+                    callback.eventuallyExpect(Event.NETWORK_CAPS_UPDATED,
                             NETWORK_CALLBACK_TIMEOUT_MS,
-                            entry -> ((CallbackEntry.CapabilitiesChanged) entry)
+                            entry -> ((Event.CapabilitiesChanged) entry)
                                     .getCaps().hasCapability(NET_CAPABILITY_VALIDATED)));
         });
     }
@@ -656,7 +656,7 @@ public class ConnectivityManagerTest {
             // callbacks. This is guaranteed to succeed because the callback is registered
             // before getAllNetworkStateSnapshots is called.
             final LinkProperties lpFromSnapshot = snapshot.getLinkProperties();
-            allNetworkLinkPropertiesListener.eventuallyExpect(CallbackEntry.LINK_PROPERTIES_CHANGED,
+            allNetworkLinkPropertiesListener.eventuallyExpect(Event.LINK_PROPERTIES_CHANGED,
                     NETWORK_CALLBACK_TIMEOUT_MS, 0 /* mark */, entry ->
                             entry.getNetwork().equals(network)
                                     && entry.getLp().equals(lpFromSnapshot));
@@ -1134,9 +1134,9 @@ public class ConnectivityManagerTest {
                 .build();
     }
 
-    private boolean hasPrivateDnsValidated(CallbackEntry entry, Network networkForPrivateDns) {
+    private boolean hasPrivateDnsValidated(Event entry, Network networkForPrivateDns) {
         if (!networkForPrivateDns.equals(entry.getNetwork())) return false;
-        final NetworkCapabilities nc = ((CallbackEntry.CapabilitiesChanged) entry).getCaps();
+        final NetworkCapabilities nc = ((Event.CapabilitiesChanged) entry).getCaps();
         return !nc.isPrivateDnsBroken() && nc.hasCapability(NET_CAPABILITY_VALIDATED);
     }
 
@@ -1154,13 +1154,13 @@ public class ConnectivityManagerTest {
         try {
             // Verifying the good private DNS sever
             mCtsNetUtils.setPrivateDnsStrictMode(goodPrivateDnsServer);
-            cb.eventuallyExpect(CallbackEntry.NETWORK_CAPS_UPDATED, NETWORK_CALLBACK_TIMEOUT_MS,
+            cb.eventuallyExpect(Event.NETWORK_CAPS_UPDATED, NETWORK_CALLBACK_TIMEOUT_MS,
                     entry -> hasPrivateDnsValidated(entry, networkForPrivateDns));
 
             // Verifying the broken private DNS sever
             mCtsNetUtils.setPrivateDnsStrictMode(invalidPrivateDnsServer);
-            cb.eventuallyExpect(CallbackEntry.NETWORK_CAPS_UPDATED, NETWORK_CALLBACK_TIMEOUT_MS,
-                    entry -> (((CallbackEntry.CapabilitiesChanged) entry).getCaps()
+            cb.eventuallyExpect(Event.NETWORK_CAPS_UPDATED, NETWORK_CALLBACK_TIMEOUT_MS,
+                    entry -> (((Event.CapabilitiesChanged) entry).getCaps()
                     .isPrivateDnsBroken()) && networkForPrivateDns.equals(entry.getNetwork()));
         } finally {
             mCtsNetUtils.restorePrivateDnsSetting();
@@ -1215,22 +1215,22 @@ public class ConnectivityManagerTest {
         // Now we should expect to get a network callback about availability of the wifi
         // network even if it was already connected as a state-based action when the callback
         // is registered.
-        wifiNetwork = callback.eventuallyExpect(CallbackEntry.AVAILABLE).getNetwork();
+        wifiNetwork = callback.eventuallyExpect(Event.AVAILABLE).getNetwork();
         assertNotNull("Did not receive onAvailable for TRANSPORT_WIFI request",
                 wifiNetwork);
 
         final Network defaultNetwork = defaultTrackingCallback.eventuallyExpect(
-                CallbackEntry.AVAILABLE).getNetwork();
+                Event.AVAILABLE).getNetwork();
         assertNotNull("Did not receive onAvailable on default network callback",
                 defaultNetwork);
 
         if (TestUtils.shouldTestSApis()) {
-            systemDefaultCallback.eventuallyExpect(CallbackEntry.AVAILABLE);
-            final Network perUidNetwork = perUidCallback.eventuallyExpect(CallbackEntry.AVAILABLE)
+            systemDefaultCallback.eventuallyExpect(Event.AVAILABLE);
+            final Network perUidNetwork = perUidCallback.eventuallyExpect(Event.AVAILABLE)
                     .getNetwork();
             assertEquals(defaultNetwork, perUidNetwork);
             final Network bestMatchingNetwork = bestMatchingCallback.eventuallyExpect(
-                    CallbackEntry.AVAILABLE).getNetwork();
+                    Event.AVAILABLE).getNetwork();
             assertEquals(defaultNetwork, bestMatchingNetwork);
         }
     }
@@ -1460,7 +1460,7 @@ public class ConnectivityManagerTest {
                         .build());
 
         // Wait to get callback for availability of internet
-        callback.eventuallyExpect(CallbackEntry.AVAILABLE).getNetwork();
+        callback.eventuallyExpect(Event.AVAILABLE).getNetwork();
     }
 
     /**
@@ -1484,7 +1484,7 @@ public class ConnectivityManagerTest {
                 100 /* timeoutMs */);
         try {
             // Wait to get callback for unavailability of requested network
-            callback.eventuallyExpect(CallbackEntry.UNAVAILABLE, 2_000 /* timeoutMs */);
+            callback.eventuallyExpect(Event.UNAVAILABLE, 2_000 /* timeoutMs */);
         } finally {
             if (previousWifiEnabledState) {
                 mCtsNetUtils.connectToWifi();
@@ -1602,7 +1602,7 @@ public class ConnectivityManagerTest {
         }
 
         return networkCallback.eventuallyExpect(
-                CallbackEntry.NETWORK_CAPS_UPDATED,
+                Event.NETWORK_CAPS_UPDATED,
                 // Changing meteredness on wifi involves reconnecting, which can take several
                 // seconds (involves re-associating, DHCP...).
                 NETWORK_CALLBACK_TIMEOUT_MS,
@@ -2276,10 +2276,10 @@ public class ConnectivityManagerTest {
 
         try (Socket socket = new Socket()) {
             // Verify that the network is restricted.
-            testNetworkCb.eventuallyExpect(CallbackEntry.NETWORK_CAPS_UPDATED,
+            testNetworkCb.eventuallyExpect(Event.NETWORK_CAPS_UPDATED,
                     NETWORK_CALLBACK_TIMEOUT_MS,
                     entry -> network.equals(entry.getNetwork())
-                            && (!((CallbackEntry.CapabilitiesChanged) entry).getCaps()
+                            && (!((Event.CapabilitiesChanged) entry).getCaps()
                             .hasCapability(NET_CAPABILITY_NOT_RESTRICTED)));
             // CtsNetTestCases package doesn't hold CONNECTIVITY_USE_RESTRICTED_NETWORKS, so it
             // does not allow to bind socket to restricted network.
@@ -2397,7 +2397,7 @@ public class ConnectivityManagerTest {
             }
             if (supportTelephony) {
                 telephonyCb.eventuallyExpect(
-                        CallbackEntry.AVAILABLE, CELL_DATA_AVAILABLE_TIMEOUT_MS);
+                        Event.AVAILABLE, CELL_DATA_AVAILABLE_TIMEOUT_MS);
             }
         } finally {
             // Restore the previous state of airplane mode and permissions:
@@ -2413,16 +2413,16 @@ public class ConnectivityManagerTest {
         waitForAvailable(cb);
     }
 
-    private CallbackEntry.Available waitForAvailable(@NonNull final TestableNetworkCallback cb) {
-        return cb.eventuallyExpect(CallbackEntry.AVAILABLE, NETWORK_CALLBACK_TIMEOUT_MS,
-                c -> c instanceof CallbackEntry.Available);
+    private Event.Available waitForAvailable(@NonNull final TestableNetworkCallback cb) {
+        return cb.eventuallyExpect(Event.AVAILABLE, NETWORK_CALLBACK_TIMEOUT_MS,
+                c -> c instanceof Event.Available);
     }
 
     private void waitForTransport(
             @NonNull final TestableNetworkCallback cb, final int expectedTransport) {
-        cb.eventuallyExpect(CallbackEntry.NETWORK_CAPS_UPDATED,
+        cb.eventuallyExpect(Event.NETWORK_CAPS_UPDATED,
                 NETWORK_CALLBACK_TIMEOUT_MS,
-                entry -> ((CallbackEntry.CapabilitiesChanged) entry).getCaps()
+                entry -> ((Event.CapabilitiesChanged) entry).getCaps()
                         .hasTransport(expectedTransport));
     }
 
@@ -2434,8 +2434,8 @@ public class ConnectivityManagerTest {
     }
 
     private void waitForLost(@NonNull final TestableNetworkCallback cb) {
-        cb.eventuallyExpect(CallbackEntry.LOST, NETWORK_CALLBACK_TIMEOUT_MS,
-                c -> c instanceof CallbackEntry.Lost);
+        cb.eventuallyExpect(Event.LOST, NETWORK_CALLBACK_TIMEOUT_MS,
+                c -> c instanceof Event.Lost);
     }
 
     private void setAndVerifyAirplaneMode(Boolean expectedResult)
@@ -2522,7 +2522,7 @@ public class ConnectivityManagerTest {
         // Registering a callback here guarantees onCapabilitiesChanged is called immediately
         // because WiFi network should be connected.
         final NetworkCapabilities nc = callback.eventuallyExpect(
-                CallbackEntry.NETWORK_CAPS_UPDATED, NETWORK_CALLBACK_TIMEOUT_MS).getCaps();
+                Event.NETWORK_CAPS_UPDATED, NETWORK_CALLBACK_TIMEOUT_MS).getCaps();
         // Verify if ssid is contained in the NetworkCapabilities received from callback.
         assertEquals(hasSsid, Pattern.compile(ssid).matcher(nc.toString()).find());
     }
@@ -2588,10 +2588,10 @@ public class ConnectivityManagerTest {
             // non-listen requests will get available callback before it can be put into
             // background if no foreground request can be satisfied. Thus, wait for a short
             // period is needed to let foreground capability go away.
-            callback.eventuallyExpect(CallbackEntry.NETWORK_CAPS_UPDATED,
+            callback.eventuallyExpect(Event.NETWORK_CAPS_UPDATED,
                     NETWORK_CALLBACK_TIMEOUT_MS,
-                    c -> c instanceof CallbackEntry.CapabilitiesChanged
-                            && !((CallbackEntry.CapabilitiesChanged) c).getCaps()
+                    c -> c instanceof Event.CapabilitiesChanged
+                            && !((Event.CapabilitiesChanged) c).getCaps()
                             .hasCapability(NET_CAPABILITY_FOREGROUND));
             final NetworkCapabilities nc = mCm.getNetworkCapabilities(testNetwork);
             assertFalse("expected background network, but got " + nc,
@@ -2601,7 +2601,7 @@ public class ConnectivityManagerTest {
             runWithShellPermissionIdentity(() -> {
                 if (null != n) {
                     tnm.teardownTestNetwork(n);
-                    callback.eventuallyExpect(CallbackEntry.LOST,
+                    callback.eventuallyExpect(Event.LOST,
                             NETWORK_CALLBACK_TIMEOUT_MS,
                             lost -> n.equals(lost.getNetwork()));
                 }
@@ -2616,16 +2616,16 @@ public class ConnectivityManagerTest {
                     BLOCKED_REASON_NONE, NETWORK_CALLBACK_TIMEOUT_MS);
         }
         public void eventuallyExpectBlockedStatusCallback(Network network, int blockedStatus) {
-            super.eventuallyExpect(CallbackEntry.BLOCKED_STATUS_INT, NETWORK_CALLBACK_TIMEOUT_MS,
+            super.eventuallyExpect(Event.BLOCKED_STATUS_INT, NETWORK_CALLBACK_TIMEOUT_MS,
                     (it) -> it.getNetwork().equals(network) && it.getReason() == blockedStatus);
         }
         public void onBlockedStatusChanged(Network network, int blockedReasons) {
             Log.v(TAG, "onBlockedStatusChanged " + network + " " + blockedReasons);
-            getHistory().add(new CallbackEntry.BlockedStatusInt(network, blockedReasons));
+            getHistory().add(new Event.BlockedStatusInt(network, blockedReasons));
         }
         private void assertNoBlockedStatusCallback() {
             super.assertNoCallback(NO_CALLBACK_TIMEOUT_MS,
-                    c -> c instanceof CallbackEntry.BlockedStatus);
+                    c -> c instanceof Event.BlockedStatus);
         }
     }
 
@@ -2671,7 +2671,7 @@ public class ConnectivityManagerTest {
                 () -> networkCallbackRule.registerDefaultNetworkCallbackForUid(
                         otherUid, otherUidCallback, handler), NETWORK_SETTINGS);
 
-        final Network defaultNetwork = myUidCallback.expect(CallbackEntry.AVAILABLE).getNetwork();
+        final Network defaultNetwork = myUidCallback.expect(Event.AVAILABLE).getNetwork();
         final List<DetailedBlockedStatusCallback> allCallbacks =
                 List.of(myUidCallback, otherUidCallback);
         for (DetailedBlockedStatusCallback callback : allCallbacks) {
@@ -2918,14 +2918,14 @@ public class ConnectivityManagerTest {
 
             // Validate that an unmetered network is used over other networks.
             waitForAvailable(defaultCallback, wifiNetwork);
-            systemDefaultCallback.eventuallyExpect(CallbackEntry.AVAILABLE,
+            systemDefaultCallback.eventuallyExpect(Event.AVAILABLE,
                     NETWORK_CALLBACK_TIMEOUT_MS, cb -> wifiNetwork.equals(cb.getNetwork()));
 
             // Validate that when setting unmetered to metered, unmetered is lost and replaced by
             // the network with the TEST transport. Also wait for validation here, in case there
             // is a bug that's only visible when the network is validated.
             setWifiMeteredStatusAndWait(ssid, true /* isMetered */, true /* waitForValidation */);
-            defaultCallback.eventuallyExpect(CallbackEntry.LOST, NETWORK_CALLBACK_TIMEOUT_MS,
+            defaultCallback.eventuallyExpect(Event.LOST, NETWORK_CALLBACK_TIMEOUT_MS,
                     l -> l.getNetwork().equals(wifiNetwork));
             waitForAvailable(defaultCallback, tnt.getNetwork());
             // Depending on if this device has cellular connectivity or not, multiple available
@@ -2938,7 +2938,7 @@ public class ConnectivityManagerTest {
                 runWithShellPermissionIdentity(tnt::teardown);
                 // The other callbacks (LP or NC changes) would receive before LOST callback. Use
                 // eventuallyExpect to check callback for avoiding test flake.
-                defaultCallback.eventuallyExpect(CallbackEntry.LOST, NETWORK_CALLBACK_TIMEOUT_MS,
+                defaultCallback.eventuallyExpect(Event.LOST, NETWORK_CALLBACK_TIMEOUT_MS,
                         lost -> tnt.getNetwork().equals(lost.getNetwork()));
                 waitForAvailable(defaultCallback);
             }, /* cleanup */ () -> {
@@ -2974,11 +2974,11 @@ public class ConnectivityManagerTest {
                     OemNetworkPreferences.OEM_NETWORK_PREFERENCE_TEST_ONLY);
             registerTestOemNetworkPreferenceCallbacks(defaultCallback, systemDefaultCallback);
             waitForAvailable(defaultCallback, testNetwork);
-            systemDefaultCallback.eventuallyExpect(CallbackEntry.AVAILABLE,
+            systemDefaultCallback.eventuallyExpect(Event.AVAILABLE,
                     NETWORK_CALLBACK_TIMEOUT_MS, cb -> wifiNetwork.equals(cb.getNetwork()));
         }, /* cleanup */ () -> {
                 runWithShellPermissionIdentity(tnt::teardown);
-                defaultCallback.eventuallyExpect(CallbackEntry.LOST, NETWORK_CALLBACK_TIMEOUT_MS,
+                defaultCallback.eventuallyExpect(Event.LOST, NETWORK_CALLBACK_TIMEOUT_MS,
                         cb -> testNetwork.equals(cb.getNetwork()));
 
                 // This network preference should only ever use the test network therefore available
@@ -3128,7 +3128,7 @@ public class ConnectivityManagerTest {
                 mCm.setAcceptPartialConnectivity(network, false /* accept */, false /* always */);
             });
             // Reject partial connectivity network should cause the network being torn down
-            assertEquals(network, cb.eventuallyExpect(CallbackEntry.LOST).getNetwork());
+            assertEquals(network, cb.eventuallyExpect(Event.LOST).getNetwork());
         } finally {
             mHttpServer.stop();
             // Wifi will not automatically reconnect to the network. ensureWifiDisconnected cannot
@@ -3213,9 +3213,9 @@ public class ConnectivityManagerTest {
                     makeWifiNetworkRequest());
 
             // Verify wifi is the default network.
-            defaultCb.eventuallyExpect(CallbackEntry.AVAILABLE, NETWORK_CALLBACK_TIMEOUT_MS,
+            defaultCb.eventuallyExpect(Event.AVAILABLE, NETWORK_CALLBACK_TIMEOUT_MS,
                     entry -> wifiNetwork.equals(entry.getNetwork()));
-            wifiCb.eventuallyExpect(CallbackEntry.AVAILABLE, NETWORK_CALLBACK_TIMEOUT_MS,
+            wifiCb.eventuallyExpect(Event.AVAILABLE, NETWORK_CALLBACK_TIMEOUT_MS,
                     entry -> wifiNetwork.equals(entry.getNetwork()));
             assertTrue(mCm.getNetworkCapabilities(wifiNetwork).hasCapability(
                     NET_CAPABILITY_VALIDATED));
@@ -3225,20 +3225,20 @@ public class ConnectivityManagerTest {
             configTestServer(Status.INTERNAL_ERROR, Status.INTERNAL_ERROR);
             mCm.reportNetworkConnectivity(wifiNetwork, false);
             // Default network should stay on unvalidated wifi because avoid bad wifi is disabled.
-            defaultCb.eventuallyExpect(CallbackEntry.NETWORK_CAPS_UPDATED,
+            defaultCb.eventuallyExpect(Event.NETWORK_CAPS_UPDATED,
                     NETWORK_CALLBACK_TIMEOUT_MS,
-                    entry -> !((CallbackEntry.CapabilitiesChanged) entry).getCaps()
+                    entry -> !((Event.CapabilitiesChanged) entry).getCaps()
                             .hasCapability(NET_CAPABILITY_VALIDATED));
-            wifiCb.eventuallyExpect(CallbackEntry.NETWORK_CAPS_UPDATED,
+            wifiCb.eventuallyExpect(Event.NETWORK_CAPS_UPDATED,
                     NETWORK_CALLBACK_TIMEOUT_MS,
-                    entry -> !((CallbackEntry.CapabilitiesChanged) entry).getCaps()
+                    entry -> !((Event.CapabilitiesChanged) entry).getCaps()
                             .hasCapability(NET_CAPABILITY_VALIDATED));
 
             runAsShell(NETWORK_SETTINGS, () -> {
                 mCm.setAvoidUnvalidated(wifiNetwork);
             });
             // Default network should be updated to validated cellular network.
-            defaultCb.eventuallyExpect(CallbackEntry.AVAILABLE, NETWORK_CALLBACK_TIMEOUT_MS,
+            defaultCb.eventuallyExpect(Event.AVAILABLE, NETWORK_CALLBACK_TIMEOUT_MS,
                     entry -> cellNetwork.equals(entry.getNetwork()));
             // The network should not validate again.
             wifiCb.assertNoCallback(NO_CALLBACK_TIMEOUT_MS, c -> isValidatedCaps(c));
@@ -3249,9 +3249,9 @@ public class ConnectivityManagerTest {
         }
     }
 
-    private boolean isValidatedCaps(CallbackEntry c) {
-        if (!(c instanceof CallbackEntry.CapabilitiesChanged)) return false;
-        final CallbackEntry.CapabilitiesChanged capsChanged = (CallbackEntry.CapabilitiesChanged) c;
+    private boolean isValidatedCaps(Event c) {
+        if (!(c instanceof Event.CapabilitiesChanged)) return false;
+        final Event.CapabilitiesChanged capsChanged = (Event.CapabilitiesChanged) c;
         return capsChanged.getCaps().hasCapability(NET_CAPABILITY_VALIDATED);
     }
 
@@ -3275,7 +3275,7 @@ public class ConnectivityManagerTest {
 
     private Network expectNetworkHasCapability(Network network, int expectedNetCap, long timeout) {
         return networkCallbackRule.registerNetworkCallback(new NetworkRequest.Builder().build())
-                .eventuallyExpect(CallbackEntry.NETWORK_CAPS_UPDATED, timeout,
+                .eventuallyExpect(Event.NETWORK_CAPS_UPDATED, timeout,
                         cb -> cb.getNetwork().equals(network)
                                 && cb.getCaps().hasCapability(expectedNetCap)).getNetwork();
     }
@@ -3406,8 +3406,8 @@ public class ConnectivityManagerTest {
     private void assertNoCallbackExceptCapOrLpChange(
             @NonNull final TestableNetworkCallback cb) {
         cb.assertNoCallback(NO_CALLBACK_TIMEOUT_MS,
-                c -> !(c instanceof CallbackEntry.CapabilitiesChanged
-                        || c instanceof CallbackEntry.LinkPropertiesChanged));
+                c -> !(c instanceof Event.CapabilitiesChanged
+                        || c instanceof Event.LinkPropertiesChanged));
     }
 
     @AppModeFull(reason = "Cannot get WifiManager in instant app mode")
@@ -3456,7 +3456,7 @@ public class ConnectivityManagerTest {
             newMobileDataPreferredUids.add(uid);
             ConnectivitySettingsManager.setMobileDataPreferredUids(
                     mContext, newMobileDataPreferredUids);
-            defaultTrackingCb.eventuallyExpect(CallbackEntry.AVAILABLE, NETWORK_CALLBACK_TIMEOUT_MS,
+            defaultTrackingCb.eventuallyExpect(Event.AVAILABLE, NETWORK_CALLBACK_TIMEOUT_MS,
                     entry -> cellNetwork.equals(entry.getNetwork()));
             // No change for system default network. Expect no callback except CapabilitiesChanged
             // or LinkPropertiesChanged which may be triggered randomly from wifi network.
@@ -3469,7 +3469,7 @@ public class ConnectivityManagerTest {
             newMobileDataPreferredUids.remove(uid);
             ConnectivitySettingsManager.setMobileDataPreferredUids(
                     mContext, newMobileDataPreferredUids);
-            defaultTrackingCb.eventuallyExpect(CallbackEntry.AVAILABLE, NETWORK_CALLBACK_TIMEOUT_MS,
+            defaultTrackingCb.eventuallyExpect(Event.AVAILABLE, NETWORK_CALLBACK_TIMEOUT_MS,
                     entry -> wifiNetwork.equals(entry.getNetwork()));
             // No change for system default network. Expect no callback except CapabilitiesChanged
             // or LinkPropertiesChanged which may be triggered randomly from wifi network.
@@ -3572,10 +3572,10 @@ public class ConnectivityManagerTest {
 
         try (Socket socket = new Socket()) {
             // Verify that the network is restricted.
-            testNetworkCb.eventuallyExpect(CallbackEntry.NETWORK_CAPS_UPDATED,
+            testNetworkCb.eventuallyExpect(Event.NETWORK_CAPS_UPDATED,
                     NETWORK_CALLBACK_TIMEOUT_MS,
                     entry -> network.equals(entry.getNetwork())
-                            && (!((CallbackEntry.CapabilitiesChanged) entry).getCaps()
+                            && (!((Event.CapabilitiesChanged) entry).getCaps()
                             .hasCapability(NET_CAPABILITY_NOT_RESTRICTED)));
             // CtsNetTestCases package doesn't hold CONNECTIVITY_USE_RESTRICTED_NETWORKS, so it
             // does not allow to bind socket to restricted network.
@@ -3596,10 +3596,10 @@ public class ConnectivityManagerTest {
                 // Uid is in allowed list. Try file network request again.
                 networkCallbackRule.requestNetwork(restrictedRequest, restrictedNetworkCb);
                 // Verify that the network is restricted.
-                restrictedNetworkCb.eventuallyExpect(CallbackEntry.NETWORK_CAPS_UPDATED,
+                restrictedNetworkCb.eventuallyExpect(Event.NETWORK_CAPS_UPDATED,
                         NETWORK_CALLBACK_TIMEOUT_MS,
                         entry -> network.equals(entry.getNetwork())
-                                && (!((CallbackEntry.CapabilitiesChanged) entry).getCaps()
+                                && (!((Event.CapabilitiesChanged) entry).getCaps()
                                 .hasCapability(NET_CAPABILITY_NOT_RESTRICTED)));
             }
         } finally {
@@ -4036,7 +4036,7 @@ public class ConnectivityManagerTest {
 
         final DetailedBlockedStatusCallback cb = new DetailedBlockedStatusCallback();
         networkCallbackRule.registerDefaultNetworkCallback(cb);
-        final Network network = cb.expect(CallbackEntry.AVAILABLE).getNetwork();
+        final Network network = cb.expect(Event.AVAILABLE).getNetwork();
         testAndCleanup(() -> {
             // Disable chain and set RULE_DENY on target chain
             runWithShellPermissionIdentity(() -> {
@@ -4086,7 +4086,7 @@ public class ConnectivityManagerTest {
 
         final DetailedBlockedStatusCallback cb = new DetailedBlockedStatusCallback();
         networkCallbackRule.registerDefaultNetworkCallback(cb);
-        final Network network = cb.expect(CallbackEntry.AVAILABLE).getNetwork();
+        final Network network = cb.expect(Event.AVAILABLE).getNetwork();
         testAndCleanup(() -> {
             cb.eventuallyExpectBlockedStatusCallback(network, BLOCKED_REASON_NONE);
 
diff --git a/tests/cts/net/src/android/net/cts/DnsResolverTapTest.kt b/tests/cts/net/src/android/net/cts/DnsResolverTapTest.kt
index 172885dfcf..85ada4d3b4 100644
--- a/tests/cts/net/src/android/net/cts/DnsResolverTapTest.kt
+++ b/tests/cts/net/src/android/net/cts/DnsResolverTapTest.kt
@@ -39,7 +39,7 @@ import com.android.testutils.DeviceConfigRule
 import com.android.testutils.DnsResolverModuleTest
 import com.android.testutils.IPv6UdpFilter
 import com.android.testutils.NdResponder
-import com.android.testutils.RecorderCallback.CallbackEntry.LinkPropertiesChanged
+import com.android.testutils.TestableNetworkCallback.Event.LinkPropertiesChanged
 import com.android.testutils.TapPacketReaderRule
 import com.android.testutils.TestableNetworkAgent
 import com.android.testutils.TestDnsPacket
diff --git a/tests/cts/net/src/android/net/cts/DnsResolverTest.java b/tests/cts/net/src/android/net/cts/DnsResolverTest.java
index 28c25c0583..f3b53c687d 100644
--- a/tests/cts/net/src/android/net/cts/DnsResolverTest.java
+++ b/tests/cts/net/src/android/net/cts/DnsResolverTest.java
@@ -63,7 +63,7 @@ import com.android.testutils.DevSdkIgnoreRule;
 import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo;
 import com.android.testutils.DeviceConfigRule;
 import com.android.testutils.DnsResolverModuleTest;
-import com.android.testutils.RecorderCallback.CallbackEntry;
+import com.android.testutils.TestableNetworkCallback.Event;
 import com.android.testutils.SkipPresubmit;
 import com.android.testutils.TestableNetworkCallback;
 
@@ -194,7 +194,7 @@ public class DnsResolverTest {
     private Network getDefaultNetwork() {
         final TestableNetworkCallback cb = callbackRule.registerDefaultNetworkCallback();
         return testAndCleanup(
-                () -> cb.eventuallyExpect(CallbackEntry.AVAILABLE, TIMEOUT_MS).getNetwork(),
+                () -> cb.eventuallyExpect(Event.AVAILABLE, TIMEOUT_MS).getNetwork(),
                 () -> callbackRule.unregisterNetworkCallback(cb));
     }
 
diff --git a/tests/cts/net/src/android/net/cts/DscpPolicyTest.kt b/tests/cts/net/src/android/net/cts/DscpPolicyTest.kt
index 3409ecc1a8..a058ba9cd6 100644
--- a/tests/cts/net/src/android/net/cts/DscpPolicyTest.kt
+++ b/tests/cts/net/src/android/net/cts/DscpPolicyTest.kt
@@ -76,8 +76,8 @@ import com.android.testutils.NdResponder
 import com.android.testutils.PollPacketReader
 import com.android.testutils.SC_V2
 import com.android.testutils.TestableNetworkAgent
-import com.android.testutils.TestableNetworkAgent.CallbackEntry.OnDscpPolicyStatusUpdated
-import com.android.testutils.TestableNetworkAgent.CallbackEntry.OnNetworkCreated
+import com.android.testutils.TestableNetworkAgent.Event.OnDscpPolicyStatusUpdated
+import com.android.testutils.TestableNetworkAgent.Event.OnNetworkCreated
 import com.android.testutils.TestableNetworkCallback
 import com.android.testutils.assertParcelingIsLossless
 import com.android.testutils.runAsShell
diff --git a/tests/cts/net/src/android/net/cts/EthernetManagerTest.kt b/tests/cts/net/src/android/net/cts/EthernetManagerTest.kt
index 9065b4e1f9..a2d58ebf60 100644
--- a/tests/cts/net/src/android/net/cts/EthernetManagerTest.kt
+++ b/tests/cts/net/src/android/net/cts/EthernetManagerTest.kt
@@ -52,8 +52,8 @@ import android.net.StaticIpConfiguration
 import android.net.TestNetworkInterface
 import android.net.TestNetworkManager
 import android.net.TestNetworkManager.TestInterfaceRequest
-import android.net.cts.EthernetManagerTest.EthernetStateListener.CallbackEntry.EthernetStateChanged
-import android.net.cts.EthernetManagerTest.EthernetStateListener.CallbackEntry.InterfaceStateChanged
+import android.net.cts.EthernetManagerTest.EthernetStateListener.Event.EthernetStateChanged
+import android.net.cts.EthernetManagerTest.EthernetStateListener.Event.InterfaceStateChanged
 import android.os.Build
 import android.os.Handler
 import android.os.Looper
@@ -69,10 +69,10 @@ import com.android.testutils.DevSdkIgnoreRule
 import com.android.testutils.DevSdkIgnoreRunner
 import com.android.testutils.DeviceInfoUtils.isKernelVersionAtLeast
 import com.android.testutils.NdResponder
-import com.android.testutils.RecorderCallback.CallbackEntry.Available
-import com.android.testutils.RecorderCallback.CallbackEntry.CapabilitiesChanged
-import com.android.testutils.RecorderCallback.CallbackEntry.LinkPropertiesChanged
-import com.android.testutils.RecorderCallback.CallbackEntry.Lost
+import com.android.testutils.TestableNetworkCallback.Event.Available
+import com.android.testutils.TestableNetworkCallback.Event.CapabilitiesChanged
+import com.android.testutils.TestableNetworkCallback.Event.LinkPropertiesChanged
+import com.android.testutils.TestableNetworkCallback.Event.Lost
 import com.android.testutils.PollPacketReader
 import com.android.testutils.TestableNetworkCallback
 import com.android.testutils.assertThrows
@@ -208,20 +208,20 @@ class EthernetManagerTest {
     }
 
     private open class EthernetStateListener private constructor(
-        private val history: ArrayTrackRecord<CallbackEntry>
+        private val history: ArrayTrackRecord<Event>
     ) : InterfaceStateListener, IntConsumer,
-                TrackRecord<EthernetStateListener.CallbackEntry> by history {
+                TrackRecord<EthernetStateListener.Event> by history {
         constructor() : this(ArrayTrackRecord())
 
         val events = history.newReadHead()
 
-        sealed class CallbackEntry {
+        sealed class Event {
             data class InterfaceStateChanged(
                 val iface: String,
                 val state: Int,
                 val role: Int,
                 val configuration: IpConfiguration?
-            ) : CallbackEntry() {
+            ) : Event() {
                 override fun toString(): String {
                     val stateString = when (state) {
                         STATE_ABSENT -> "STATE_ABSENT"
@@ -240,7 +240,7 @@ class EthernetManagerTest {
                 }
             }
 
-            data class EthernetStateChanged(val state: Int) : CallbackEntry() {
+            data class EthernetStateChanged(val state: Int) : Event() {
                 override fun toString(): String {
                     val stateString = when (state) {
                         ETHERNET_STATE_ENABLED -> "ETHERNET_STATE_ENABLED"
@@ -265,7 +265,7 @@ class EthernetManagerTest {
             add(EthernetStateChanged(state))
         }
 
-        fun <T : CallbackEntry> expectCallback(expected: T): T {
+        fun <T : Event> expectCallback(expected: T): T {
             val event = events.poll(TIMEOUT_MS)
             assertEquals(expected, event)
             return event as T
@@ -283,7 +283,7 @@ class EthernetManagerTest {
                 InterfaceStateChanged(iface, state, role,
                         if (state != STATE_ABSENT) DEFAULT_IP_CONFIGURATION else null)
 
-        fun eventuallyExpect(expected: CallbackEntry) {
+        fun eventuallyExpect(expected: Event) {
             val cb = events.poll(TIMEOUT_MS) { it == expected }
             assertNotNull(cb, "Never received expected $expected. Received: ${events.backtrace()}")
         }
diff --git a/tests/cts/net/src/android/net/cts/Ikev2VpnTest.java b/tests/cts/net/src/android/net/cts/Ikev2VpnTest.java
index 493cb078c7..86363969ee 100644
--- a/tests/cts/net/src/android/net/cts/Ikev2VpnTest.java
+++ b/tests/cts/net/src/android/net/cts/Ikev2VpnTest.java
@@ -67,8 +67,8 @@ import com.android.networkstack.apishim.common.VpnProfileStateShim;
 import com.android.testutils.DevSdkIgnoreRule;
 import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo;
 import com.android.testutils.DevSdkIgnoreRunner;
-import com.android.testutils.RecorderCallback.CallbackEntry;
 import com.android.testutils.TestableNetworkCallback;
+import com.android.testutils.TestableNetworkCallback.Event;
 
 import org.bouncycastle.x509.X509V1CertificateGenerator;
 import org.junit.After;
@@ -565,7 +565,7 @@ public class Ikev2VpnTest {
                 HexDump.hexStringToByteArray(authResp));
 
         // Verify the VPN network came up
-        final Network vpnNetwork = cb.expect(CallbackEntry.AVAILABLE).getNetwork();
+        final Network vpnNetwork = cb.expect(Event.AVAILABLE).getNetwork();
 
         if (testSessionKey) {
             final VpnProfileStateShim profileState = mVmShim.getProvisionedVpnProfileState();
@@ -579,8 +579,8 @@ public class Ikev2VpnTest {
                 && c.hasCapability(NET_CAPABILITY_INTERNET)
                 && !c.hasCapability(NET_CAPABILITY_VALIDATED)
                 && Process.myUid() == c.getOwnerUid());
-        cb.expect(CallbackEntry.LINK_PROPERTIES_CHANGED, vpnNetwork);
-        cb.expect(CallbackEntry.BLOCKED_STATUS, vpnNetwork);
+        cb.expect(Event.LINK_PROPERTIES_CHANGED, vpnNetwork);
+        cb.expect(Event.BLOCKED_STATUS, vpnNetwork);
 
         // A VPN that requires validation is initially not validated, while one that doesn't
         // immediately validate automatically. Because this VPN can't actually access Internet,
@@ -592,15 +592,15 @@ public class Ikev2VpnTest {
         // misuse VPN network itself as the underlying network. The fix is not available without
         // SDK > T platform. Thus, verify this only on T+ platform.
         if (!requiresValidation && isAtLeastT()) {
-            cb.eventuallyExpect(CallbackEntry.NETWORK_CAPS_UPDATED, TIMEOUT_MS,
-                    entry -> ((CallbackEntry.CapabilitiesChanged) entry).getCaps()
+            cb.eventuallyExpect(Event.NETWORK_CAPS_UPDATED, TIMEOUT_MS,
+                    entry -> ((Event.CapabilitiesChanged) entry).getCaps()
                             .hasCapability(NET_CAPABILITY_VALIDATED));
         }
 
         sVpnMgr.stopProvisionedVpnProfile();
         // Using expectCallback may cause the test to be flaky since test may receive other
         // callbacks such as linkproperties change.
-        cb.eventuallyExpect(CallbackEntry.LOST, TIMEOUT_MS,
+        cb.eventuallyExpect(Event.LOST, TIMEOUT_MS,
                 lost -> vpnNetwork.equals(lost.getNetwork()));
     }
 
diff --git a/tests/cts/net/src/android/net/cts/NetworkAgentTest.kt b/tests/cts/net/src/android/net/cts/NetworkAgentTest.kt
index 8a541ed270..52bd0c7d91 100644
--- a/tests/cts/net/src/android/net/cts/NetworkAgentTest.kt
+++ b/tests/cts/net/src/android/net/cts/NetworkAgentTest.kt
@@ -75,9 +75,9 @@ import android.net.TransportInfo
 import android.net.Uri
 import android.net.VpnManager
 import android.net.VpnTransportInfo
-import android.net.cts.NetworkAgentTest.TestableQosCallback.CallbackEntry.OnError
-import android.net.cts.NetworkAgentTest.TestableQosCallback.CallbackEntry.OnQosSessionAvailable
-import android.net.cts.NetworkAgentTest.TestableQosCallback.CallbackEntry.OnQosSessionLost
+import android.net.cts.NetworkAgentTest.TestableQosCallback.Event.OnError
+import android.net.cts.NetworkAgentTest.TestableQosCallback.Event.OnQosSessionAvailable
+import android.net.cts.NetworkAgentTest.TestableQosCallback.Event.OnQosSessionLost
 import android.net.wifi.WifiInfo
 import android.os.Build
 import android.os.Handler
@@ -111,27 +111,27 @@ import com.android.testutils.ConnectivityModuleTest
 import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
 import com.android.testutils.DevSdkIgnoreRunner
 import com.android.testutils.PollPacketReader
-import com.android.testutils.RecorderCallback.CallbackEntry.Available
-import com.android.testutils.RecorderCallback.CallbackEntry.BlockedStatus
-import com.android.testutils.RecorderCallback.CallbackEntry.CapabilitiesChanged
-import com.android.testutils.RecorderCallback.CallbackEntry.LinkPropertiesChanged
-import com.android.testutils.RecorderCallback.CallbackEntry.Losing
-import com.android.testutils.RecorderCallback.CallbackEntry.Lost
 import com.android.testutils.TestableNetworkAgent
-import com.android.testutils.TestableNetworkAgent.CallbackEntry.OnAddKeepalivePacketFilter
-import com.android.testutils.TestableNetworkAgent.CallbackEntry.OnAutomaticReconnectDisabled
-import com.android.testutils.TestableNetworkAgent.CallbackEntry.OnBandwidthUpdateRequested
-import com.android.testutils.TestableNetworkAgent.CallbackEntry.OnNetworkCreated
-import com.android.testutils.TestableNetworkAgent.CallbackEntry.OnNetworkDestroyed
-import com.android.testutils.TestableNetworkAgent.CallbackEntry.OnNetworkUnwanted
-import com.android.testutils.TestableNetworkAgent.CallbackEntry.OnRegisterQosCallback
-import com.android.testutils.TestableNetworkAgent.CallbackEntry.OnRemoveKeepalivePacketFilter
-import com.android.testutils.TestableNetworkAgent.CallbackEntry.OnSaveAcceptUnvalidated
-import com.android.testutils.TestableNetworkAgent.CallbackEntry.OnStartSocketKeepalive
-import com.android.testutils.TestableNetworkAgent.CallbackEntry.OnStopSocketKeepalive
-import com.android.testutils.TestableNetworkAgent.CallbackEntry.OnUnregisterQosCallback
-import com.android.testutils.TestableNetworkAgent.CallbackEntry.OnValidationStatus
+import com.android.testutils.TestableNetworkAgent.Event.OnAddKeepalivePacketFilter
+import com.android.testutils.TestableNetworkAgent.Event.OnAutomaticReconnectDisabled
+import com.android.testutils.TestableNetworkAgent.Event.OnBandwidthUpdateRequested
+import com.android.testutils.TestableNetworkAgent.Event.OnNetworkCreated
+import com.android.testutils.TestableNetworkAgent.Event.OnNetworkDestroyed
+import com.android.testutils.TestableNetworkAgent.Event.OnNetworkUnwanted
+import com.android.testutils.TestableNetworkAgent.Event.OnRegisterQosCallback
+import com.android.testutils.TestableNetworkAgent.Event.OnRemoveKeepalivePacketFilter
+import com.android.testutils.TestableNetworkAgent.Event.OnSaveAcceptUnvalidated
+import com.android.testutils.TestableNetworkAgent.Event.OnStartSocketKeepalive
+import com.android.testutils.TestableNetworkAgent.Event.OnStopSocketKeepalive
+import com.android.testutils.TestableNetworkAgent.Event.OnUnregisterQosCallback
+import com.android.testutils.TestableNetworkAgent.Event.OnValidationStatus
 import com.android.testutils.TestableNetworkCallback
+import com.android.testutils.TestableNetworkCallback.Event.Available
+import com.android.testutils.TestableNetworkCallback.Event.BlockedStatus
+import com.android.testutils.TestableNetworkCallback.Event.CapabilitiesChanged
+import com.android.testutils.TestableNetworkCallback.Event.LinkPropertiesChanged
+import com.android.testutils.TestableNetworkCallback.Event.Losing
+import com.android.testutils.TestableNetworkCallback.Event.Lost
 import com.android.testutils.assertThrows
 import com.android.testutils.com.android.testutils.CarrierConfigRule
 import com.android.testutils.runAsShell
@@ -1310,13 +1310,13 @@ class NetworkAgentTest {
     }
 
     private class TestableQosCallback : QosCallback() {
-        val history = ArrayTrackRecord<CallbackEntry>().newReadHead()
+        val history = ArrayTrackRecord<Event>().newReadHead()
 
-        sealed class CallbackEntry {
+        sealed class Event {
             data class OnQosSessionAvailable(val sess: QosSession, val attr: QosSessionAttributes) :
-                CallbackEntry()
-            data class OnQosSessionLost(val sess: QosSession) : CallbackEntry()
-            data class OnError(val ex: QosCallbackException) : CallbackEntry()
+                Event()
+            data class OnQosSessionLost(val sess: QosSession) : Event()
+            data class OnError(val ex: QosCallbackException) : Event()
         }
 
         override fun onQosSessionAvailable(sess: QosSession, attr: QosSessionAttributes) {
@@ -1331,13 +1331,13 @@ class NetworkAgentTest {
             history.add(OnError(ex))
         }
 
-        inline fun <reified T : CallbackEntry> expectCallback(): T {
+        inline fun <reified T : Event> expectCallback(): T {
             val foundCallback = history.poll(DEFAULT_TIMEOUT_MS)
             assertTrue(foundCallback is T, "Expected ${T::class} but found $foundCallback")
             return foundCallback
         }
 
-        inline fun <reified T : CallbackEntry> expectCallback(valid: (T) -> Boolean) {
+        inline fun <reified T : Event> expectCallback(valid: (T) -> Boolean) {
             val foundCallback = history.poll(DEFAULT_TIMEOUT_MS)
             assertTrue(foundCallback is T, "Expected ${T::class} but found $foundCallback")
             assertTrue(valid(foundCallback), "Unexpected callback : $foundCallback")
diff --git a/tests/cts/net/src/android/net/cts/NetworkReservationTest.kt b/tests/cts/net/src/android/net/cts/NetworkReservationTest.kt
index 9afb0d3d71..cc4aaf51fa 100644
--- a/tests/cts/net/src/android/net/cts/NetworkReservationTest.kt
+++ b/tests/cts/net/src/android/net/cts/NetworkReservationTest.kt
@@ -47,9 +47,9 @@ import com.android.compatibility.common.util.SystemUtil.runShellCommandOrThrow
 import com.android.testutils.ConnectivityModuleTest
 import com.android.testutils.DevSdkIgnoreRule
 import com.android.testutils.DevSdkIgnoreRunner
-import com.android.testutils.RecorderCallback.CallbackEntry.Reserved
-import com.android.testutils.RecorderCallback.CallbackEntry.Unavailable
 import com.android.testutils.TestableNetworkCallback
+import com.android.testutils.TestableNetworkCallback.Event.Reserved
+import com.android.testutils.TestableNetworkCallback.Event.Unavailable
 import com.android.testutils.TestableNetworkOfferCallback
 import com.android.testutils.pollingCheck
 import com.android.testutils.runAsShell
diff --git a/tests/cts/net/src/android/net/cts/NetworkScoreTest.kt b/tests/cts/net/src/android/net/cts/NetworkScoreTest.kt
index e660b1e679..a85e478daf 100644
--- a/tests/cts/net/src/android/net/cts/NetworkScoreTest.kt
+++ b/tests/cts/net/src/android/net/cts/NetworkScoreTest.kt
@@ -35,8 +35,8 @@ import androidx.test.InstrumentationRegistry
 import com.android.compatibility.common.util.SystemUtil.runWithShellPermissionIdentity
 import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
 import com.android.testutils.DevSdkIgnoreRunner
-import com.android.testutils.RecorderCallback.CallbackEntry
 import com.android.testutils.TestableNetworkCallback
+import com.android.testutils.TestableNetworkCallback.Event
 import com.android.testutils.TestableNetworkCallback.HasNetwork
 import org.junit.After
 import org.junit.Before
@@ -91,7 +91,7 @@ class NetworkScoreTest {
         agentsToCleanUp.forEach {
             Log.i(TAG, "Unregister agent for net ${it.network}")
             it.unregister()
-            agentCleanUpCb.eventuallyExpect<CallbackEntry.Lost> { cb -> cb.network == it.network }
+            agentCleanUpCb.eventuallyExpect<Event.Lost> { cb -> cb.network == it.network }
         }
         mCm.unregisterNetworkCallback(agentCleanUpCb)
 
diff --git a/tests/cts/net/src/android/net/cts/NetworkStatsManagerTest.java b/tests/cts/net/src/android/net/cts/NetworkStatsManagerTest.java
index ff43aa072c..03e14ab064 100644
--- a/tests/cts/net/src/android/net/cts/NetworkStatsManagerTest.java
+++ b/tests/cts/net/src/android/net/cts/NetworkStatsManagerTest.java
@@ -77,8 +77,8 @@ import com.android.testutils.ConnectivityDiagnosticsCollector;
 import com.android.testutils.ConnectivityModuleTest;
 import com.android.testutils.DevSdkIgnoreRule;
 import com.android.testutils.DevSdkIgnoreRunner;
-import com.android.testutils.RecorderCallback.CallbackEntry;
 import com.android.testutils.TestableNetworkCallback;
+import com.android.testutils.TestableNetworkCallback.Event;
 
 import org.junit.After;
 import org.junit.Before;
@@ -192,7 +192,7 @@ public class NetworkStatsManagerTest {
                             networkCallbackRule.requestNetwork(buildRequestForTransport(
                                     NetworkCapabilities.TRANSPORT_WIFI),
                                     mRequestNetworkCb, TIMEOUT_MILLIS);
-                            return mRequestNetworkCb.expect(CallbackEntry.AVAILABLE,
+                            return mRequestNetworkCb.expect(Event.AVAILABLE,
                                     "Wifi network not available. "
                                             + "Please ensure the device has working wifi."
                             ).getNetwork();
@@ -214,7 +214,7 @@ public class NetworkStatsManagerTest {
                             networkCallbackRule.requestNetwork(buildRequestForTransport(
                                             NetworkCapabilities.TRANSPORT_CELLULAR),
                                     mRequestNetworkCb, TIMEOUT_MILLIS);
-                            return mRequestNetworkCb.expect(CallbackEntry.AVAILABLE,
+                            return mRequestNetworkCb.expect(Event.AVAILABLE,
                                     "Cell network not available. "
                                             + "Please ensure the device has working mobile data."
                             ).getNetwork();
@@ -366,7 +366,7 @@ public class NetworkStatsManagerTest {
         // interested attributes are not mutable, and not expected to be
         // changed during the test.
         final NetworkCapabilities caps = networkInterface.mRequestNetworkCb.expect(
-                CallbackEntry.NETWORK_CAPS_UPDATED, network).getCaps();
+                Event.NETWORK_CAPS_UPDATED, network).getCaps();
         networkInterface.setMetered(!caps.hasCapability(
                 NetworkCapabilities.NET_CAPABILITY_NOT_METERED));
         networkInterface.setRoaming(!caps.hasCapability(
diff --git a/tests/cts/net/src/android/net/cts/NetworkValidationTest.kt b/tests/cts/net/src/android/net/cts/NetworkValidationTest.kt
index 67068beb85..8db6e28b12 100644
--- a/tests/cts/net/src/android/net/cts/NetworkValidationTest.kt
+++ b/tests/cts/net/src/android/net/cts/NetworkValidationTest.kt
@@ -47,9 +47,10 @@ import com.android.testutils.AutoCloseTestInterfaceRule
 import com.android.testutils.DhcpClientPacketFilter
 import com.android.testutils.DhcpOptionFilter
 import com.android.testutils.PollPacketReader
-import com.android.testutils.RecorderCallback.CallbackEntry
 import com.android.testutils.TestHttpServer
 import com.android.testutils.TestableNetworkCallback
+import com.android.testutils.TestableNetworkCallback.Event.CapabilitiesChanged
+import com.android.testutils.TestableNetworkCallback.Event.LinkPropertiesChanged
 import com.android.testutils.runAsShell
 import fi.iki.elonen.NanoHTTPD.Response.Status
 import java.net.Inet4Address
@@ -181,10 +182,10 @@ class NetworkValidationTest {
 
             try {
                 val mark = testCb.mark
-                val ncCb = testCb.eventuallyExpect<CallbackEntry.CapabilitiesChanged>(from = mark) {
+                val ncCb = testCb.eventuallyExpect<CapabilitiesChanged>(from = mark) {
                     it.caps.hasCapability(NET_CAPABILITY_CAPTIVE_PORTAL)
                 }
-                testCb.eventuallyExpect<CallbackEntry.LinkPropertiesChanged>(from = mark) {
+                testCb.eventuallyExpect<LinkPropertiesChanged>(from = mark) {
                     it.network == ncCb.network && it.lp.captivePortalData != null
                 }.lp
             } finally {
diff --git a/tests/cts/net/src/android/net/cts/NsdManagerTest.kt b/tests/cts/net/src/android/net/cts/NsdManagerTest.kt
index ee31f1af3a..db3c4837f4 100644
--- a/tests/cts/net/src/android/net/cts/NsdManagerTest.kt
+++ b/tests/cts/net/src/android/net/cts/NsdManagerTest.kt
@@ -92,8 +92,8 @@ import com.android.testutils.NsdServiceInfoCallbackRecord.ServiceInfoCallbackEve
 import com.android.testutils.NsdServiceInfoCallbackRecord.ServiceInfoCallbackEvent.ServiceUpdatedLost
 import com.android.testutils.NsdServiceInfoCallbackRecord.ServiceInfoCallbackEvent.UnregisterCallbackSucceeded
 import com.android.testutils.PollPacketReader
-import com.android.testutils.RecorderCallback.CallbackEntry.CapabilitiesChanged
-import com.android.testutils.RecorderCallback.CallbackEntry.LinkPropertiesChanged
+import com.android.testutils.TestableNetworkCallback.Event.CapabilitiesChanged
+import com.android.testutils.TestableNetworkCallback.Event.LinkPropertiesChanged
 import com.android.testutils.TestDnsPacket
 import com.android.testutils.TestableNetworkAgent
 import com.android.testutils.TestableNetworkCallback
diff --git a/tests/cts/net/util/java/android/net/cts/util/CtsNetUtils.java b/tests/cts/net/util/java/android/net/cts/util/CtsNetUtils.java
index 680aa08731..1d8e66d77f 100644
--- a/tests/cts/net/util/java/android/net/cts/util/CtsNetUtils.java
+++ b/tests/cts/net/util/java/android/net/cts/util/CtsNetUtils.java
@@ -74,8 +74,8 @@ import com.android.compatibility.common.util.SystemUtil;
 import com.android.modules.utils.build.SdkLevel;
 import com.android.net.module.util.ConnectivitySettingsUtils;
 import com.android.testutils.ConnectUtil;
-import com.android.testutils.RecorderCallback.CallbackEntry;
 import com.android.testutils.TestableNetworkCallback;
+import com.android.testutils.TestableNetworkCallback.Event;
 
 import java.io.IOException;
 import java.io.InputStream;
@@ -582,7 +582,7 @@ public final class CtsNetUtils {
                     .addTransportType(NetworkCapabilities.TRANSPORT_CELLULAR)
                     .addCapability(NetworkCapabilities.NET_CAPABILITY_INTERNET)
                     .build(), cb);
-            final Network cellNetwork = cb.expect(CallbackEntry.AVAILABLE, errorMsg).getNetwork();
+            final Network cellNetwork = cb.expect(Event.AVAILABLE, errorMsg).getNetwork();
             mCm.unregisterNetworkCallback(cb);
             testableNetworks.add(cellNetwork);
         }
diff --git a/tests/cts/tethering/src/android/tethering/cts/TetheringWifiP2pTest.kt b/tests/cts/tethering/src/android/tethering/cts/TetheringWifiP2pTest.kt
index 4bb1fddd7e..ac05a56f00 100644
--- a/tests/cts/tethering/src/android/tethering/cts/TetheringWifiP2pTest.kt
+++ b/tests/cts/tethering/src/android/tethering/cts/TetheringWifiP2pTest.kt
@@ -34,10 +34,10 @@ import com.android.testutils.AutoReleaseNetworkCallbackRule
 import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
 import com.android.testutils.DevSdkIgnoreRunner
 import com.android.testutils.DeviceConfigRule
-import com.android.testutils.RecorderCallback.CallbackEntry.Available
-import com.android.testutils.RecorderCallback.CallbackEntry.CapabilitiesChanged
-import com.android.testutils.RecorderCallback.CallbackEntry.LinkPropertiesChanged
 import com.android.testutils.TestableNetworkCallback
+import com.android.testutils.TestableNetworkCallback.Event.Available
+import com.android.testutils.TestableNetworkCallback.Event.CapabilitiesChanged
+import com.android.testutils.TestableNetworkCallback.Event.LinkPropertiesChanged
 import com.android.testutils.runAsShell
 import com.google.snippet.connectivity.Wifip2pMultiDevicesSnippet
 import java.util.Random
diff --git a/tests/integration/src/android/net/ClatTest.kt b/tests/integration/src/android/net/ClatTest.kt
index 1c279b24ee..b1f9f62462 100644
--- a/tests/integration/src/android/net/ClatTest.kt
+++ b/tests/integration/src/android/net/ClatTest.kt
@@ -41,8 +41,8 @@ import com.android.testutils.EthernetTestInterface
 import com.android.testutils.Ip6Pkt
 import com.android.testutils.NdResponder
 import com.android.testutils.RaPkt
-import com.android.testutils.RecorderCallback.CallbackEntry.LinkPropertiesChanged
 import com.android.testutils.TestableNetworkCallback
+import com.android.testutils.TestableNetworkCallback.Event.LinkPropertiesChanged
 import com.android.testutils.UdpPkt
 import com.android.testutils.runAsShell
 import com.google.common.truth.Truth.assertThat
diff --git a/tests/integration/src/android/net/Dhcp6PdTest.kt b/tests/integration/src/android/net/Dhcp6PdTest.kt
index e40956c40c..748b258044 100644
--- a/tests/integration/src/android/net/Dhcp6PdTest.kt
+++ b/tests/integration/src/android/net/Dhcp6PdTest.kt
@@ -43,9 +43,9 @@ import com.android.testutils.Ip6Pkt
 import com.android.testutils.NdResponder
 import com.android.testutils.PacketBuilder
 import com.android.testutils.RaPkt
-import com.android.testutils.RecorderCallback.CallbackEntry.Available
-import com.android.testutils.RecorderCallback.CallbackEntry.LinkPropertiesChanged
 import com.android.testutils.TestableNetworkCallback
+import com.android.testutils.TestableNetworkCallback.Event.Available
+import com.android.testutils.TestableNetworkCallback.Event.LinkPropertiesChanged
 import com.android.testutils.UdpPkt
 import com.android.testutils.runAsShell
 import com.google.common.truth.Truth.assertThat
diff --git a/tests/integration/src/com/android/server/net/integrationtests/ConnectivityServiceIntegrationTest.kt b/tests/integration/src/com/android/server/net/integrationtests/ConnectivityServiceIntegrationTest.kt
index 5357cf559e..563ced89e5 100644
--- a/tests/integration/src/com/android/server/net/integrationtests/ConnectivityServiceIntegrationTest.kt
+++ b/tests/integration/src/com/android/server/net/integrationtests/ConnectivityServiceIntegrationTest.kt
@@ -67,8 +67,8 @@ import com.android.server.connectivity.ProxyTracker
 import com.android.server.connectivity.SatelliteAccessController
 import com.android.testutils.DevSdkIgnoreRunner
 import com.android.testutils.DeviceInfoUtils
-import com.android.testutils.RecorderCallback.CallbackEntry.LinkPropertiesChanged
 import com.android.testutils.TestableNetworkCallback
+import com.android.testutils.TestableNetworkCallback.Event.LinkPropertiesChanged
 import com.android.testutils.runAsShell
 import com.android.testutils.tryTest
 import java.util.function.BiConsumer
diff --git a/tests/integration/src/com/android/server/net/integrationtests/NetworkStatsIntegrationTest.kt b/tests/integration/src/com/android/server/net/integrationtests/NetworkStatsIntegrationTest.kt
index 4780c5d4b9..1d7b54d116 100644
--- a/tests/integration/src/com/android/server/net/integrationtests/NetworkStatsIntegrationTest.kt
+++ b/tests/integration/src/com/android/server/net/integrationtests/NetworkStatsIntegrationTest.kt
@@ -44,7 +44,7 @@ import com.android.server.net.integrationtests.NetworkStatsIntegrationTest.Direc
 import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
 import com.android.testutils.DevSdkIgnoreRunner
 import com.android.testutils.PacketBridge
-import com.android.testutils.RecorderCallback.CallbackEntry.LinkPropertiesChanged
+import com.android.testutils.TestableNetworkCallback.Event.LinkPropertiesChanged
 import com.android.testutils.TestDnsServer
 import com.android.testutils.TestHttpServer
 import com.android.testutils.TestableNetworkCallback
diff --git a/tests/unit/java/com/android/server/ConnectivityServiceTest.java b/tests/unit/java/com/android/server/ConnectivityServiceTest.java
old mode 100755
new mode 100644
index f4d1003866..a8b95b7418
--- a/tests/unit/java/com/android/server/ConnectivityServiceTest.java
+++ b/tests/unit/java/com/android/server/ConnectivityServiceTest.java
@@ -189,16 +189,16 @@ import static com.android.testutils.MiscAsserts.assertLength;
 import static com.android.testutils.MiscAsserts.assertRunsInAtMost;
 import static com.android.testutils.MiscAsserts.assertSameElements;
 import static com.android.testutils.MiscAsserts.assertThrows;
-import static com.android.testutils.RecorderCallback.CallbackEntry.AVAILABLE;
-import static com.android.testutils.RecorderCallback.CallbackEntry.BLOCKED_STATUS;
-import static com.android.testutils.RecorderCallback.CallbackEntry.BLOCKED_STATUS_INT;
-import static com.android.testutils.RecorderCallback.CallbackEntry.LINK_PROPERTIES_CHANGED;
-import static com.android.testutils.RecorderCallback.CallbackEntry.LOSING;
-import static com.android.testutils.RecorderCallback.CallbackEntry.LOST;
-import static com.android.testutils.RecorderCallback.CallbackEntry.NETWORK_CAPS_UPDATED;
-import static com.android.testutils.RecorderCallback.CallbackEntry.RESUMED;
-import static com.android.testutils.RecorderCallback.CallbackEntry.SUSPENDED;
-import static com.android.testutils.RecorderCallback.CallbackEntry.UNAVAILABLE;
+import static com.android.testutils.TestableNetworkCallback.Event.AVAILABLE;
+import static com.android.testutils.TestableNetworkCallback.Event.BLOCKED_STATUS;
+import static com.android.testutils.TestableNetworkCallback.Event.BLOCKED_STATUS_INT;
+import static com.android.testutils.TestableNetworkCallback.Event.LINK_PROPERTIES_CHANGED;
+import static com.android.testutils.TestableNetworkCallback.Event.LOSING;
+import static com.android.testutils.TestableNetworkCallback.Event.LOST;
+import static com.android.testutils.TestableNetworkCallback.Event.NETWORK_CAPS_UPDATED;
+import static com.android.testutils.TestableNetworkCallback.Event.RESUMED;
+import static com.android.testutils.TestableNetworkCallback.Event.SUSPENDED;
+import static com.android.testutils.TestableNetworkCallback.Event.UNAVAILABLE;
 import static com.android.testutils.TestPermissionUtil.runAsShell;
 
 import static org.hamcrest.MatcherAssert.assertThat;
@@ -433,8 +433,8 @@ import com.android.testutils.FunctionalUtils.Function3;
 import com.android.testutils.FunctionalUtils.ThrowingConsumer;
 import com.android.testutils.FunctionalUtils.ThrowingRunnable;
 import com.android.testutils.HandlerUtils;
-import com.android.testutils.RecorderCallback.CallbackEntry;
 import com.android.testutils.TestableNetworkCallback;
+import com.android.testutils.TestableNetworkCallback.Event;
 import com.android.testutils.TestableNetworkOfferCallback;
 
 import libcore.junit.util.compat.CoreCompatChangeRule.DisableCompatChanges;
@@ -3387,8 +3387,8 @@ public class ConnectivityServiceTest {
                     ConnectivityServiceTest.this::waitForIdle);
         }
 
-        public CallbackEntry.Losing expectLosing(final HasNetwork n, final long timeoutMs) {
-            final CallbackEntry.Losing losing = expect(LOSING, n, timeoutMs);
+        public Event.Losing expectLosing(final HasNetwork n, final long timeoutMs) {
+            final Event.Losing losing = expect(LOSING, n, timeoutMs);
             final int maxMsToLive = losing.getMaxMsToLive();
             if (maxMsToLive < 0 || maxMsToLive > mService.mLingerDelayMs) {
                 // maxMsToLive is the value that was received in the onLosing callback. That must
@@ -3403,7 +3403,7 @@ public class ConnectivityServiceTest {
             return losing;
         }
 
-        public CallbackEntry.Losing expectLosing(final HasNetwork n) {
+        public Event.Losing expectLosing(final HasNetwork n) {
             return expectLosing(n, getDefaultTimeoutMs());
         }
     }
@@ -3468,9 +3468,9 @@ public class ConnectivityServiceTest {
         cb.assertNoCallback();
         mWiFiAgent.connect(false);
         cb.expectAvailableCallbacksUnvalidated(mWiFiAgent);
-        final CallbackEntry found = CollectionUtils.findLast(cb.getHistory(),
-                it -> it instanceof CallbackEntry.CapabilitiesChanged);
-        assertTrue(((CallbackEntry.CapabilitiesChanged) found).getCaps()
+        final Event found = CollectionUtils.findLast(cb.getHistory(),
+                it -> it instanceof Event.CapabilitiesChanged);
+        assertTrue(((Event.CapabilitiesChanged) found).getCaps()
                 .hasCapability(NET_CAPABILITY_TEMPORARILY_NOT_METERED));
         cb.assertNoCallback();
         mCm.unregisterNetworkCallback(cb);
@@ -3518,16 +3518,16 @@ public class ConnectivityServiceTest {
 
         b = expectConnectivityAction(2);
         mWiFiAgent.disconnect();
-        genericNetworkCallback.expect(CallbackEntry.LOST, mWiFiAgent);
-        wifiNetworkCallback.expect(CallbackEntry.LOST, mWiFiAgent);
+        genericNetworkCallback.expect(Event.LOST, mWiFiAgent);
+        wifiNetworkCallback.expect(Event.LOST, mWiFiAgent);
         cellNetworkCallback.assertNoCallback();
         b.expectBroadcast();
         assertNoCallbacks(genericNetworkCallback, wifiNetworkCallback, cellNetworkCallback);
 
         b = expectConnectivityAction(1);
         mCellAgent.disconnect();
-        genericNetworkCallback.expect(CallbackEntry.LOST, mCellAgent);
-        cellNetworkCallback.expect(CallbackEntry.LOST, mCellAgent);
+        genericNetworkCallback.expect(Event.LOST, mCellAgent);
+        cellNetworkCallback.expect(Event.LOST, mCellAgent);
         b.expectBroadcast();
         assertNoCallbacks(genericNetworkCallback, wifiNetworkCallback, cellNetworkCallback);
 
@@ -7882,7 +7882,7 @@ public class ConnectivityServiceTest {
         networkAgent.connect(true);
         networkCallback.expect(AVAILABLE, networkAgent);
         networkCallback.expect(NETWORK_CAPS_UPDATED, networkAgent);
-        CallbackEntry.LinkPropertiesChanged cbi =
+        Event.LinkPropertiesChanged cbi =
                 networkCallback.expect(LINK_PROPERTIES_CHANGED, networkAgent);
         networkCallback.expect(BLOCKED_STATUS, networkAgent);
         networkCallback.expectCaps(networkAgent, c -> c.hasCapability(NET_CAPABILITY_VALIDATED));
@@ -8480,7 +8480,7 @@ public class ConnectivityServiceTest {
         reset(mMockDnsResolver);
         cellNetworkCallback.expect(AVAILABLE, mCellAgent);
         cellNetworkCallback.expect(NETWORK_CAPS_UPDATED, mCellAgent);
-        CallbackEntry.LinkPropertiesChanged cbi = cellNetworkCallback.expect(
+        Event.LinkPropertiesChanged cbi = cellNetworkCallback.expect(
                 LINK_PROPERTIES_CHANGED, mCellAgent);
         cellNetworkCallback.expect(BLOCKED_STATUS, mCellAgent);
         cellNetworkCallback.assertNoCallback();
@@ -8547,7 +8547,7 @@ public class ConnectivityServiceTest {
         waitForIdle();
         cellNetworkCallback.expect(AVAILABLE, mCellAgent);
         cellNetworkCallback.expect(NETWORK_CAPS_UPDATED, mCellAgent);
-        CallbackEntry.LinkPropertiesChanged cbi = cellNetworkCallback.expect(
+        Event.LinkPropertiesChanged cbi = cellNetworkCallback.expect(
                 LINK_PROPERTIES_CHANGED, mCellAgent);
         cellNetworkCallback.expect(BLOCKED_STATUS, mCellAgent);
         cellNetworkCallback.assertNoCallback();
@@ -9826,7 +9826,7 @@ public class ConnectivityServiceTest {
             super.expectAvailableThenValidatedCallbacks(n.getNetwork(), blockedStatus, TIMEOUT_MS);
         }
         public void onBlockedStatusChanged(Network network, int blockedReasons) {
-            getHistory().add(new CallbackEntry.BlockedStatusInt(network, blockedReasons));
+            getHistory().add(new Event.BlockedStatusInt(network, blockedReasons));
         }
     }
 
@@ -10080,7 +10080,7 @@ public class ConnectivityServiceTest {
 
         // Expect exactly one blocked callback for each agent.
         for (int i = 0; i < agents.length; i++) {
-            final CallbackEntry e = callback.expect(BLOCKED_STATUS, TIMEOUT_MS,
+            final Event e = callback.expect(BLOCKED_STATUS, TIMEOUT_MS,
                     c -> c.getBlocked() == blocked);
             final Network network = e.getNetwork();
             assertTrue("Received unexpected blocked callback for network " + network,
@@ -11932,7 +11932,7 @@ public class ConnectivityServiceTest {
         final LinkProperties testLinkProperties = new LinkProperties();
         testLinkProperties.setHttpProxy(initialProxyInfo);
         mWiFiAgent.sendLinkProperties(testLinkProperties);
-        wifiCallback.expect(CallbackEntry.LINK_PROPERTIES_CHANGED, mWiFiAgent);
+        wifiCallback.expect(Event.LINK_PROPERTIES_CHANGED, mWiFiAgent);
         cellCallback.assertNoCallback();
 
         // At first the local PAC proxy server is unstarted (see the description of what the local
@@ -11965,7 +11965,7 @@ public class ConnectivityServiceTest {
         final ProxyInfo servingProxyInfo = new ProxyInfo(pacUrl, 2097);
         final ExpectedBroadcast servingProxyBroadcast = expectProxyChangeAction(servingProxyInfo);
         mService.simulateUpdateProxyInfo(mWiFiAgent.getNetwork(), servingProxyInfo);
-        wifiCallback.expect(CallbackEntry.LINK_PROPERTIES_CHANGED, mWiFiAgent);
+        wifiCallback.expect(Event.LINK_PROPERTIES_CHANGED, mWiFiAgent);
         cellCallback.assertNoCallback();
         servingProxyBroadcast.expectBroadcast();
 
@@ -11997,14 +11997,14 @@ public class ConnectivityServiceTest {
                 lp -> lp.getLp().getHttpProxy().getPort() == -1
                         && lp.getLp().getHttpProxy().isPacProxy());
         // Wifi is lingered as it was the default but is no longer serving any request.
-        wifiCallback.expect(CallbackEntry.LOSING, mWiFiAgent);
+        wifiCallback.expect(Event.LOSING, mWiFiAgent);
 
         // Now arrange for Ethernet to have a PAC proxy.
         final ProxyInfo ethProxy = ProxyInfo.buildPacProxy(ethPacUrl);
         final LinkProperties ethLinkProperties = new LinkProperties();
         ethLinkProperties.setHttpProxy(ethProxy);
         mEthernetAgent.sendLinkProperties(ethLinkProperties);
-        ethernetCallback.expect(CallbackEntry.LINK_PROPERTIES_CHANGED, mEthernetAgent);
+        ethernetCallback.expect(Event.LINK_PROPERTIES_CHANGED, mEthernetAgent);
         // Default network is Ethernet
         assertEquals(ethProxy, mService.getProxyForNetwork(null));
         assertEquals(ethProxy, mService.getProxyForNetwork(mEthernetAgent.getNetwork()));
@@ -12024,7 +12024,7 @@ public class ConnectivityServiceTest {
         final ExpectedBroadcast servingEthProxyBroadcast = expectProxyChangeAction(servingEthProxy);
         final ExpectedBroadcast servingProxyBroadcast2 = expectProxyChangeAction(servingProxyInfo);
         mService.simulateUpdateProxyInfo(mEthernetAgent.getNetwork(), servingEthProxy);
-        ethernetCallback.expect(CallbackEntry.LINK_PROPERTIES_CHANGED, mEthernetAgent);
+        ethernetCallback.expect(Event.LINK_PROPERTIES_CHANGED, mEthernetAgent);
         assertEquals(servingEthProxy, mService.getProxyForNetwork(null));
         assertEquals(servingEthProxy, mService.getProxyForNetwork(mEthernetAgent.getNetwork()));
         assertEquals(initialProxyInfo, mService.getProxyForNetwork(mWiFiAgent.getNetwork()));
@@ -12033,7 +12033,7 @@ public class ConnectivityServiceTest {
 
         // Ethernet disconnects, back to WiFi
         mEthernetAgent.disconnect();
-        ethernetCallback.expect(CallbackEntry.LOST, mEthernetAgent);
+        ethernetCallback.expect(Event.LOST, mEthernetAgent);
 
         // WiFi is now the default network again. However, the local proxy server does not serve
         // WiFi at this time, so at this time a proxy with port -1 is still the correct value.
@@ -12056,7 +12056,7 @@ public class ConnectivityServiceTest {
         // starts up. This should cause a LP event to inform clients of the port to access the
         // proxy server for wifi.
         mService.simulateUpdateProxyInfo(mWiFiAgent.getNetwork(), servingProxyInfo);
-        wifiCallback.expect(CallbackEntry.LINK_PROPERTIES_CHANGED, mWiFiAgent);
+        wifiCallback.expect(Event.LINK_PROPERTIES_CHANGED, mWiFiAgent);
         assertEquals(servingProxyInfo, mService.getProxyForNetwork(null));
         assertEquals(servingProxyInfo, mService.getProxyForNetwork(mWiFiAgent.getNetwork()));
         assertNull(mService.getProxyForNetwork(mCellAgent.getNetwork()));
@@ -12070,7 +12070,7 @@ public class ConnectivityServiceTest {
                 proxy -> proxy == null || TextUtils.isEmpty(proxy.getHost()));
         mWiFiAgent.disconnect();
         emptyProxyBroadcast.expectBroadcast();
-        wifiCallback.expect(CallbackEntry.LOST, mWiFiAgent);
+        wifiCallback.expect(Event.LOST, mWiFiAgent);
         assertNull(mService.getProxyForNetwork(null));
         assertNull(mService.getLinkProperties(mCellAgent.getNetwork()).getHttpProxy());
         assertNull(mService.getGlobalProxy());
@@ -12100,7 +12100,7 @@ public class ConnectivityServiceTest {
         final ProxyInfo servingProxyInfo = new ProxyInfo(pacUrl, 2097);
         final ExpectedBroadcast servingProxyBroadcast = expectProxyChangeAction(servingProxyInfo);
         mService.simulateUpdateProxyInfo(mWiFiAgent.getNetwork(), servingProxyInfo);
-        wifiCallback.expect(CallbackEntry.LINK_PROPERTIES_CHANGED, mWiFiAgent);
+        wifiCallback.expect(Event.LINK_PROPERTIES_CHANGED, mWiFiAgent);
         servingProxyBroadcast.expectBroadcast();
 
         // Now disconnect Wi-Fi and make sure there is a broadcast for some empty proxy. Whether
@@ -12109,7 +12109,7 @@ public class ConnectivityServiceTest {
         final ExpectedBroadcast emptyProxyBroadcast = expectProxyChangeAction(
                 proxy -> proxy == null || TextUtils.isEmpty(proxy.getHost()));
         mWiFiAgent.disconnect();
-        wifiCallback.expect(CallbackEntry.LOST, mWiFiAgent);
+        wifiCallback.expect(Event.LOST, mWiFiAgent);
         emptyProxyBroadcast.expectBroadcast();
     }
 
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSBlockedReasonsTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSBlockedReasonsTest.kt
index 985d403fe3..c33dc69cb2 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSBlockedReasonsTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSBlockedReasonsTest.kt
@@ -43,8 +43,8 @@ import android.os.Build
 import android.os.Process
 import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
 import com.android.testutils.DevSdkIgnoreRunner
-import com.android.testutils.RecorderCallback.CallbackEntry.BlockedStatusInt
 import com.android.testutils.TestableNetworkCallback
+import com.android.testutils.TestableNetworkCallback.Event.BlockedStatusInt
 import org.junit.Test
 import org.junit.runner.RunWith
 import org.mockito.ArgumentMatchers.anyBoolean
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSDeclaredMethodsForCallbacksTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSDeclaredMethodsForCallbacksTest.kt
index b179aac770..f1c2143a54 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSDeclaredMethodsForCallbacksTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSDeclaredMethodsForCallbacksTest.kt
@@ -35,8 +35,8 @@ import com.android.server.defaultLp
 import com.android.server.defaultNc
 import com.android.testutils.DevSdkIgnoreRule
 import com.android.testutils.DevSdkIgnoreRunner
-import com.android.testutils.RecorderCallback.CallbackEntry
 import com.android.testutils.TestableNetworkCallback
+import com.android.testutils.TestableNetworkCallback.Event
 import com.android.testutils.tryTest
 import java.lang.reflect.Modifier
 import java.util.concurrent.atomic.AtomicInteger
@@ -127,11 +127,11 @@ class CSDeclaredMethodsForCallbacksTest : CSTest() {
         waitForIdle()
 
         // Only callbacks for the corresponding flags are called
-        requestCb.expect<CallbackEntry.LinkPropertiesChanged>()
-        requestCb.expect<CallbackEntry.Lost>()
+        requestCb.expect<Event.LinkPropertiesChanged>()
+        requestCb.expect<Event.Lost>()
         requestCb.assertNoCallback(timeoutMs = 0L)
 
-        listenCb.expect<CallbackEntry.CapabilitiesChanged>()
+        listenCb.expect<Event.CapabilitiesChanged>()
         listenCb.assertNoCallback(timeoutMs = 0L)
     }
 
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSDestroyedNetworkTests.kt b/tests/unit/java/com/android/server/connectivityservice/CSDestroyedNetworkTests.kt
index b82453140c..3b511b150e 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSDestroyedNetworkTests.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSDestroyedNetworkTests.kt
@@ -23,8 +23,8 @@ import android.os.Build
 import androidx.test.filters.SmallTest
 import com.android.testutils.DevSdkIgnoreRule
 import com.android.testutils.DevSdkIgnoreRunner
-import com.android.testutils.RecorderCallback.CallbackEntry.Lost
 import com.android.testutils.TestableNetworkCallback
+import com.android.testutils.TestableNetworkCallback.Event.Lost
 import org.junit.Test
 import org.junit.runner.RunWith
 import org.mockito.ArgumentMatchers.anyInt
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSIngressDiscardRuleTests.kt b/tests/unit/java/com/android/server/connectivityservice/CSIngressDiscardRuleTests.kt
index 77b06b2239..2ef035e9b7 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSIngressDiscardRuleTests.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSIngressDiscardRuleTests.kt
@@ -35,8 +35,8 @@ import androidx.test.filters.SmallTest
 import com.android.server.connectivity.ConnectivityFlags
 import com.android.testutils.DevSdkIgnoreRule
 import com.android.testutils.DevSdkIgnoreRunner
-import com.android.testutils.RecorderCallback.CallbackEntry.LinkPropertiesChanged
 import com.android.testutils.TestableNetworkCallback
+import com.android.testutils.TestableNetworkCallback.Event.LinkPropertiesChanged
 import org.junit.Test
 import org.junit.runner.RunWith
 import org.mockito.InOrder
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSInterfaceTrackerTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSInterfaceTrackerTest.kt
index b06e11357f..08236e006f 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSInterfaceTrackerTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSInterfaceTrackerTest.kt
@@ -31,12 +31,11 @@ import androidx.test.filters.SmallTest
 import com.android.server.CSTest
 import com.android.testutils.DevSdkIgnoreRule
 import com.android.testutils.DevSdkIgnoreRunner
-import com.android.testutils.RecorderCallback.CallbackEntry.Lost
 import com.android.testutils.TestableNetworkCallback
+import com.android.testutils.TestableNetworkCallback.Event.Lost
 import org.junit.Test
 import org.junit.runner.RunWith
 import org.mockito.Mockito.inOrder
-import org.mockito.Mockito.verify
 
 private const val WIFI_IFNAME = "wlan0"
 
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSKeepConnectedTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSKeepConnectedTest.kt
index c0965b4ff7..d99099450d 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSKeepConnectedTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSKeepConnectedTest.kt
@@ -28,8 +28,8 @@ import android.os.Build
 import androidx.test.filters.SmallTest
 import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
 import com.android.testutils.DevSdkIgnoreRunner
-import com.android.testutils.RecorderCallback.CallbackEntry.Lost
 import com.android.testutils.TestableNetworkCallback
+import com.android.testutils.TestableNetworkCallback.Event.Lost
 import org.junit.Test
 import org.junit.runner.RunWith
 
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSL2capProviderTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSL2capProviderTest.kt
index ee5b4eede5..98e7ff44ae 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSL2capProviderTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSL2capProviderTest.kt
@@ -45,10 +45,10 @@ import com.android.server.net.L2capNetwork.L2capIpClient
 import com.android.server.net.L2capPacketForwarder
 import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
 import com.android.testutils.DevSdkIgnoreRunner
-import com.android.testutils.RecorderCallback.CallbackEntry.Lost
-import com.android.testutils.RecorderCallback.CallbackEntry.Reserved
-import com.android.testutils.RecorderCallback.CallbackEntry.Unavailable
 import com.android.testutils.TestableNetworkCallback
+import com.android.testutils.TestableNetworkCallback.Event.Lost
+import com.android.testutils.TestableNetworkCallback.Event.Reserved
+import com.android.testutils.TestableNetworkCallback.Event.Unavailable
 import com.android.testutils.anyNetwork
 import com.android.testutils.waitForIdle
 import java.io.IOException
@@ -67,7 +67,6 @@ import org.mockito.ArgumentMatchers.isNull
 import org.mockito.Mockito.doAnswer
 import org.mockito.Mockito.doReturn
 import org.mockito.Mockito.doThrow
-import org.mockito.Mockito.mock
 import org.mockito.Mockito.verify
 
 private const val PSM = 0x85
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSLocalAgentCreationTests.kt b/tests/unit/java/com/android/server/connectivityservice/CSLocalAgentCreationTests.kt
index 6dc9d2d537..7d5ed312fb 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSLocalAgentCreationTests.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSLocalAgentCreationTests.kt
@@ -28,8 +28,8 @@ import android.os.Build
 import androidx.test.filters.SmallTest
 import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
 import com.android.testutils.DevSdkIgnoreRunner
-import com.android.testutils.RecorderCallback.CallbackEntry.Available
 import com.android.testutils.TestableNetworkCallback
+import com.android.testutils.TestableNetworkCallback.Event.Available
 import kotlin.test.assertFailsWith
 import org.junit.Assert.assertEquals
 import org.junit.Test
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSLocalAgentTests.kt b/tests/unit/java/com/android/server/connectivityservice/CSLocalAgentTests.kt
index 1058be125c..152751d401 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSLocalAgentTests.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSLocalAgentTests.kt
@@ -34,9 +34,9 @@ import android.net.connectivity.ConnectivityCompatChanges.ENABLE_MATCH_NON_THREA
 import android.os.Build
 import com.android.testutils.DevSdkIgnoreRule
 import com.android.testutils.DevSdkIgnoreRunner
-import com.android.testutils.RecorderCallback.CallbackEntry.LocalInfoChanged
-import com.android.testutils.RecorderCallback.CallbackEntry.Lost
 import com.android.testutils.TestableNetworkCallback
+import com.android.testutils.TestableNetworkCallback.Event.LocalInfoChanged
+import com.android.testutils.TestableNetworkCallback.Event.Lost
 import kotlin.test.assertFailsWith
 import org.junit.Test
 import org.junit.runner.RunWith
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSLocalNetworkProtectionTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSLocalNetworkProtectionTest.kt
index 84c98359de..4f1c1aabb8 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSLocalNetworkProtectionTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSLocalNetworkProtectionTest.kt
@@ -31,9 +31,9 @@ import android.os.Build
 import androidx.test.filters.SmallTest
 import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
 import com.android.testutils.DevSdkIgnoreRunner
-import com.android.testutils.RecorderCallback.CallbackEntry.LinkPropertiesChanged
-import com.android.testutils.RecorderCallback.CallbackEntry.Lost
 import com.android.testutils.TestableNetworkCallback
+import com.android.testutils.TestableNetworkCallback.Event.LinkPropertiesChanged
+import com.android.testutils.TestableNetworkCallback.Event.Lost
 import org.junit.Test
 import org.junit.runner.RunWith
 import org.mockito.ArgumentMatchers.eq
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSNetworkActivityTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSNetworkActivityTest.kt
index ccbd6b3370..99fdfa5248 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSNetworkActivityTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSNetworkActivityTest.kt
@@ -40,8 +40,8 @@ import com.android.net.module.util.BaseNetdUnsolicitedEventListener
 import com.android.server.CSTest.CSContext
 import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
 import com.android.testutils.DevSdkIgnoreRunner
-import com.android.testutils.RecorderCallback.CallbackEntry.Lost
 import com.android.testutils.TestableNetworkCallback
+import com.android.testutils.TestableNetworkCallback.Event.Lost
 import java.time.Duration
 import kotlin.test.assertNotNull
 import org.junit.Assert.assertFalse
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSNetworkReservationTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSNetworkReservationTest.kt
index a509d1ecc8..662ec18395 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSNetworkReservationTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSNetworkReservationTest.kt
@@ -32,11 +32,11 @@ import android.net.NetworkScore
 import android.os.Build
 import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
 import com.android.testutils.DevSdkIgnoreRunner
-import com.android.testutils.RecorderCallback.CallbackEntry.Reserved
-import com.android.testutils.RecorderCallback.CallbackEntry.Unavailable
 import com.android.testutils.TestableNetworkCallback
+import com.android.testutils.TestableNetworkCallback.Event.Reserved
+import com.android.testutils.TestableNetworkCallback.Event.Unavailable
 import com.android.testutils.TestableNetworkOfferCallback
-import com.android.testutils.TestableNetworkOfferCallback.CallbackEntry.Needed
+import com.android.testutils.TestableNetworkOfferCallback.Event.Needed
 import kotlin.test.assertEquals
 import kotlin.test.assertNull
 import org.junit.Before
@@ -118,7 +118,7 @@ class CSNetworkReservationTest : CSTest() {
     }
 
     fun TestableNetworkOfferCallback.expectNoCallbackWhere(
-            predicate: (TestableNetworkOfferCallback.CallbackEntry) -> Boolean
+            predicate: (TestableNetworkOfferCallback.Event) -> Boolean
     ) {
         val event = history.poll(NO_CB_TIMEOUT_MS) { predicate(it) }
         assertNull(event)
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSPreferenceTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSPreferenceTest.kt
index 1b7b1017ab..c8cd64e902 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSPreferenceTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSPreferenceTest.kt
@@ -41,11 +41,11 @@ import androidx.test.filters.SmallTest
 import com.android.testutils.DevSdkIgnoreRule
 import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
 import com.android.testutils.DevSdkIgnoreRunner
-import com.android.testutils.RecorderCallback.CallbackEntry.Lost
 import com.android.testutils.TestableNetworkCallback
+import com.android.testutils.TestableNetworkCallback.Event.Lost
 import com.android.testutils.TestableNetworkOfferCallback
-import com.android.testutils.TestableNetworkOfferCallback.CallbackEntry.Needed
-import com.android.testutils.TestableNetworkOfferCallback.CallbackEntry.Unneeded
+import com.android.testutils.TestableNetworkOfferCallback.Event.Needed
+import com.android.testutils.TestableNetworkOfferCallback.Event.Unneeded
 import com.android.testutils.postAndWait
 import com.android.testutils.runAsShell
 import kotlin.test.assertEquals
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSQueuedCallbacksTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSQueuedCallbacksTest.kt
index 6d1858e964..4f15b1a6a7 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSQueuedCallbacksTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSQueuedCallbacksTest.kt
@@ -55,14 +55,14 @@ import com.android.server.defaultLp
 import com.android.server.defaultNc
 import com.android.testutils.DevSdkIgnoreRule
 import com.android.testutils.DevSdkIgnoreRunner
-import com.android.testutils.RecorderCallback.CallbackEntry.BlockedStatus
-import com.android.testutils.RecorderCallback.CallbackEntry.CapabilitiesChanged
-import com.android.testutils.RecorderCallback.CallbackEntry.LinkPropertiesChanged
-import com.android.testutils.RecorderCallback.CallbackEntry.LocalInfoChanged
-import com.android.testutils.RecorderCallback.CallbackEntry.Lost
-import com.android.testutils.RecorderCallback.CallbackEntry.Resumed
-import com.android.testutils.RecorderCallback.CallbackEntry.Suspended
 import com.android.testutils.TestableNetworkCallback
+import com.android.testutils.TestableNetworkCallback.Event.BlockedStatus
+import com.android.testutils.TestableNetworkCallback.Event.CapabilitiesChanged
+import com.android.testutils.TestableNetworkCallback.Event.LinkPropertiesChanged
+import com.android.testutils.TestableNetworkCallback.Event.LocalInfoChanged
+import com.android.testutils.TestableNetworkCallback.Event.Lost
+import com.android.testutils.TestableNetworkCallback.Event.Resumed
+import com.android.testutils.TestableNetworkCallback.Event.Suspended
 import com.android.testutils.visibleOnHandlerThread
 import com.android.testutils.waitForIdleSerialExecutor
 import java.util.Collections
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSSatelliteNetworkTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSSatelliteNetworkTest.kt
index 94be0a8e64..31f70fdb8e 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSSatelliteNetworkTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSSatelliteNetworkTest.kt
@@ -47,9 +47,9 @@ import com.android.server.ConnectivityService.PREFERENCE_ORDER_SATELLITE_FALLBAC
 import com.android.testutils.DevSdkIgnoreRule
 import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
 import com.android.testutils.DevSdkIgnoreRunner
-import com.android.testutils.RecorderCallback.CallbackEntry.Losing
-import com.android.testutils.RecorderCallback.CallbackEntry.Lost
 import com.android.testutils.TestableNetworkCallback
+import com.android.testutils.TestableNetworkCallback.Event.Losing
+import com.android.testutils.TestableNetworkCallback.Event.Lost
 import com.android.testutils.runAsShell
 import com.android.testutils.visibleOnHandlerThread
 import kotlin.test.assertEquals
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSShellCommandsTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSShellCommandsTest.kt
index f94e858377..3467fff894 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSShellCommandsTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSShellCommandsTest.kt
@@ -41,9 +41,9 @@ import com.android.server.ConnectivityService.PREFERENCE_ORDER_DEBUG_FALLBACK
 import com.android.testutils.DevSdkIgnoreRule
 import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
 import com.android.testutils.DevSdkIgnoreRunner
-import com.android.testutils.RecorderCallback.CallbackEntry.Losing
-import com.android.testutils.RecorderCallback.CallbackEntry.Lost
 import com.android.testutils.TestableNetworkCallback
+import com.android.testutils.TestableNetworkCallback.Event.Losing
+import com.android.testutils.TestableNetworkCallback.Event.Lost
 import java.io.File
 import org.junit.Assume.assumeTrue
 import org.junit.Rule
diff --git a/tests/unit/java/com/android/server/connectivityservice/base/CSAgentWrapper.kt b/tests/unit/java/com/android/server/connectivityservice/base/CSAgentWrapper.kt
index 0cc9457f2c..4dd6d82e08 100644
--- a/tests/unit/java/com/android/server/connectivityservice/base/CSAgentWrapper.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/base/CSAgentWrapper.kt
@@ -37,9 +37,9 @@ import android.net.NetworkScore
 import android.net.NetworkTestResultParcelable
 import android.net.networkstack.NetworkStackClientBase
 import android.os.HandlerThread
-import com.android.testutils.RecorderCallback.CallbackEntry.Available
-import com.android.testutils.RecorderCallback.CallbackEntry.Lost
 import com.android.testutils.TestableNetworkCallback
+import com.android.testutils.TestableNetworkCallback.Event.Available
+import com.android.testutils.TestableNetworkCallback.Event.Lost
 import java.util.concurrent.atomic.AtomicInteger
 import kotlin.test.assertEquals
 import kotlin.test.fail
diff --git a/thread/tests/utils/src/android/net/thread/utils/TapTestNetworkTracker.java b/thread/tests/utils/src/android/net/thread/utils/TapTestNetworkTracker.java
index 62c278534d..c117975fc7 100644
--- a/thread/tests/utils/src/android/net/thread/utils/TapTestNetworkTracker.java
+++ b/thread/tests/utils/src/android/net/thread/utils/TapTestNetworkTracker.java
@@ -17,7 +17,7 @@ package android.net.thread.utils;
 
 import static android.Manifest.permission.MANAGE_TEST_NETWORKS;
 
-import static com.android.testutils.RecorderCallback.CallbackEntry.LINK_PROPERTIES_CHANGED;
+import static com.android.testutils.TestableNetworkCallback.Event.LINK_PROPERTIES_CHANGED;
 import static com.android.testutils.TestPermissionUtil.runAsShell;
 
 import android.content.Context;

From f0252b1cf4e8612fede21fb2d4915c55c092c18c Mon Sep 17 00:00:00 2001
From: Chalard Jean <jchalard@google.com>
Date: Wed, 7 May 2025 13:46:17 +0900
Subject: [PATCH 271/377] Fix a bug in poll(from)

Test: new test in this patch
Flag: EXEMPT test-only
Change-Id: I00d367ce9db47e3fd30d27816b68280ab418f988
---
 .../net/module/util/TrackRecordTest.kt        | 19 +++++++++++++++++++
 .../android/net/module/util/TrackRecord.kt    |  2 +-
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/staticlibs/tests/unit/src/com/android/net/module/util/TrackRecordTest.kt b/staticlibs/tests/unit/src/com/android/net/module/util/TrackRecordTest.kt
index 8e320d0d4e..d18ae9cf29 100644
--- a/staticlibs/tests/unit/src/com/android/net/module/util/TrackRecordTest.kt
+++ b/staticlibs/tests/unit/src/com/android/net/module/util/TrackRecordTest.kt
@@ -184,6 +184,25 @@ class TrackRecordTest {
         assertTrue(delay >= SHORT_TIMEOUT)
     }
 
+    @Test
+    fun testPollFrom() {
+        val readHead = ArrayTrackRecord<Int>().newReadHead()
+        readHead.add(3)
+        readHead.add(6)
+        readHead.add(7)
+        readHead.add(10)
+        assertEquals(0, readHead.mark)
+        assertEquals(3, readHead.poll(timeoutMs = 1, pos = 0) { it == 3 })
+        assertEquals(1, readHead.mark)
+        assertEquals(7, readHead.poll(timeoutMs = 1, pos = 0) { it == 7 })
+        assertEquals(3, readHead.mark)
+        // Do not advance the read head since the found element is after the current head
+        assertEquals(6, readHead.poll(timeoutMs = 1, pos = 0) { it == 6 })
+        assertEquals(3, readHead.mark)
+        assertNull(readHead.poll(timeoutMs = 1, pos = 1) { it == 3 })
+        assertEquals(4, readHead.mark)
+    }
+
     @Test
     fun testConcurrentPollDisallowed() {
         val failures = AtomicInteger(0)
diff --git a/staticlibs/testutils/hostdevice/com/android/net/module/util/TrackRecord.kt b/staticlibs/testutils/hostdevice/com/android/net/module/util/TrackRecord.kt
index 541fccad1f..123efd7283 100644
--- a/staticlibs/testutils/hostdevice/com/android/net/module/util/TrackRecord.kt
+++ b/staticlibs/testutils/hostdevice/com/android/net/module/util/TrackRecord.kt
@@ -315,7 +315,7 @@ class ArrayTrackRecord<E> : TrackRecord<E> {
                     val index = pollForIndexReadLocked(timeoutMs, pos, predicate)
                     when {
                         index < 0 -> readHead = size
-                        index > readHead -> readHead = index + 1
+                        index >= readHead -> readHead = index + 1
                         // else do nothing, the element was found prior to the read head so
                         // don't move the read head
                     }

From 63947668a23a31ff1d20f1aef157079af0eb5760 Mon Sep 17 00:00:00 2001
From: Chalard Jean <jchalard@google.com>
Date: Mon, 28 Apr 2025 15:25:15 +0900
Subject: [PATCH 272/377] Address warnings in TestableNetworkCallback

Test: TH
Flag: EXEMPT test-only
Change-Id: Ifcbbc6e5443f619279744be993cce10f4ecd22a5
---
 .../android/testutils/TestableNetworkCallback.kt | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git a/staticlibs/testutils/devicetests/com/android/testutils/TestableNetworkCallback.kt b/staticlibs/testutils/devicetests/com/android/testutils/TestableNetworkCallback.kt
index 1a6eade6c2..ccf72c8a7d 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/TestableNetworkCallback.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/TestableNetworkCallback.kt
@@ -58,11 +58,12 @@ private val NOOP = Runnable {}
 open class TestableNetworkCallback private constructor(
     src: TestableNetworkCallback?,
     val defaultTimeoutMs: Long,
-    val defaultNoCallbackTimeoutMs: Long,
-    val waiterFunc: Runnable,
+    private val defaultNoCallbackTimeoutMs: Long,
+    private val waiterFunc: Runnable,
     private val logTag: String
 ) : NetworkCallback() {
-    val backingRecord: ArrayTrackRecord<Event> = src?.backingRecord ?: ArrayTrackRecord()
+    private val backingRecord: ArrayTrackRecord<Event> =
+        src?.backingRecord ?: ArrayTrackRecord()
     val history: ArrayTrackRecord<Event>.ReadHead = backingRecord.newReadHead()
     val mark get() = history.mark
 
@@ -75,7 +76,7 @@ open class TestableNetworkCallback private constructor(
         // constructor by specifying override.
         abstract val network: Network
 
-        data class Reserved private constructor(
+        data class Reserved(
             override val network: Network,
             val caps: NetworkCapabilities
         ) : Event() {
@@ -98,7 +99,7 @@ open class TestableNetworkCallback private constructor(
         data class Resumed(override val network: Network) : Event()
         data class Losing(override val network: Network, val maxMsToLive: Int) : Event()
         data class Lost(override val network: Network) : Event()
-        data class Unavailable private constructor(
+        data class Unavailable(
             override val network: Network
         ) : Event() {
             constructor() : this(NULL_NETWORK)
@@ -312,7 +313,6 @@ open class TestableNetworkCallback private constructor(
     ) = expect(type, network.network, defaultTimeoutMs, errorMsg, test)
 
     // Without |errorMsg|, in Network and HasNetwork versions
-    @JvmOverloads
     fun <T : Event> expect(
         type: KClass<T>,
         network: Network,
@@ -320,7 +320,6 @@ open class TestableNetworkCallback private constructor(
         test: (T) -> Boolean
     ) = expect(type, network, timeoutMs, null, test)
 
-    @JvmOverloads
     fun <T : Event> expect(
         type: KClass<T>,
         network: HasNetwork,
@@ -345,14 +344,12 @@ open class TestableNetworkCallback private constructor(
     ) = expect(type, ANY_NETWORK, timeoutMs, null, test)
 
     // Without |timeout| or |errorMsg|, in Network and HasNetwork versions
-    @JvmOverloads
     fun <T : Event> expect(
         type: KClass<T>,
         network: Network,
         test: (T) -> Boolean
     ) = expect(type, network, defaultTimeoutMs, null, test)
 
-    @JvmOverloads
     fun <T : Event> expect(
         type: KClass<T>,
         network: HasNetwork,
@@ -360,7 +357,6 @@ open class TestableNetworkCallback private constructor(
     ) = expect(type, network.network, defaultTimeoutMs, null, test)
 
     // Without |network| or |timeout| or |errorMsg|
-    @JvmOverloads
     fun <T : Event> expect(
         type: KClass<T>,
         test: (T) -> Boolean

From 871e7ea68484c200cb6b3d64532fd99407ff2834 Mon Sep 17 00:00:00 2001
From: Junyu Lai <junyulai@google.com>
Date: Wed, 14 May 2025 16:54:46 +0800
Subject: [PATCH 273/377] Update comments and local variables

PermissionMonitor#startMonitoring() was renamed to initialize().
Update comments and local variables accordingly.

Flag: EXEMPT refactor
Test: TH
Bug: 410731080
Change-Id: I840b5172e1ebc761cade0e6082fec0cab7fe9a3b
---
 .../android/server/ConnectivityService.java    | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index 07375c7f4c..0a74857a6c 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -4175,27 +4175,27 @@ public class ConnectivityService extends IConnectivityManager.Stub
         // Since mApps in PermissionMonitor needs to be populated first to ensure that
         // listening network request which is sent by MultipathPolicyTracker won't be added
         // NET_CAPABILITY_FOREGROUND capability. Thus, MultipathPolicyTracker.start() must
-        // be called after PermissionMonitor#startMonitoring().
-        // Calling PermissionMonitor#startMonitoring() in systemReadyInternal() and the
+        // be called after PermissionMonitor#initialize().
+        // Calling PermissionMonitor#initialize() in systemReadyInternal() and the
         // MultipathPolicyTracker.start() is called in NetworkPolicyManagerService#systemReady()
         // to ensure the tracking will be initialized correctly.
-        final ConditionVariable startMonitoringDone = new ConditionVariable();
+        final ConditionVariable permissionMonitorInitializeDone = new ConditionVariable();
         mHandler.post(() -> {
             mPermissionMonitor.initialize();
             // Calling mBroadcastReceiveHelper.callCallbackForInitialUsers() after
-            // PermissionMonitor.startMonitoring() ensures that the internal lists
+            // PermissionMonitor#initialize() ensures that the internal lists
             // (mUidsAllowedOnRestrictedNetworks and mUsersTrafficPermissions) in
             // PermissionMonitor are prepared before processing initial users.
             // While technically the onUserAdded callback (triggered by
             // callCallbackForInitialUsers) handles sending network and traffic
             // permissions to netd and bpf, which depend on these lists, moving
-            // this call before startMonitoring would necessitate performing these
-            // actions again within startMonitoring, leading to redundant work.
+            // this call before initialize would necessitate performing these
+            // actions again within initialize, leading to redundant work.
             // Therefore, keeping callCallbackForInitialUsers() in this order is the
             // safest approach to avoid duplicated operations and ensure the
             // permission lists are ready when the initial user callbacks are invoked.
             mBroadcastReceiveHelper.callOnUserAddedForExistingUsers();
-            startMonitoringDone.open();
+            permissionMonitorInitializeDone.open();
         });
         mProxyTracker.loadGlobalProxy();
         registerDnsResolverUnsolicitedEventListener();
@@ -4239,9 +4239,9 @@ public class ConnectivityService extends IConnectivityManager.Stub
                 CONNECTIVITY_STATE_SAMPLE, this::sampleConnectivityStateToStatsEvent);
         // Wait PermissionMonitor to finish the permission update. Then MultipathPolicyTracker won't
         // have permission problem. While CV#block() is unbounded in time and can in principle block
-        // forever, this replaces a synchronous call to PermissionMonitor#startMonitoring, which
+        // forever, this replaces a synchronous call to PermissionMonitor#initialize, which
         // could have blocked forever too.
-        startMonitoringDone.block();
+        permissionMonitorInitializeDone.block();
     }
 
     /**

From b936f0c5fd7b636063cf14fc38376f3f00ace890 Mon Sep 17 00:00:00 2001
From: Jimi Chen <jimictw@google.com>
Date: Tue, 13 May 2025 09:08:50 +0000
Subject: [PATCH 274/377] Check whether CarrierConfigManager is null

Currently, the CarrierConfigManager is null on several non-phone
projects, e.g. tv, wear devices. This is because CarrierConfigManager
is not supported on these devices.

This change checks whether it is null and improve error handling.

Flag: android.net.platform.flags.avoid_bad_wifi_from_carrier_config
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.connectivity.MultinetworkPolicyTrackerTest \
      --update-device
Fix: 416654774
Change-Id: I40fa7139a349472b1d5cbd36b5bff286309aebc5
---
 .../MultinetworkPolicyTracker.java            | 134 ++++++++++--------
 .../MultinetworkPolicyTrackerTest.kt          |  31 +++-
 ...ltinetworkPolicyTrackerTestDependencies.kt |   4 +-
 3 files changed, 100 insertions(+), 69 deletions(-)

diff --git a/service/src/com/android/server/connectivity/MultinetworkPolicyTracker.java b/service/src/com/android/server/connectivity/MultinetworkPolicyTracker.java
index 60d27c353d..9b15728754 100644
--- a/service/src/com/android/server/connectivity/MultinetworkPolicyTracker.java
+++ b/service/src/com/android/server/connectivity/MultinetworkPolicyTracker.java
@@ -20,6 +20,7 @@ import static android.content.pm.PackageManager.FEATURE_TELEPHONY_SUBSCRIPTION;
 import static android.net.ConnectivitySettingsManager.NETWORK_AVOID_BAD_WIFI;
 import static android.net.ConnectivitySettingsManager.NETWORK_METERED_MULTIPATH_PREFERENCE;
 
+import android.annotation.IntDef;
 import android.annotation.NonNull;
 import android.annotation.Nullable;
 import android.annotation.TargetApi;
@@ -52,6 +53,8 @@ import com.android.modules.utils.build.SdkLevel;
 import com.android.net.module.util.DeviceConfigUtils;
 import com.android.net.module.util.HandlerUtils;
 
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
 import java.util.Arrays;
 import java.util.List;
 import java.util.concurrent.Executor;
@@ -87,10 +90,23 @@ public class MultinetworkPolicyTracker {
         }
     }
 
-    private enum AvoidBadWifiSource {
-        FROM_RESOURCE,
-        FROM_CARRIER_CONFIG,
-    }
+    /**
+     * Indicates that the "Avoid Bad Wi-Fi" setting originates from a resource.
+     */
+    private static final int FROM_RESOURCE = 0;
+
+    /**
+     * Indicates that the "Avoid Bad Wi-Fi" setting originates from carrier configuration.
+     */
+    private static final int FROM_CARRIER_CONFIG = 1;
+
+    /**
+     * Defines the set of possible integer constants for AvoidBadWifiSource.
+     * This annotation provides compile-time type safety.
+     */
+    @IntDef({FROM_RESOURCE, FROM_CARRIER_CONFIG})
+    @Retention(RetentionPolicy.SOURCE)
+    public @interface AvoidBadWifiSource {}
 
     private static String TAG = MultinetworkPolicyTracker.class.getSimpleName();
 
@@ -105,8 +121,7 @@ public class MultinetworkPolicyTracker {
     private final ContentResolver mResolver;
     private final SettingObserver mSettingObserver;
     private final BroadcastReceiver mBroadcastReceiver;
-    private final boolean mAvoidBadWifiFromCarrierConfigFeature;
-    private final boolean mHasTelephonySubscription;
+    private final @AvoidBadWifiSource int mAvoidBadWifiSource;
     // This will be null if the FLAG_AVOID_BAD_WIFI_FROM_CARRIER_CONFIG is off
     private final @Nullable CarrierConfigManager mCarrierConfigManager;
     private final @Nullable CarrierConfigChangeListener mCarrierConfigChangeListener;
@@ -162,15 +177,19 @@ public class MultinetworkPolicyTracker {
 
         @VisibleForTesting
         protected boolean readAvoidBadWifiFromCarrierConfig(
-                @NonNull final Context context, final int subId) {
+                @Nullable final CarrierConfigManager ccm, final int subId) {
             // Defaults to true to avoid potentially poor Wi-Fi and improve user experience.
             final boolean defaultConfig = true;
             if (subId == SubscriptionManager.INVALID_SUBSCRIPTION_ID) {
                 return defaultConfig;
             }
 
+            // It implies the FEATURE_TELEPHONY_SUBSCRIPTION is not supported, return default config
+            if (ccm == null) {
+                return defaultConfig;
+            }
+
             PersistableBundle config = null;
-            final CarrierConfigManager ccm = context.getSystemService(CarrierConfigManager.class);
 
             try {
                 config = ccm.getConfigForSubId(subId,
@@ -271,18 +290,17 @@ public class MultinetworkPolicyTracker {
             }
         };
 
-        mHasTelephonySubscription =
-            mContext.getPackageManager().hasSystemFeature(FEATURE_TELEPHONY_SUBSCRIPTION);
-        mAvoidBadWifiFromCarrierConfigFeature = mDeps.getAvoidBadWifiFromCarrierConfigFeature();
-        mCarrierConfigManager = mAvoidBadWifiFromCarrierConfigFeature
-            ? mContext.getSystemService(CarrierConfigManager.class)
-            : null;
-
-        mCarrierConfigChangeListener = mAvoidBadWifiFromCarrierConfigFeature
-            ? new CarrierConfigChangeListener()
-            : null;
-
-        if (!mAvoidBadWifiFromCarrierConfigFeature) {
+        if (mDeps.getAvoidBadWifiFromCarrierConfigFeature()) {
+            mAvoidBadWifiSource = FROM_CARRIER_CONFIG;
+            mCarrierConfigManager =
+                mContext.getPackageManager().hasSystemFeature(FEATURE_TELEPHONY_SUBSCRIPTION)
+                ? mContext.getSystemService(CarrierConfigManager.class)
+                : null;
+            mCarrierConfigChangeListener = new CarrierConfigChangeListener();
+        } else {
+            mAvoidBadWifiSource = FROM_RESOURCE;
+            mCarrierConfigManager = null;
+            mCarrierConfigChangeListener = null;
             updateAvoidBadWifi();
             updateMeteredMultipathPreference();
         }
@@ -304,7 +322,7 @@ public class MultinetworkPolicyTracker {
         mContext.getSystemService(TelephonyManager.class).registerTelephonyCallback(
                 handlerExecutor, new ActiveDataSubscriptionIdListener());
 
-        if (mAvoidBadWifiFromCarrierConfigFeature) {
+        if (mCarrierConfigManager != null) {
             mCarrierConfigManager.registerCarrierConfigChangeListener(
                     BackgroundThread.getExecutor(), mCarrierConfigChangeListener
             );
@@ -325,7 +343,7 @@ public class MultinetworkPolicyTracker {
         mResolver.unregisterContentObserver(mSettingObserver);
 
         mContext.unregisterReceiver(mBroadcastReceiver);
-        if (mAvoidBadWifiFromCarrierConfigFeature) {
+        if (mCarrierConfigManager != null) {
             mCarrierConfigManager.unregisterCarrierConfigChangeListener(
                     mCarrierConfigChangeListener
             );
@@ -462,18 +480,6 @@ public class MultinetworkPolicyTracker {
         }
     }
 
-    /**
-     * Determines the source of the avoid bad Wi-Fi setting.
-     * It returns FROM_CARRIER_CONFIG if the carrier config feature is enabled,
-     * otherwise it returns FROM_RESOURCE.
-     *
-     */
-    private AvoidBadWifiSource getAvoidBadWifiSource() {
-        return mAvoidBadWifiFromCarrierConfigFeature
-            ? AvoidBadWifiSource.FROM_CARRIER_CONFIG
-            : AvoidBadWifiSource.FROM_RESOURCE;
-    }
-
     /**
      * Updates the local cache of the "avoid bad Wi-Fi" setting from the carrier config
      * for a specific subscription ID.
@@ -502,8 +508,8 @@ public class MultinetworkPolicyTracker {
 
         // CarrierConfigManager#getConfigForSubId() is supported
         // only when system has FEATURE_TELEPHONY_SUBSCRIPTION
-        final boolean config = !mHasTelephonySubscription
-                || mDeps.readAvoidBadWifiFromCarrierConfig(mContext, subId);
+        final boolean config =
+                mDeps.readAvoidBadWifiFromCarrierConfig(mCarrierConfigManager, subId);
         mHandler.post(() -> updateAvoidBadWifiFromCarrierConfig(subId, config));
     }
 
@@ -528,33 +534,35 @@ public class MultinetworkPolicyTracker {
      */
     public boolean updateAvoidBadWifi() {
         final boolean prevAvoid = mAvoidBadWifi;
-        if (getAvoidBadWifiSource() == AvoidBadWifiSource.FROM_CARRIER_CONFIG) {
-            // Force update activelyPreferBadWifi since it will always be true in Android U+,
-            // and mAvoidBadWifiFromCarrierConfigFeature is a trunk stable flag
-            // that only exists in 25Q4+
-            mActivelyPreferBadWifi = true;
-
-            final String settingAvoidBadWifiStr = readAvoidBadWifiFromSettings();
-            if (settingAvoidBadWifiStr != null) {
-                mAvoidBadWifi = "1".equals(settingAvoidBadWifiStr);
-            } else {
-                // Retrieve the avoid bad Wi-Fi setting from the local cache to avoid potential
-                // issues or blocking from the IPC call getAvoidBadWifiCarrierConfigForSubId().
-                mAvoidBadWifi = readAvoidBadWifiFromCache(mActiveSubId);
-            }
-            return mAvoidBadWifi != prevAvoid;
-        } else {
-            final boolean settingAvoidBadWifi = "1".equals(readAvoidBadWifiFromSettings());
-            mAvoidBadWifi = settingAvoidBadWifi || !configRestrictsAvoidBadWifi();
-            final boolean prevActive = mActivelyPreferBadWifi;
-            final Boolean deviceConfigPreferBadWifi = deviceConfigActivelyPreferBadWifi();
-            if (null == deviceConfigPreferBadWifi) {
-                mActivelyPreferBadWifi = configActivelyPrefersBadWifi();
-            } else {
-                mActivelyPreferBadWifi = deviceConfigPreferBadWifi;
-            }
-
-            return mAvoidBadWifi != prevAvoid || mActivelyPreferBadWifi != prevActive;
+        switch (mAvoidBadWifiSource) {
+            case FROM_CARRIER_CONFIG:
+                // Force update activelyPreferBadWifi since it will always be true in Android U+,
+                // and mAvoidBadWifiFromCarrierConfigFeature is a trunk stable flag
+                // that only exists in 25Q4+
+                mActivelyPreferBadWifi = true;
+                final String settingAvoidBadWifiStr = readAvoidBadWifiFromSettings();
+                if (settingAvoidBadWifiStr != null) {
+                    mAvoidBadWifi = "1".equals(settingAvoidBadWifiStr);
+                } else {
+                    // Retrieve the avoid bad Wi-Fi setting from the local cache to avoid potential
+                    // issues or blocking from the IPC call getAvoidBadWifiCarrierConfigForSubId().
+                    mAvoidBadWifi = readAvoidBadWifiFromCache(mActiveSubId);
+                }
+                return mAvoidBadWifi != prevAvoid;
+            case FROM_RESOURCE:
+                final boolean settingAvoidBadWifi = "1".equals(readAvoidBadWifiFromSettings());
+                mAvoidBadWifi = settingAvoidBadWifi || !configRestrictsAvoidBadWifi();
+                final boolean prevActive = mActivelyPreferBadWifi;
+                final Boolean deviceConfigPreferBadWifi = deviceConfigActivelyPreferBadWifi();
+                if (null == deviceConfigPreferBadWifi) {
+                    mActivelyPreferBadWifi = configActivelyPrefersBadWifi();
+                } else {
+                    mActivelyPreferBadWifi = deviceConfigPreferBadWifi;
+                }
+                return mAvoidBadWifi != prevAvoid || mActivelyPreferBadWifi != prevActive;
+            default:
+                Log.wtf(TAG, "Unexpected avoid bad Wi-Fi source: " + mAvoidBadWifiSource);
+                return false;
         }
     }
 
diff --git a/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTest.kt b/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTest.kt
index 95a6d8c8bb..ca0a136227 100644
--- a/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTest.kt
+++ b/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTest.kt
@@ -49,16 +49,19 @@ import org.junit.After
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertFalse
 import org.junit.Assert.assertTrue
+import org.junit.Assume.assumeNotNull
 import org.junit.Before
 import org.junit.Rule
 import org.junit.Test
 import org.junit.runner.RunWith
+import org.junit.runners.Parameterized
 import org.mockito.ArgumentCaptor
 import org.mockito.ArgumentMatchers.anyInt
 import org.mockito.Mockito.any
 import org.mockito.Mockito.doCallRealMethod
 import org.mockito.Mockito.doReturn
 import org.mockito.Mockito.mock
+import org.mockito.Mockito.reset
 import org.mockito.Mockito.times
 import org.mockito.Mockito.verify
 
@@ -74,6 +77,17 @@ const val HANDLER_TIMEOUT_MS = 400
 @SmallTest
 @DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.R)
 class MultinetworkPolicyTrackerTest {
+    companion object {
+        @Parameterized.Parameters
+        @JvmStatic
+        fun data(): Iterable<Any?> {
+            return mutableListOf(
+                null,
+                mock(CarrierConfigManager::class.java)
+            )
+        }
+    }
+
     // This wrapper class prevents JUnit from attempting to load unsupported system classes
     // that are present in the System Test (S/T) image, which would otherwise cause test failures.
     private class CarrierConfigChangeRunner(
@@ -97,6 +111,11 @@ class MultinetworkPolicyTrackerTest {
 
     private val featureFlags = HashSet<String>()
 
+    // Indicates where carrierConfigManager is supported.
+    @Parameterized.Parameter(0)
+    @JvmField
+    var carrierConfigManager: CarrierConfigManager? = null
+
     // This will set feature flags from @FeatureFlag annotations
     // into the map before setUp() runs.
     @get:Rule
@@ -115,7 +134,6 @@ class MultinetworkPolicyTrackerTest {
     }
 
     private val telephonyManager = mock(TelephonyManager::class.java)
-    private val carrierConfigManager = mock(CarrierConfigManager::class.java)
     private val subscriptionManager = mock(SubscriptionManager::class.java).also {
         doReturn(null).`when`(it).getActiveSubscriptionInfo(anyInt())
     }
@@ -135,8 +153,6 @@ class MultinetworkPolicyTrackerTest {
         }
         doReturn(subscriptionManager).`when`(it)
             .getSystemService(Context.TELEPHONY_SUBSCRIPTION_SERVICE)
-        doReturn(carrierConfigManager).`when`(it)
-            .getSystemService(CarrierConfigManager::class.java)
         doReturn(resolver).`when`(it).contentResolver
         doReturn(resources).`when`(it).resources
         doReturn(it).`when`(it).createConfigurationContext(any())
@@ -206,6 +222,8 @@ class MultinetworkPolicyTrackerTest {
             featureFlags.contains(FLAG_AVOID_BAD_WIFI_FROM_CARRIER_CONFIG)
         )
 
+        doReturn(carrierConfigManager).`when`(context)
+            .getSystemService(CarrierConfigManager::class.java)
         trackerDependencies.setBackgroundThreadHandler(bgHandler)
         tracker = MultinetworkPolicyTracker(
             context,
@@ -219,6 +237,9 @@ class MultinetworkPolicyTrackerTest {
     @After
     fun tearDown() {
         ConnectivityResources.setResourcesContextForTest(null)
+        carrierConfigManager?.let { ccm ->
+            reset(ccm)
+        }
         trackerDependencies.resetAvoidBadWifiCarrierConfigForSubIdMap()
     }
 
@@ -326,6 +347,8 @@ class MultinetworkPolicyTrackerTest {
     @FeatureFlag(name = FLAG_AVOID_BAD_WIFI_FROM_CARRIER_CONFIG, true)
     @DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.BAKLAVA)
     fun testUpdateAvoidBadWifiOnCarrierConfigChange() {
+        assumeNotNull("skip test if carrierConfigManager is not supported", carrierConfigManager)
+
         // Mock the initial global setting to null
         Settings.Global.putString(resolver, NETWORK_AVOID_BAD_WIFI, null)
 
@@ -346,7 +369,7 @@ class MultinetworkPolicyTrackerTest {
         // Mock the initial carrier configuration to return false
         trackerDependencies.setAvoidBadWifiCarrierConfigForSubId(activeSubId, false)
         verify(carrierConfigManager, times(1))
-            .registerCarrierConfigChangeListener(any(), carrierConfiglistenCaptor.capture())
+            ?.registerCarrierConfigChangeListener(any(), carrierConfiglistenCaptor.capture())
 
         val carrierConfiglistener = carrierConfiglistenCaptor.value
         // dispatch for the first carrier config initialization on the handler thread
diff --git a/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTestDependencies.kt b/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTestDependencies.kt
index 7285cbe32b..dc2ace4984 100644
--- a/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTestDependencies.kt
+++ b/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTestDependencies.kt
@@ -1,11 +1,11 @@
 package com.android.server.connectivity
 
-import android.content.Context
 import android.content.res.Resources
 import android.os.Handler
 import android.provider.DeviceConfig
 import android.provider.DeviceConfig.NAMESPACE_CONNECTIVITY
 import android.provider.DeviceConfig.OnPropertiesChangedListener
+import android.telephony.CarrierConfigManager
 import com.android.internal.annotations.GuardedBy
 import com.android.internal.os.BackgroundThread
 import com.android.server.connectivity.MultinetworkPolicyTracker.CONFIG_ACTIVELY_PREFER_BAD_WIFI
@@ -72,7 +72,7 @@ class MultinetworkPolicyTrackerTestDependencies(
         resources
 
     override fun readAvoidBadWifiFromCarrierConfig(
-        context: Context,
+        ccm: CarrierConfigManager?,
         subId: Int
     ): Boolean =
         avoidBadWifiCarrierConfigForSubIdMap.getOrDefault(subId, true)

From 30c36198c50df0a8abeb30a795d05a0e9eef0868 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Mon, 19 May 2025 10:04:14 -0700
Subject: [PATCH 275/377] Log terrible error when tethering type mismatches

Today on R and S, it is theoretically possible for WiFi to start
tethering with interface name wlan0, but the tethering regexes to map
wlan0 to type TETHERING_USB, because ifaceNameToType(wlan0) could return
TETHERING_USB and the subsequent call to checkTetherableType() returns
true.

This change adds a telemetry express log to figure out whether this
actually happens in the field.

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I59d6665670fc3210ddf8d49dc28917f000751ccd
---
 .../android/networkstack/tethering/Tethering.java    | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/Tethering/src/com/android/networkstack/tethering/Tethering.java b/Tethering/src/com/android/networkstack/tethering/Tethering.java
index 4bbe130a8a..771a9ff7b0 100644
--- a/Tethering/src/com/android/networkstack/tethering/Tethering.java
+++ b/Tethering/src/com/android/networkstack/tethering/Tethering.java
@@ -149,6 +149,7 @@ import com.android.internal.util.StateMachine;
 import com.android.modules.utils.build.SdkLevel;
 import com.android.net.module.util.BaseNetdUnsolicitedEventListener;
 import com.android.net.module.util.CollectionUtils;
+import com.android.net.module.util.FrameworkConnectivityStatsLog;
 import com.android.net.module.util.HandlerUtils;
 import com.android.net.module.util.NetdUtils;
 import com.android.net.module.util.RoutingCoordinatorManager;
@@ -1718,6 +1719,12 @@ public class Tethering {
         // After T, tethering always trust the iface pass by state change intent. This allow
         // tethering to deprecate tetherable p2p regexs after T.
         final int type = SdkLevel.isAtLeastT() ? TETHERING_WIFI_P2P : ifaceNameToType(ifname);
+        if (type != TETHERING_WIFI_P2P) {
+            FrameworkConnectivityStatsLog.write(
+                    FrameworkConnectivityStatsLog.CORE_NETWORKING_TERRIBLE_ERROR_OCCURRED,
+                    FrameworkConnectivityStatsLog.CORE_NETWORKING_TERRIBLE_ERROR_OCCURRED__ERROR_TYPE__TYPE_TETHER_WIFIP2P_TYPE_MISMATCH);
+        }
+
         if (!checkTetherableType(type)) {
             mLog.e(ifname + " is not a tetherable iface, ignoring");
             return;
@@ -1768,6 +1775,11 @@ public class Tethering {
                 mLog.e("Cannot enable IP serving in unknown WiFi mode: " + wifiIpMode);
                 return;
         }
+        if (type != TETHERING_WIFI) {
+            FrameworkConnectivityStatsLog.write(
+                    FrameworkConnectivityStatsLog.CORE_NETWORKING_TERRIBLE_ERROR_OCCURRED,
+                    FrameworkConnectivityStatsLog.CORE_NETWORKING_TERRIBLE_ERROR_OCCURRED__ERROR_TYPE__TYPE_TETHER_WIFI_TYPE_MISMATCH);
+        }
 
         // After T, tethering always trust the iface pass by state change intent. This allow
         // tethering to deprecate tetherable wifi regexs after T.

From d9b2cf9be0e44000ee12f06f9f9472aae86e70f5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Mon, 19 May 2025 10:48:13 -0700
Subject: [PATCH 276/377] NetlinkUtils: bump dump socket recv buffer size to
 1MiB
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bump up buffer to 1M to avoid overflow.

Bug: 409212357
Test: TreeHugger
Flag: EXEMPT mainline/trivial
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I6ccca6c577fda080067a9cf8a8efae064ed6df51
---
 .../com/android/net/module/util/netlink/NetlinkUtils.java       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/staticlibs/device/com/android/net/module/util/netlink/NetlinkUtils.java b/staticlibs/device/com/android/net/module/util/netlink/NetlinkUtils.java
index a999306ee5..1c642ae29b 100644
--- a/staticlibs/device/com/android/net/module/util/netlink/NetlinkUtils.java
+++ b/staticlibs/device/com/android/net/module/util/netlink/NetlinkUtils.java
@@ -87,7 +87,7 @@ public class NetlinkUtils {
 
     public static final int DEFAULT_RECV_BUFSIZE = 8 * 1024;
     public static final int SOCKET_RECV_BUFSIZE = 64 * 1024;
-    public static final int SOCKET_DUMP_RECV_BUFSIZE = 128 * 1024;
+    public static final int SOCKET_DUMP_RECV_BUFSIZE = 1024 * 1024;
 
     /**
      * Return whether the input ByteBuffer contains enough remaining bytes for

From 7a82293238ebdec9bf13fb677deb705c9b304a07 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Mon, 19 May 2025 10:45:14 -0700
Subject: [PATCH 277/377] Tethering: use the correct socket size for conntrack
 dump
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Offload HAL conntrack sockets are used for conntrack state dumps,
so should use the dump socket buffer size.

Bug: 409212357
Test: TreeHugger
Flag: EXEMPT mainline/trivial
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I73b4bb706efe55505b3646df63330de521a6df3f
---
 .../networkstack/tethering/OffloadHardwareInterface.java      | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Tethering/src/com/android/networkstack/tethering/OffloadHardwareInterface.java b/Tethering/src/com/android/networkstack/tethering/OffloadHardwareInterface.java
index 13a7a22f57..d1cc79dffc 100644
--- a/Tethering/src/com/android/networkstack/tethering/OffloadHardwareInterface.java
+++ b/Tethering/src/com/android/networkstack/tethering/OffloadHardwareInterface.java
@@ -16,7 +16,7 @@
 
 package com.android.networkstack.tethering;
 
-import static com.android.net.module.util.netlink.NetlinkUtils.SOCKET_RECV_BUFSIZE;
+import static com.android.net.module.util.netlink.NetlinkUtils.SOCKET_DUMP_RECV_BUFSIZE;
 import static com.android.net.module.util.netlink.StructNlMsgHdr.NLM_F_DUMP;
 import static com.android.net.module.util.netlink.StructNlMsgHdr.NLM_F_REQUEST;
 
@@ -200,7 +200,7 @@ public class OffloadHardwareInterface {
             final FileDescriptor fd;
             try {
                 fd = NetlinkUtils.netlinkSocketForProto(OsConstants.NETLINK_NETFILTER,
-                        SOCKET_RECV_BUFSIZE);
+                        SOCKET_DUMP_RECV_BUFSIZE);
             } catch (ErrnoException e) {
                 mLog.e("Unable to create conntrack socket " + e);
                 return null;

From 10979ef9ec71b33abd12f79b1d5730ce1166c97c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Tue, 20 May 2025 06:38:16 -0700
Subject: [PATCH 278/377] NetBpfLoad: abort if pin_subdir is specified
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This code should be dead. Abort to see whether it is.

Test: TreeHugger
Flag: EXEMPT dead code
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ib5309ff683339e70bc44e135578ede75548b022d
---
 bpf/loader/NetBpfLoad.cpp | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/bpf/loader/NetBpfLoad.cpp b/bpf/loader/NetBpfLoad.cpp
index d910da2ccd..6b92dfcf09 100644
--- a/bpf/loader/NetBpfLoad.cpp
+++ b/bpf/loader/NetBpfLoad.cpp
@@ -970,6 +970,7 @@ static int createMaps(const char* elfPath, ifstream& elfFile, vector<unique_fd>&
         if (specified(pin_subdir)) {
             ALOGV("map %s pin_subdir [%-32s] -> %d -> '%s'", mapNames[i].c_str(), md[i].pin_subdir,
                   static_cast<int>(pin_subdir), lookupPinSubdir(pin_subdir));
+            abort();
         }
 
         // Format of pin location is /sys/fs/bpf/<pin_subdir|prefix>map_<objName>_<mapName>
@@ -1202,6 +1203,7 @@ static int loadCodeSections(const char* elfPath, vector<codeSection>& cs, const
             ALOGV("prog %s pin_subdir [%-32s] -> %d -> '%s'", name.c_str(),
                   cs[i].prog_def->pin_subdir, static_cast<int>(pin_subdir),
                   lookupPinSubdir(pin_subdir));
+            abort();
         }
 
         // strip any potential $foo suffix

From b71cd4f8cf61ce7bf92f3026431c14fc5436a3b1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Tue, 20 May 2025 06:41:01 -0700
Subject: [PATCH 279/377] NetBpfLoad: crash if we are reusing a map.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is to identify if it actually happens.

It is expected not to happen, because we now pin every map and are run only once on boot.

Test: TreeHugger
Flag: EXEMPT dead code
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ie46ace40f20fb4b061a91cd53f8256caebdfa71f
---
 bpf/loader/NetBpfLoad.cpp | 1 +
 1 file changed, 1 insertion(+)

diff --git a/bpf/loader/NetBpfLoad.cpp b/bpf/loader/NetBpfLoad.cpp
index d910da2ccd..56a50a71d7 100644
--- a/bpf/loader/NetBpfLoad.cpp
+++ b/bpf/loader/NetBpfLoad.cpp
@@ -986,6 +986,7 @@ static int createMaps(const char* elfPath, ifstream& elfFile, vector<unique_fd>&
             saved_errno = errno;
             ALOGD("bpf_create_map reusing map %s, ret: %d", mapNames[i].c_str(), fd.get());
             reuse = true;
+            abort();
         } else {
             union bpf_attr req = {
               .map_type = type,

From e445d25af763adb749a0ead179fb936e431bf434 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Tue, 20 May 2025 08:44:56 -0700
Subject: [PATCH 280/377] NetBpfLoad: abort() on ignore_on_*
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

should be unused

Test: TreeHugger
Flag: EXEMPT dead code
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ice72d940dd3492d2b9e14dd32390a49f87bd54d1
---
 bpf/loader/NetBpfLoad.cpp | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/bpf/loader/NetBpfLoad.cpp b/bpf/loader/NetBpfLoad.cpp
index d910da2ccd..d61beb6062 100644
--- a/bpf/loader/NetBpfLoad.cpp
+++ b/bpf/loader/NetBpfLoad.cpp
@@ -909,7 +909,7 @@ static int createMaps(const char* elfPath, ifstream& elfFile, vector<unique_fd>&
             ALOGD("skipping map %s which is ignored on %s builds", mapNames[i].c_str(),
                   getBuildType().c_str());
             mapFds.push_back(unique_fd());
-            continue;
+            abort();
         }
 
         if ((isArm() && isKernel32Bit() && md[i].ignore_on_arm32) ||
@@ -920,7 +920,7 @@ static int createMaps(const char* elfPath, ifstream& elfFile, vector<unique_fd>&
             ALOGD("skipping map %s which is ignored on %s", mapNames[i].c_str(),
                   describeArch());
             mapFds.push_back(unique_fd());
-            continue;
+            abort();
         }
 
         enum bpf_map_type type = md[i].type;
@@ -1180,7 +1180,7 @@ static int loadCodeSections(const char* elfPath, vector<codeSection>& cs, const
             (cs[i].prog_def->ignore_on_userdebug && isUserdebug())) {
             ALOGD("cs[%d].name:%s is ignored on %s builds", i, name.c_str(),
                   getBuildType().c_str());
-            continue;
+            abort();
         }
 
         if ((isArm() && isKernel32Bit() && cs[i].prog_def->ignore_on_arm32) ||
@@ -1189,7 +1189,7 @@ static int loadCodeSections(const char* elfPath, vector<codeSection>& cs, const
             (isX86() && isKernel64Bit() && cs[i].prog_def->ignore_on_x86_64) ||
             (isRiscV() && cs[i].prog_def->ignore_on_riscv64)) {
             ALOGD("cs[%d].name:%s is ignored on %s", i, name.c_str(), describeArch());
-            continue;
+            abort();
         }
 
         if (specified(selinux_context)) {

From e74c12bfbe466b27f8483ed7300eb67cca9da30b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Tue, 20 May 2025 08:48:52 -0700
Subject: [PATCH 281/377] bpf: Remove unused macro definitions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Remove unused macros.

Test: TreeHugger
Flag: EXEMPT dead code
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I863227d0ad59f8cfe8a4108940ec050b5ae2f2bf
---
 bpf/headers/include/bpf_map_def.h | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/bpf/headers/include/bpf_map_def.h b/bpf/headers/include/bpf_map_def.h
index 2e5afca97b..144c81a471 100644
--- a/bpf/headers/include/bpf_map_def.h
+++ b/bpf/headers/include/bpf_map_def.h
@@ -117,7 +117,7 @@ _Static_assert(_Alignof(unsigned long long) == 8, "_Alignof unsigned long long !
 // for maps:
 struct shared_bool { bool shared; };
 #define PRIVATE ((struct shared_bool){ .shared = false })
-#define SHARED ((struct shared_bool){ .shared = true })
+//#define SHARED ((struct shared_bool){ .shared = true })
 
 // for programs:
 struct optional_bool { bool optional; };
@@ -127,15 +127,15 @@ struct optional_bool { bool optional; };
 // for both maps and programs:
 struct ignore_on_eng_bool { bool ignore_on_eng; };
 #define LOAD_ON_ENG ((struct ignore_on_eng_bool){ .ignore_on_eng = false })
-#define IGNORE_ON_ENG ((struct ignore_on_eng_bool){ .ignore_on_eng = true })
+//#define IGNORE_ON_ENG ((struct ignore_on_eng_bool){ .ignore_on_eng = true })
 
 struct ignore_on_user_bool { bool ignore_on_user; };
 #define LOAD_ON_USER ((struct ignore_on_user_bool){ .ignore_on_user = false })
-#define IGNORE_ON_USER ((struct ignore_on_user_bool){ .ignore_on_user = true })
+//#define IGNORE_ON_USER ((struct ignore_on_user_bool){ .ignore_on_user = true })
 
 struct ignore_on_userdebug_bool { bool ignore_on_userdebug; };
 #define LOAD_ON_USERDEBUG ((struct ignore_on_userdebug_bool){ .ignore_on_userdebug = false })
-#define IGNORE_ON_USERDEBUG ((struct ignore_on_userdebug_bool){ .ignore_on_userdebug = true })
+//#define IGNORE_ON_USERDEBUG ((struct ignore_on_userdebug_bool){ .ignore_on_userdebug = true })
 
 
 // Length of strings (incl. selinux_context and pin_subdir)

From 7b7cfa45a673a52a7623956ba475f57ce3c1eab2 Mon Sep 17 00:00:00 2001
From: "Priyanka Advani (xWF)" <padvani@google.com>
Date: Tue, 20 May 2025 11:19:03 -0700
Subject: [PATCH 282/377] Revert "Check whether CarrierConfigManager is null"

This reverts commit b936f0c5fd7b636063cf14fc38376f3f00ace890.

Reason for revert: Droidmonitor created revert due to b/418898788. Will be verifying through ABTD before submission.

Fix: 418898788
Change-Id: Ia47f0cc9a33ed33f9d53064878992081a792f1ad
---
 .../MultinetworkPolicyTracker.java            | 134 ++++++++----------
 .../MultinetworkPolicyTrackerTest.kt          |  31 +---
 ...ltinetworkPolicyTrackerTestDependencies.kt |   4 +-
 3 files changed, 69 insertions(+), 100 deletions(-)

diff --git a/service/src/com/android/server/connectivity/MultinetworkPolicyTracker.java b/service/src/com/android/server/connectivity/MultinetworkPolicyTracker.java
index 9b15728754..60d27c353d 100644
--- a/service/src/com/android/server/connectivity/MultinetworkPolicyTracker.java
+++ b/service/src/com/android/server/connectivity/MultinetworkPolicyTracker.java
@@ -20,7 +20,6 @@ import static android.content.pm.PackageManager.FEATURE_TELEPHONY_SUBSCRIPTION;
 import static android.net.ConnectivitySettingsManager.NETWORK_AVOID_BAD_WIFI;
 import static android.net.ConnectivitySettingsManager.NETWORK_METERED_MULTIPATH_PREFERENCE;
 
-import android.annotation.IntDef;
 import android.annotation.NonNull;
 import android.annotation.Nullable;
 import android.annotation.TargetApi;
@@ -53,8 +52,6 @@ import com.android.modules.utils.build.SdkLevel;
 import com.android.net.module.util.DeviceConfigUtils;
 import com.android.net.module.util.HandlerUtils;
 
-import java.lang.annotation.Retention;
-import java.lang.annotation.RetentionPolicy;
 import java.util.Arrays;
 import java.util.List;
 import java.util.concurrent.Executor;
@@ -90,23 +87,10 @@ public class MultinetworkPolicyTracker {
         }
     }
 
-    /**
-     * Indicates that the "Avoid Bad Wi-Fi" setting originates from a resource.
-     */
-    private static final int FROM_RESOURCE = 0;
-
-    /**
-     * Indicates that the "Avoid Bad Wi-Fi" setting originates from carrier configuration.
-     */
-    private static final int FROM_CARRIER_CONFIG = 1;
-
-    /**
-     * Defines the set of possible integer constants for AvoidBadWifiSource.
-     * This annotation provides compile-time type safety.
-     */
-    @IntDef({FROM_RESOURCE, FROM_CARRIER_CONFIG})
-    @Retention(RetentionPolicy.SOURCE)
-    public @interface AvoidBadWifiSource {}
+    private enum AvoidBadWifiSource {
+        FROM_RESOURCE,
+        FROM_CARRIER_CONFIG,
+    }
 
     private static String TAG = MultinetworkPolicyTracker.class.getSimpleName();
 
@@ -121,7 +105,8 @@ public class MultinetworkPolicyTracker {
     private final ContentResolver mResolver;
     private final SettingObserver mSettingObserver;
     private final BroadcastReceiver mBroadcastReceiver;
-    private final @AvoidBadWifiSource int mAvoidBadWifiSource;
+    private final boolean mAvoidBadWifiFromCarrierConfigFeature;
+    private final boolean mHasTelephonySubscription;
     // This will be null if the FLAG_AVOID_BAD_WIFI_FROM_CARRIER_CONFIG is off
     private final @Nullable CarrierConfigManager mCarrierConfigManager;
     private final @Nullable CarrierConfigChangeListener mCarrierConfigChangeListener;
@@ -177,19 +162,15 @@ public class MultinetworkPolicyTracker {
 
         @VisibleForTesting
         protected boolean readAvoidBadWifiFromCarrierConfig(
-                @Nullable final CarrierConfigManager ccm, final int subId) {
+                @NonNull final Context context, final int subId) {
             // Defaults to true to avoid potentially poor Wi-Fi and improve user experience.
             final boolean defaultConfig = true;
             if (subId == SubscriptionManager.INVALID_SUBSCRIPTION_ID) {
                 return defaultConfig;
             }
 
-            // It implies the FEATURE_TELEPHONY_SUBSCRIPTION is not supported, return default config
-            if (ccm == null) {
-                return defaultConfig;
-            }
-
             PersistableBundle config = null;
+            final CarrierConfigManager ccm = context.getSystemService(CarrierConfigManager.class);
 
             try {
                 config = ccm.getConfigForSubId(subId,
@@ -290,17 +271,18 @@ public class MultinetworkPolicyTracker {
             }
         };
 
-        if (mDeps.getAvoidBadWifiFromCarrierConfigFeature()) {
-            mAvoidBadWifiSource = FROM_CARRIER_CONFIG;
-            mCarrierConfigManager =
-                mContext.getPackageManager().hasSystemFeature(FEATURE_TELEPHONY_SUBSCRIPTION)
-                ? mContext.getSystemService(CarrierConfigManager.class)
-                : null;
-            mCarrierConfigChangeListener = new CarrierConfigChangeListener();
-        } else {
-            mAvoidBadWifiSource = FROM_RESOURCE;
-            mCarrierConfigManager = null;
-            mCarrierConfigChangeListener = null;
+        mHasTelephonySubscription =
+            mContext.getPackageManager().hasSystemFeature(FEATURE_TELEPHONY_SUBSCRIPTION);
+        mAvoidBadWifiFromCarrierConfigFeature = mDeps.getAvoidBadWifiFromCarrierConfigFeature();
+        mCarrierConfigManager = mAvoidBadWifiFromCarrierConfigFeature
+            ? mContext.getSystemService(CarrierConfigManager.class)
+            : null;
+
+        mCarrierConfigChangeListener = mAvoidBadWifiFromCarrierConfigFeature
+            ? new CarrierConfigChangeListener()
+            : null;
+
+        if (!mAvoidBadWifiFromCarrierConfigFeature) {
             updateAvoidBadWifi();
             updateMeteredMultipathPreference();
         }
@@ -322,7 +304,7 @@ public class MultinetworkPolicyTracker {
         mContext.getSystemService(TelephonyManager.class).registerTelephonyCallback(
                 handlerExecutor, new ActiveDataSubscriptionIdListener());
 
-        if (mCarrierConfigManager != null) {
+        if (mAvoidBadWifiFromCarrierConfigFeature) {
             mCarrierConfigManager.registerCarrierConfigChangeListener(
                     BackgroundThread.getExecutor(), mCarrierConfigChangeListener
             );
@@ -343,7 +325,7 @@ public class MultinetworkPolicyTracker {
         mResolver.unregisterContentObserver(mSettingObserver);
 
         mContext.unregisterReceiver(mBroadcastReceiver);
-        if (mCarrierConfigManager != null) {
+        if (mAvoidBadWifiFromCarrierConfigFeature) {
             mCarrierConfigManager.unregisterCarrierConfigChangeListener(
                     mCarrierConfigChangeListener
             );
@@ -480,6 +462,18 @@ public class MultinetworkPolicyTracker {
         }
     }
 
+    /**
+     * Determines the source of the avoid bad Wi-Fi setting.
+     * It returns FROM_CARRIER_CONFIG if the carrier config feature is enabled,
+     * otherwise it returns FROM_RESOURCE.
+     *
+     */
+    private AvoidBadWifiSource getAvoidBadWifiSource() {
+        return mAvoidBadWifiFromCarrierConfigFeature
+            ? AvoidBadWifiSource.FROM_CARRIER_CONFIG
+            : AvoidBadWifiSource.FROM_RESOURCE;
+    }
+
     /**
      * Updates the local cache of the "avoid bad Wi-Fi" setting from the carrier config
      * for a specific subscription ID.
@@ -508,8 +502,8 @@ public class MultinetworkPolicyTracker {
 
         // CarrierConfigManager#getConfigForSubId() is supported
         // only when system has FEATURE_TELEPHONY_SUBSCRIPTION
-        final boolean config =
-                mDeps.readAvoidBadWifiFromCarrierConfig(mCarrierConfigManager, subId);
+        final boolean config = !mHasTelephonySubscription
+                || mDeps.readAvoidBadWifiFromCarrierConfig(mContext, subId);
         mHandler.post(() -> updateAvoidBadWifiFromCarrierConfig(subId, config));
     }
 
@@ -534,35 +528,33 @@ public class MultinetworkPolicyTracker {
      */
     public boolean updateAvoidBadWifi() {
         final boolean prevAvoid = mAvoidBadWifi;
-        switch (mAvoidBadWifiSource) {
-            case FROM_CARRIER_CONFIG:
-                // Force update activelyPreferBadWifi since it will always be true in Android U+,
-                // and mAvoidBadWifiFromCarrierConfigFeature is a trunk stable flag
-                // that only exists in 25Q4+
-                mActivelyPreferBadWifi = true;
-                final String settingAvoidBadWifiStr = readAvoidBadWifiFromSettings();
-                if (settingAvoidBadWifiStr != null) {
-                    mAvoidBadWifi = "1".equals(settingAvoidBadWifiStr);
-                } else {
-                    // Retrieve the avoid bad Wi-Fi setting from the local cache to avoid potential
-                    // issues or blocking from the IPC call getAvoidBadWifiCarrierConfigForSubId().
-                    mAvoidBadWifi = readAvoidBadWifiFromCache(mActiveSubId);
-                }
-                return mAvoidBadWifi != prevAvoid;
-            case FROM_RESOURCE:
-                final boolean settingAvoidBadWifi = "1".equals(readAvoidBadWifiFromSettings());
-                mAvoidBadWifi = settingAvoidBadWifi || !configRestrictsAvoidBadWifi();
-                final boolean prevActive = mActivelyPreferBadWifi;
-                final Boolean deviceConfigPreferBadWifi = deviceConfigActivelyPreferBadWifi();
-                if (null == deviceConfigPreferBadWifi) {
-                    mActivelyPreferBadWifi = configActivelyPrefersBadWifi();
-                } else {
-                    mActivelyPreferBadWifi = deviceConfigPreferBadWifi;
-                }
-                return mAvoidBadWifi != prevAvoid || mActivelyPreferBadWifi != prevActive;
-            default:
-                Log.wtf(TAG, "Unexpected avoid bad Wi-Fi source: " + mAvoidBadWifiSource);
-                return false;
+        if (getAvoidBadWifiSource() == AvoidBadWifiSource.FROM_CARRIER_CONFIG) {
+            // Force update activelyPreferBadWifi since it will always be true in Android U+,
+            // and mAvoidBadWifiFromCarrierConfigFeature is a trunk stable flag
+            // that only exists in 25Q4+
+            mActivelyPreferBadWifi = true;
+
+            final String settingAvoidBadWifiStr = readAvoidBadWifiFromSettings();
+            if (settingAvoidBadWifiStr != null) {
+                mAvoidBadWifi = "1".equals(settingAvoidBadWifiStr);
+            } else {
+                // Retrieve the avoid bad Wi-Fi setting from the local cache to avoid potential
+                // issues or blocking from the IPC call getAvoidBadWifiCarrierConfigForSubId().
+                mAvoidBadWifi = readAvoidBadWifiFromCache(mActiveSubId);
+            }
+            return mAvoidBadWifi != prevAvoid;
+        } else {
+            final boolean settingAvoidBadWifi = "1".equals(readAvoidBadWifiFromSettings());
+            mAvoidBadWifi = settingAvoidBadWifi || !configRestrictsAvoidBadWifi();
+            final boolean prevActive = mActivelyPreferBadWifi;
+            final Boolean deviceConfigPreferBadWifi = deviceConfigActivelyPreferBadWifi();
+            if (null == deviceConfigPreferBadWifi) {
+                mActivelyPreferBadWifi = configActivelyPrefersBadWifi();
+            } else {
+                mActivelyPreferBadWifi = deviceConfigPreferBadWifi;
+            }
+
+            return mAvoidBadWifi != prevAvoid || mActivelyPreferBadWifi != prevActive;
         }
     }
 
diff --git a/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTest.kt b/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTest.kt
index ca0a136227..95a6d8c8bb 100644
--- a/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTest.kt
+++ b/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTest.kt
@@ -49,19 +49,16 @@ import org.junit.After
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertFalse
 import org.junit.Assert.assertTrue
-import org.junit.Assume.assumeNotNull
 import org.junit.Before
 import org.junit.Rule
 import org.junit.Test
 import org.junit.runner.RunWith
-import org.junit.runners.Parameterized
 import org.mockito.ArgumentCaptor
 import org.mockito.ArgumentMatchers.anyInt
 import org.mockito.Mockito.any
 import org.mockito.Mockito.doCallRealMethod
 import org.mockito.Mockito.doReturn
 import org.mockito.Mockito.mock
-import org.mockito.Mockito.reset
 import org.mockito.Mockito.times
 import org.mockito.Mockito.verify
 
@@ -77,17 +74,6 @@ const val HANDLER_TIMEOUT_MS = 400
 @SmallTest
 @DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.R)
 class MultinetworkPolicyTrackerTest {
-    companion object {
-        @Parameterized.Parameters
-        @JvmStatic
-        fun data(): Iterable<Any?> {
-            return mutableListOf(
-                null,
-                mock(CarrierConfigManager::class.java)
-            )
-        }
-    }
-
     // This wrapper class prevents JUnit from attempting to load unsupported system classes
     // that are present in the System Test (S/T) image, which would otherwise cause test failures.
     private class CarrierConfigChangeRunner(
@@ -111,11 +97,6 @@ class MultinetworkPolicyTrackerTest {
 
     private val featureFlags = HashSet<String>()
 
-    // Indicates where carrierConfigManager is supported.
-    @Parameterized.Parameter(0)
-    @JvmField
-    var carrierConfigManager: CarrierConfigManager? = null
-
     // This will set feature flags from @FeatureFlag annotations
     // into the map before setUp() runs.
     @get:Rule
@@ -134,6 +115,7 @@ class MultinetworkPolicyTrackerTest {
     }
 
     private val telephonyManager = mock(TelephonyManager::class.java)
+    private val carrierConfigManager = mock(CarrierConfigManager::class.java)
     private val subscriptionManager = mock(SubscriptionManager::class.java).also {
         doReturn(null).`when`(it).getActiveSubscriptionInfo(anyInt())
     }
@@ -153,6 +135,8 @@ class MultinetworkPolicyTrackerTest {
         }
         doReturn(subscriptionManager).`when`(it)
             .getSystemService(Context.TELEPHONY_SUBSCRIPTION_SERVICE)
+        doReturn(carrierConfigManager).`when`(it)
+            .getSystemService(CarrierConfigManager::class.java)
         doReturn(resolver).`when`(it).contentResolver
         doReturn(resources).`when`(it).resources
         doReturn(it).`when`(it).createConfigurationContext(any())
@@ -222,8 +206,6 @@ class MultinetworkPolicyTrackerTest {
             featureFlags.contains(FLAG_AVOID_BAD_WIFI_FROM_CARRIER_CONFIG)
         )
 
-        doReturn(carrierConfigManager).`when`(context)
-            .getSystemService(CarrierConfigManager::class.java)
         trackerDependencies.setBackgroundThreadHandler(bgHandler)
         tracker = MultinetworkPolicyTracker(
             context,
@@ -237,9 +219,6 @@ class MultinetworkPolicyTrackerTest {
     @After
     fun tearDown() {
         ConnectivityResources.setResourcesContextForTest(null)
-        carrierConfigManager?.let { ccm ->
-            reset(ccm)
-        }
         trackerDependencies.resetAvoidBadWifiCarrierConfigForSubIdMap()
     }
 
@@ -347,8 +326,6 @@ class MultinetworkPolicyTrackerTest {
     @FeatureFlag(name = FLAG_AVOID_BAD_WIFI_FROM_CARRIER_CONFIG, true)
     @DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.BAKLAVA)
     fun testUpdateAvoidBadWifiOnCarrierConfigChange() {
-        assumeNotNull("skip test if carrierConfigManager is not supported", carrierConfigManager)
-
         // Mock the initial global setting to null
         Settings.Global.putString(resolver, NETWORK_AVOID_BAD_WIFI, null)
 
@@ -369,7 +346,7 @@ class MultinetworkPolicyTrackerTest {
         // Mock the initial carrier configuration to return false
         trackerDependencies.setAvoidBadWifiCarrierConfigForSubId(activeSubId, false)
         verify(carrierConfigManager, times(1))
-            ?.registerCarrierConfigChangeListener(any(), carrierConfiglistenCaptor.capture())
+            .registerCarrierConfigChangeListener(any(), carrierConfiglistenCaptor.capture())
 
         val carrierConfiglistener = carrierConfiglistenCaptor.value
         // dispatch for the first carrier config initialization on the handler thread
diff --git a/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTestDependencies.kt b/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTestDependencies.kt
index dc2ace4984..7285cbe32b 100644
--- a/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTestDependencies.kt
+++ b/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTestDependencies.kt
@@ -1,11 +1,11 @@
 package com.android.server.connectivity
 
+import android.content.Context
 import android.content.res.Resources
 import android.os.Handler
 import android.provider.DeviceConfig
 import android.provider.DeviceConfig.NAMESPACE_CONNECTIVITY
 import android.provider.DeviceConfig.OnPropertiesChangedListener
-import android.telephony.CarrierConfigManager
 import com.android.internal.annotations.GuardedBy
 import com.android.internal.os.BackgroundThread
 import com.android.server.connectivity.MultinetworkPolicyTracker.CONFIG_ACTIVELY_PREFER_BAD_WIFI
@@ -72,7 +72,7 @@ class MultinetworkPolicyTrackerTestDependencies(
         resources
 
     override fun readAvoidBadWifiFromCarrierConfig(
-        ccm: CarrierConfigManager?,
+        context: Context,
         subId: Int
     ): Boolean =
         avoidBadWifiCarrierConfigForSubIdMap.getOrDefault(subId, true)

From 41d8d6335654ec4574c818ec70b54f2089b7ba04 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Tue, 20 May 2025 14:30:07 -0700
Subject: [PATCH 283/377] NetBpfLoad: Remove `ignore_on_*` directives
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`ignore_on_*` directives haven't been used in a while and require a special version of bpfloader. Remove them.

While doing so, pad the `map_def` and `prog_def` structs, to maintain existing size.

Note: The mainline shipped bpf .o files are now in a location
that no platform bpfloader ever looked/looks at.
As such maintaining .o format compatibility with older release
is not needed.

Test: TreeHugger
Flag: EXEMPT dead code removal / mainline
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I485c9645bdece2ad27add08347688d0f1c93e5d2
---
 bpf/headers/include/bpf_helpers.h | 17 +----------
 bpf/headers/include/bpf_map_def.h | 49 ++++++-------------------------
 bpf/loader/NetBpfLoad.cpp         | 36 -----------------------
 3 files changed, 10 insertions(+), 92 deletions(-)

diff --git a/bpf/headers/include/bpf_helpers.h b/bpf/headers/include/bpf_helpers.h
index 8526745d94..2242daf378 100644
--- a/bpf/headers/include/bpf_helpers.h
+++ b/bpf/headers/include/bpf_helpers.h
@@ -286,14 +286,6 @@ static int (*bpf_sk_storage_delete_unsafe) (const struct bpf_map_def* sk_storage
         __attribute__ ((section(".maps." #name), used)) \
                 ____btf_map_##name = { }
 
-#define BPF_ASSERT_LOADER_VERSION(min_loader, ignore_eng, ignore_user, ignore_userdebug) \
-    _Static_assert(                                                                      \
-        (min_loader) >= BPFLOADER_IGNORED_ON_VERSION ||                                  \
-            !((ignore_eng).ignore_on_eng ||                                              \
-              (ignore_user).ignore_on_user ||                                            \
-              (ignore_userdebug).ignore_on_userdebug),                                   \
-        "bpfloader min version must be >= 0.33 in order to use ignored_on");
-
 #define ABSOLUTE(x) ((x) < 0 ? -(x) : (x))
 
 #define DEFAULT_BPF_MAP_FLAGS(type, num_entries, mapflags)         \
@@ -323,11 +315,7 @@ static int (*bpf_sk_storage_delete_unsafe) (const struct bpf_map_def* sk_storage
         .selinux_context = (selinux),                                       \
         .pin_subdir = (pindir),                                             \
         .shared = (share).shared,                                           \
-        .ignore_on_eng = (ignore_eng).ignore_on_eng,                        \
-        .ignore_on_user = (ignore_user).ignore_on_user,                     \
-        .ignore_on_userdebug = (ignore_userdebug).ignore_on_userdebug,      \
-    };                                                                      \
-    BPF_ASSERT_LOADER_VERSION(minloader, ignore_eng, ignore_user, ignore_userdebug);
+    };
 
 // Type safe macro to declare a ring buffer and related output functions.
 // Compatibility:
@@ -542,9 +530,6 @@ static int (*bpf_trace_printk)(const char* fmt, int fmt_size, ...) = (void*) BPF
         .bpfloader_max_ver = (max_loader),                                               \
         .selinux_context = (selinux),                                                    \
         .pin_subdir = (pindir),                                                          \
-        .ignore_on_eng = (ignore_eng).ignore_on_eng,                                     \
-        .ignore_on_user = (ignore_user).ignore_on_user,                                  \
-        .ignore_on_userdebug = (ignore_userdebug).ignore_on_userdebug,                   \
     };                                                                                   \
     SECTION(SECTION_NAME)                                                                \
     int the_prog
diff --git a/bpf/headers/include/bpf_map_def.h b/bpf/headers/include/bpf_map_def.h
index 144c81a471..c98f40b4ea 100644
--- a/bpf/headers/include/bpf_map_def.h
+++ b/bpf/headers/include/bpf_map_def.h
@@ -124,18 +124,15 @@ struct optional_bool { bool optional; };
 #define MANDATORY ((struct optional_bool){ .optional = false })
 #define OPTIONAL ((struct optional_bool){ .optional = true })
 
-// for both maps and programs:
-struct ignore_on_eng_bool { bool ignore_on_eng; };
-#define LOAD_ON_ENG ((struct ignore_on_eng_bool){ .ignore_on_eng = false })
-//#define IGNORE_ON_ENG ((struct ignore_on_eng_bool){ .ignore_on_eng = true })
+// (deprecated) for both maps and programs:
+struct ignore_on_eng_bool { };
+#define LOAD_ON_ENG ((struct ignore_on_eng_bool){ })
 
-struct ignore_on_user_bool { bool ignore_on_user; };
-#define LOAD_ON_USER ((struct ignore_on_user_bool){ .ignore_on_user = false })
-//#define IGNORE_ON_USER ((struct ignore_on_user_bool){ .ignore_on_user = true })
+struct ignore_on_user_bool { };
+#define LOAD_ON_USER ((struct ignore_on_user_bool){ })
 
-struct ignore_on_userdebug_bool { bool ignore_on_userdebug; };
-#define LOAD_ON_USERDEBUG ((struct ignore_on_userdebug_bool){ .ignore_on_userdebug = false })
-//#define IGNORE_ON_USERDEBUG ((struct ignore_on_userdebug_bool){ .ignore_on_userdebug = true })
+struct ignore_on_userdebug_bool { };
+#define LOAD_ON_USERDEBUG ((struct ignore_on_userdebug_bool){ })
 
 
 // Length of strings (incl. selinux_context and pin_subdir)
@@ -198,21 +195,7 @@ struct bpf_map_def {
 
     bool shared;  // use empty string as 'file' component of pin path - allows cross .o map sharing
 
-    // The following 3 ignore_on_* fields were added in version 0.32 (U). These are ignored in
-    // older bpfloader versions, and zero in programs compiled before 0.32.
-    bool ignore_on_eng:1;
-    bool ignore_on_user:1;
-    bool ignore_on_userdebug:1;
-    // The following 5 ignore_on_* fields were added in version 0.38 (U). These are ignored in
-    // older bpfloader versions, and zero in programs compiled before 0.38.
-    // These are tests on the kernel architecture, ie. they ignore userspace bit-ness.
-    bool ignore_on_arm32:1;
-    bool ignore_on_aarch64:1;
-    bool ignore_on_x86_32:1;
-    bool ignore_on_x86_64:1;
-    bool ignore_on_riscv64:1;
-
-    char pad0[2];  // manually pad up to 4 byte alignment, may be used for extensions in the future
+    char pad0[3];  // manually pad up to 4 byte alignment, may be used for extensions in the future
 
     unsigned int uid;   // uid_t
 };
@@ -235,21 +218,7 @@ struct bpf_prog_def {
 
     bool optional;  // program section (ie. function) may fail to load, continue onto next func.
 
-    // The following 3 ignore_on_* fields were added in version 0.33 (U). These are ignored in
-    // older bpfloader versions, and zero in programs compiled before 0.33.
-    bool ignore_on_eng:1;
-    bool ignore_on_user:1;
-    bool ignore_on_userdebug:1;
-    // The following 5 ignore_on_* fields were added in version 0.38 (U). These are ignored in
-    // older bpfloader versions, and zero in programs compiled before 0.38.
-    // These are tests on the kernel architecture, ie. they ignore userspace bit-ness.
-    bool ignore_on_arm32:1;
-    bool ignore_on_aarch64:1;
-    bool ignore_on_x86_32:1;
-    bool ignore_on_x86_64:1;
-    bool ignore_on_riscv64:1;
-
-    char pad0[2];  // manually pad up to 4 byte alignment, may be used for extensions in the future
+    char pad0[3];  // manually pad up to 4 byte alignment, may be used for extensions in the future
 
     // The following fields were added in version 0.1
     unsigned int bpfloader_min_ver;  // if missing, defaults to 0, ie. v0.0
diff --git a/bpf/loader/NetBpfLoad.cpp b/bpf/loader/NetBpfLoad.cpp
index 0fa54013a3..e5d3507a45 100644
--- a/bpf/loader/NetBpfLoad.cpp
+++ b/bpf/loader/NetBpfLoad.cpp
@@ -904,25 +904,6 @@ static int createMaps(const char* elfPath, ifstream& elfFile, vector<unique_fd>&
             continue;
         }
 
-        if ((md[i].ignore_on_eng && isEng()) || (md[i].ignore_on_user && isUser()) ||
-            (md[i].ignore_on_userdebug && isUserdebug())) {
-            ALOGD("skipping map %s which is ignored on %s builds", mapNames[i].c_str(),
-                  getBuildType().c_str());
-            mapFds.push_back(unique_fd());
-            abort();
-        }
-
-        if ((isArm() && isKernel32Bit() && md[i].ignore_on_arm32) ||
-            (isArm() && isKernel64Bit() && md[i].ignore_on_aarch64) ||
-            (isX86() && isKernel32Bit() && md[i].ignore_on_x86_32) ||
-            (isX86() && isKernel64Bit() && md[i].ignore_on_x86_64) ||
-            (isRiscV() && md[i].ignore_on_riscv64)) {
-            ALOGD("skipping map %s which is ignored on %s", mapNames[i].c_str(),
-                  describeArch());
-            mapFds.push_back(unique_fd());
-            abort();
-        }
-
         enum bpf_map_type type = md[i].type;
         if (type == BPF_MAP_TYPE_LPM_TRIE && !isAtLeastKernelVersion(4, 14, 0)) {
             // On Linux Kernels older than 4.14 this map type doesn't exist - autoskip.
@@ -1177,23 +1158,6 @@ static int loadCodeSections(const char* elfPath, vector<codeSection>& cs, const
         if (bpfloader_ver < bpfMinVer) continue;
         if (bpfloader_ver >= bpfMaxVer) continue;
 
-        if ((cs[i].prog_def->ignore_on_eng && isEng()) ||
-            (cs[i].prog_def->ignore_on_user && isUser()) ||
-            (cs[i].prog_def->ignore_on_userdebug && isUserdebug())) {
-            ALOGD("cs[%d].name:%s is ignored on %s builds", i, name.c_str(),
-                  getBuildType().c_str());
-            abort();
-        }
-
-        if ((isArm() && isKernel32Bit() && cs[i].prog_def->ignore_on_arm32) ||
-            (isArm() && isKernel64Bit() && cs[i].prog_def->ignore_on_aarch64) ||
-            (isX86() && isKernel32Bit() && cs[i].prog_def->ignore_on_x86_32) ||
-            (isX86() && isKernel64Bit() && cs[i].prog_def->ignore_on_x86_64) ||
-            (isRiscV() && cs[i].prog_def->ignore_on_riscv64)) {
-            ALOGD("cs[%d].name:%s is ignored on %s", i, name.c_str(), describeArch());
-            abort();
-        }
-
         if (specified(selinux_context)) {
             ALOGV("prog %s selinux_context [%-32s] -> %d -> '%s' (%s)", name.c_str(),
                   cs[i].prog_def->selinux_context, static_cast<int>(selinux_context),

From 232c944de35eaa03b77c7dba33c389bdf237e8cc Mon Sep 17 00:00:00 2001
From: Jimi Chen <jimictw@google.com>
Date: Tue, 20 May 2025 20:29:30 -0700
Subject: [PATCH 284/377] Revert^2 "Check whether CarrierConfigManager is null"

This reverts commit 7b7cfa45a673a52a7623956ba475f57ce3c1eab2.

Reason for revert: prevents crash with no carrierConfigManager support
Test: atest ConnectivityCoverageTests

Change-Id: I9e91d2d25d16c0c2a39388f08a49bef7b17fda42
---
 .../MultinetworkPolicyTracker.java            | 129 +++++++++---------
 .../MultinetworkPolicyTrackerTest.kt          |  40 +++++-
 ...ltinetworkPolicyTrackerTestDependencies.kt |   4 +-
 3 files changed, 104 insertions(+), 69 deletions(-)

diff --git a/service/src/com/android/server/connectivity/MultinetworkPolicyTracker.java b/service/src/com/android/server/connectivity/MultinetworkPolicyTracker.java
index 60d27c353d..561a7934aa 100644
--- a/service/src/com/android/server/connectivity/MultinetworkPolicyTracker.java
+++ b/service/src/com/android/server/connectivity/MultinetworkPolicyTracker.java
@@ -20,6 +20,7 @@ import static android.content.pm.PackageManager.FEATURE_TELEPHONY_SUBSCRIPTION;
 import static android.net.ConnectivitySettingsManager.NETWORK_AVOID_BAD_WIFI;
 import static android.net.ConnectivitySettingsManager.NETWORK_METERED_MULTIPATH_PREFERENCE;
 
+import android.annotation.IntDef;
 import android.annotation.NonNull;
 import android.annotation.Nullable;
 import android.annotation.TargetApi;
@@ -52,6 +53,8 @@ import com.android.modules.utils.build.SdkLevel;
 import com.android.net.module.util.DeviceConfigUtils;
 import com.android.net.module.util.HandlerUtils;
 
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
 import java.util.Arrays;
 import java.util.List;
 import java.util.concurrent.Executor;
@@ -87,10 +90,23 @@ public class MultinetworkPolicyTracker {
         }
     }
 
-    private enum AvoidBadWifiSource {
-        FROM_RESOURCE,
-        FROM_CARRIER_CONFIG,
-    }
+    /**
+     * Indicates that the "Avoid Bad Wi-Fi" setting originates from a resource.
+     */
+    private static final int FROM_RESOURCE = 0;
+
+    /**
+     * Indicates that the "Avoid Bad Wi-Fi" setting originates from carrier configuration.
+     */
+    private static final int FROM_CARRIER_CONFIG = 1;
+
+    /**
+     * Defines the set of possible integer constants for AvoidBadWifiSource.
+     * This annotation provides compile-time type safety.
+     */
+    @IntDef({FROM_RESOURCE, FROM_CARRIER_CONFIG})
+    @Retention(RetentionPolicy.SOURCE)
+    public @interface AvoidBadWifiSource {}
 
     private static String TAG = MultinetworkPolicyTracker.class.getSimpleName();
 
@@ -105,8 +121,7 @@ public class MultinetworkPolicyTracker {
     private final ContentResolver mResolver;
     private final SettingObserver mSettingObserver;
     private final BroadcastReceiver mBroadcastReceiver;
-    private final boolean mAvoidBadWifiFromCarrierConfigFeature;
-    private final boolean mHasTelephonySubscription;
+    private final @AvoidBadWifiSource int mAvoidBadWifiSource;
     // This will be null if the FLAG_AVOID_BAD_WIFI_FROM_CARRIER_CONFIG is off
     private final @Nullable CarrierConfigManager mCarrierConfigManager;
     private final @Nullable CarrierConfigChangeListener mCarrierConfigChangeListener;
@@ -162,7 +177,7 @@ public class MultinetworkPolicyTracker {
 
         @VisibleForTesting
         protected boolean readAvoidBadWifiFromCarrierConfig(
-                @NonNull final Context context, final int subId) {
+                @NonNull final CarrierConfigManager ccm, final int subId) {
             // Defaults to true to avoid potentially poor Wi-Fi and improve user experience.
             final boolean defaultConfig = true;
             if (subId == SubscriptionManager.INVALID_SUBSCRIPTION_ID) {
@@ -170,7 +185,6 @@ public class MultinetworkPolicyTracker {
             }
 
             PersistableBundle config = null;
-            final CarrierConfigManager ccm = context.getSystemService(CarrierConfigManager.class);
 
             try {
                 config = ccm.getConfigForSubId(subId,
@@ -271,18 +285,17 @@ public class MultinetworkPolicyTracker {
             }
         };
 
-        mHasTelephonySubscription =
-            mContext.getPackageManager().hasSystemFeature(FEATURE_TELEPHONY_SUBSCRIPTION);
-        mAvoidBadWifiFromCarrierConfigFeature = mDeps.getAvoidBadWifiFromCarrierConfigFeature();
-        mCarrierConfigManager = mAvoidBadWifiFromCarrierConfigFeature
-            ? mContext.getSystemService(CarrierConfigManager.class)
-            : null;
-
-        mCarrierConfigChangeListener = mAvoidBadWifiFromCarrierConfigFeature
-            ? new CarrierConfigChangeListener()
-            : null;
-
-        if (!mAvoidBadWifiFromCarrierConfigFeature) {
+        if (mDeps.getAvoidBadWifiFromCarrierConfigFeature()) {
+            mAvoidBadWifiSource = FROM_CARRIER_CONFIG;
+            mCarrierConfigManager =
+                mContext.getPackageManager().hasSystemFeature(FEATURE_TELEPHONY_SUBSCRIPTION)
+                ? mContext.getSystemService(CarrierConfigManager.class)
+                : null;
+            mCarrierConfigChangeListener = new CarrierConfigChangeListener();
+        } else {
+            mAvoidBadWifiSource = FROM_RESOURCE;
+            mCarrierConfigManager = null;
+            mCarrierConfigChangeListener = null;
             updateAvoidBadWifi();
             updateMeteredMultipathPreference();
         }
@@ -304,7 +317,7 @@ public class MultinetworkPolicyTracker {
         mContext.getSystemService(TelephonyManager.class).registerTelephonyCallback(
                 handlerExecutor, new ActiveDataSubscriptionIdListener());
 
-        if (mAvoidBadWifiFromCarrierConfigFeature) {
+        if (mCarrierConfigManager != null) {
             mCarrierConfigManager.registerCarrierConfigChangeListener(
                     BackgroundThread.getExecutor(), mCarrierConfigChangeListener
             );
@@ -325,7 +338,7 @@ public class MultinetworkPolicyTracker {
         mResolver.unregisterContentObserver(mSettingObserver);
 
         mContext.unregisterReceiver(mBroadcastReceiver);
-        if (mAvoidBadWifiFromCarrierConfigFeature) {
+        if (mCarrierConfigManager != null) {
             mCarrierConfigManager.unregisterCarrierConfigChangeListener(
                     mCarrierConfigChangeListener
             );
@@ -462,18 +475,6 @@ public class MultinetworkPolicyTracker {
         }
     }
 
-    /**
-     * Determines the source of the avoid bad Wi-Fi setting.
-     * It returns FROM_CARRIER_CONFIG if the carrier config feature is enabled,
-     * otherwise it returns FROM_RESOURCE.
-     *
-     */
-    private AvoidBadWifiSource getAvoidBadWifiSource() {
-        return mAvoidBadWifiFromCarrierConfigFeature
-            ? AvoidBadWifiSource.FROM_CARRIER_CONFIG
-            : AvoidBadWifiSource.FROM_RESOURCE;
-    }
-
     /**
      * Updates the local cache of the "avoid bad Wi-Fi" setting from the carrier config
      * for a specific subscription ID.
@@ -502,8 +503,8 @@ public class MultinetworkPolicyTracker {
 
         // CarrierConfigManager#getConfigForSubId() is supported
         // only when system has FEATURE_TELEPHONY_SUBSCRIPTION
-        final boolean config = !mHasTelephonySubscription
-                || mDeps.readAvoidBadWifiFromCarrierConfig(mContext, subId);
+        final boolean config =
+                mDeps.readAvoidBadWifiFromCarrierConfig(mCarrierConfigManager, subId);
         mHandler.post(() -> updateAvoidBadWifiFromCarrierConfig(subId, config));
     }
 
@@ -528,33 +529,35 @@ public class MultinetworkPolicyTracker {
      */
     public boolean updateAvoidBadWifi() {
         final boolean prevAvoid = mAvoidBadWifi;
-        if (getAvoidBadWifiSource() == AvoidBadWifiSource.FROM_CARRIER_CONFIG) {
-            // Force update activelyPreferBadWifi since it will always be true in Android U+,
-            // and mAvoidBadWifiFromCarrierConfigFeature is a trunk stable flag
-            // that only exists in 25Q4+
-            mActivelyPreferBadWifi = true;
-
-            final String settingAvoidBadWifiStr = readAvoidBadWifiFromSettings();
-            if (settingAvoidBadWifiStr != null) {
-                mAvoidBadWifi = "1".equals(settingAvoidBadWifiStr);
-            } else {
-                // Retrieve the avoid bad Wi-Fi setting from the local cache to avoid potential
-                // issues or blocking from the IPC call getAvoidBadWifiCarrierConfigForSubId().
-                mAvoidBadWifi = readAvoidBadWifiFromCache(mActiveSubId);
-            }
-            return mAvoidBadWifi != prevAvoid;
-        } else {
-            final boolean settingAvoidBadWifi = "1".equals(readAvoidBadWifiFromSettings());
-            mAvoidBadWifi = settingAvoidBadWifi || !configRestrictsAvoidBadWifi();
-            final boolean prevActive = mActivelyPreferBadWifi;
-            final Boolean deviceConfigPreferBadWifi = deviceConfigActivelyPreferBadWifi();
-            if (null == deviceConfigPreferBadWifi) {
-                mActivelyPreferBadWifi = configActivelyPrefersBadWifi();
-            } else {
-                mActivelyPreferBadWifi = deviceConfigPreferBadWifi;
-            }
-
-            return mAvoidBadWifi != prevAvoid || mActivelyPreferBadWifi != prevActive;
+        switch (mAvoidBadWifiSource) {
+            case FROM_CARRIER_CONFIG:
+                // Force update activelyPreferBadWifi since it will always be true in Android U+,
+                // and mAvoidBadWifiFromCarrierConfigFeature is a trunk stable flag
+                // that only exists in 25Q4+
+                mActivelyPreferBadWifi = true;
+                final String settingAvoidBadWifiStr = readAvoidBadWifiFromSettings();
+                if (settingAvoidBadWifiStr != null) {
+                    mAvoidBadWifi = "1".equals(settingAvoidBadWifiStr);
+                } else {
+                    // Retrieve the avoid bad Wi-Fi setting from the local cache to avoid potential
+                    // issues or blocking from the IPC call getAvoidBadWifiCarrierConfigForSubId().
+                    mAvoidBadWifi = readAvoidBadWifiFromCache(mActiveSubId);
+                }
+                return mAvoidBadWifi != prevAvoid;
+            case FROM_RESOURCE:
+                final boolean settingAvoidBadWifi = "1".equals(readAvoidBadWifiFromSettings());
+                mAvoidBadWifi = settingAvoidBadWifi || !configRestrictsAvoidBadWifi();
+                final boolean prevActive = mActivelyPreferBadWifi;
+                final Boolean deviceConfigPreferBadWifi = deviceConfigActivelyPreferBadWifi();
+                if (null == deviceConfigPreferBadWifi) {
+                    mActivelyPreferBadWifi = configActivelyPrefersBadWifi();
+                } else {
+                    mActivelyPreferBadWifi = deviceConfigPreferBadWifi;
+                }
+                return mAvoidBadWifi != prevAvoid || mActivelyPreferBadWifi != prevActive;
+            default:
+                Log.wtf(TAG, "Unexpected avoid bad Wi-Fi source: " + mAvoidBadWifiSource);
+                return false;
         }
     }
 
diff --git a/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTest.kt b/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTest.kt
index 95a6d8c8bb..97b3c49cde 100644
--- a/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTest.kt
+++ b/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTest.kt
@@ -49,10 +49,12 @@ import org.junit.After
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertFalse
 import org.junit.Assert.assertTrue
+import org.junit.Assume.assumeTrue
 import org.junit.Before
 import org.junit.Rule
 import org.junit.Test
 import org.junit.runner.RunWith
+import org.junit.runners.Parameterized
 import org.mockito.ArgumentCaptor
 import org.mockito.ArgumentMatchers.anyInt
 import org.mockito.Mockito.any
@@ -74,6 +76,17 @@ const val HANDLER_TIMEOUT_MS = 400
 @SmallTest
 @DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.R)
 class MultinetworkPolicyTrackerTest {
+    companion object {
+        @Parameterized.Parameters
+        @JvmStatic
+        fun data(): Iterable<Any?> {
+            return mutableListOf(
+                false,
+                true
+            )
+        }
+    }
+
     // This wrapper class prevents JUnit from attempting to load unsupported system classes
     // that are present in the System Test (S/T) image, which would otherwise cause test failures.
     private class CarrierConfigChangeRunner(
@@ -97,6 +110,14 @@ class MultinetworkPolicyTrackerTest {
 
     private val featureFlags = HashSet<String>()
 
+    // Indicates where CarrierConfigManager is supported.
+    // It will be false if FEATURE_TELEPHONY_SUBSCRIPTION is not supported.
+    @Parameterized.Parameter(0)
+    @JvmField
+    var supportCarrierConfigManager: Boolean = false
+
+    var carrierConfigManager: CarrierConfigManager? = null
+
     // This will set feature flags from @FeatureFlag annotations
     // into the map before setUp() runs.
     @get:Rule
@@ -115,7 +136,6 @@ class MultinetworkPolicyTrackerTest {
     }
 
     private val telephonyManager = mock(TelephonyManager::class.java)
-    private val carrierConfigManager = mock(CarrierConfigManager::class.java)
     private val subscriptionManager = mock(SubscriptionManager::class.java).also {
         doReturn(null).`when`(it).getActiveSubscriptionInfo(anyInt())
     }
@@ -135,8 +155,6 @@ class MultinetworkPolicyTrackerTest {
         }
         doReturn(subscriptionManager).`when`(it)
             .getSystemService(Context.TELEPHONY_SUBSCRIPTION_SERVICE)
-        doReturn(carrierConfigManager).`when`(it)
-            .getSystemService(CarrierConfigManager::class.java)
         doReturn(resolver).`when`(it).contentResolver
         doReturn(resources).`when`(it).resources
         doReturn(it).`when`(it).createConfigurationContext(any())
@@ -206,6 +224,15 @@ class MultinetworkPolicyTrackerTest {
             featureFlags.contains(FLAG_AVOID_BAD_WIFI_FROM_CARRIER_CONFIG)
         )
 
+        if (supportCarrierConfigManager) {
+            carrierConfigManager = mock(CarrierConfigManager::class.java)
+        } else {
+            carrierConfigManager = null
+        }
+
+        doReturn(carrierConfigManager).`when`(context)
+            .getSystemService(CarrierConfigManager::class.java)
+
         trackerDependencies.setBackgroundThreadHandler(bgHandler)
         tracker = MultinetworkPolicyTracker(
             context,
@@ -326,6 +353,11 @@ class MultinetworkPolicyTrackerTest {
     @FeatureFlag(name = FLAG_AVOID_BAD_WIFI_FROM_CARRIER_CONFIG, true)
     @DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.BAKLAVA)
     fun testUpdateAvoidBadWifiOnCarrierConfigChange() {
+        assumeTrue(
+            "skip test if carrierConfigManager is not supported",
+            supportCarrierConfigManager
+        )
+
         // Mock the initial global setting to null
         Settings.Global.putString(resolver, NETWORK_AVOID_BAD_WIFI, null)
 
@@ -346,7 +378,7 @@ class MultinetworkPolicyTrackerTest {
         // Mock the initial carrier configuration to return false
         trackerDependencies.setAvoidBadWifiCarrierConfigForSubId(activeSubId, false)
         verify(carrierConfigManager, times(1))
-            .registerCarrierConfigChangeListener(any(), carrierConfiglistenCaptor.capture())
+            ?.registerCarrierConfigChangeListener(any(), carrierConfiglistenCaptor.capture())
 
         val carrierConfiglistener = carrierConfiglistenCaptor.value
         // dispatch for the first carrier config initialization on the handler thread
diff --git a/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTestDependencies.kt b/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTestDependencies.kt
index 7285cbe32b..0103fd906e 100644
--- a/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTestDependencies.kt
+++ b/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTestDependencies.kt
@@ -1,11 +1,11 @@
 package com.android.server.connectivity
 
-import android.content.Context
 import android.content.res.Resources
 import android.os.Handler
 import android.provider.DeviceConfig
 import android.provider.DeviceConfig.NAMESPACE_CONNECTIVITY
 import android.provider.DeviceConfig.OnPropertiesChangedListener
+import android.telephony.CarrierConfigManager
 import com.android.internal.annotations.GuardedBy
 import com.android.internal.os.BackgroundThread
 import com.android.server.connectivity.MultinetworkPolicyTracker.CONFIG_ACTIVELY_PREFER_BAD_WIFI
@@ -72,7 +72,7 @@ class MultinetworkPolicyTrackerTestDependencies(
         resources
 
     override fun readAvoidBadWifiFromCarrierConfig(
-        context: Context,
+        ccm: CarrierConfigManager,
         subId: Int
     ): Boolean =
         avoidBadWifiCarrierConfigForSubIdMap.getOrDefault(subId, true)

From 3556c3d7b1b509b25042975d5dcf8eb4cfc3b76c Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Wed, 21 May 2025 14:12:31 -0700
Subject: [PATCH 285/377] Ensure requestTetheredInterface() is processed before
 proceeding

requestTetheredInterface() only returns a callback if an interface for
tethering is available. The previous code timed out after 500ms which
was not enough for some devices. Instead of increasing the timeout, this
change calls setEthernetEnabled() which triggers a callback as soon as
it was processed on the handler thread. Since this event is guaranteed
to be processed after requestTetheredInterface(), the subsequent
expectOnAvailable() does not have to wait at all.

Test: TH
Flag: EXEMPT test
Bug: 418151132
Change-Id: Iff119a8e425d4071bf63fe92815061c7eb36848a
---
 tests/cts/net/src/android/net/cts/EthernetManagerTest.kt | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/tests/cts/net/src/android/net/cts/EthernetManagerTest.kt b/tests/cts/net/src/android/net/cts/EthernetManagerTest.kt
index a2d58ebf60..2e5ea8b1dd 100644
--- a/tests/cts/net/src/android/net/cts/EthernetManagerTest.kt
+++ b/tests/cts/net/src/android/net/cts/EthernetManagerTest.kt
@@ -618,7 +618,12 @@ class EthernetManagerTest {
         // see aosp/2123900.
         try {
             // assumeException does not exist.
-            requestTetheredInterface().expectOnAvailable(NO_CALLBACK_TIMEOUT_MS)
+            val listener = requestTetheredInterface()
+            // Force requestTetheredInterface() to be processed before proceeding by calling
+            // setEthernetEnabled() which always waits on a callback and is guaranteed to be
+            // processed after requestTetheredInterface().
+            setEthernetEnabled(ethernetEnabled)
+            listener.expectOnAvailable(0)
             // interface used for tethering is available, throw an assumption error.
             assumeTrue(false)
         } catch (e: TimeoutException) {

From f69a211d6ffe5454d2c886224462187001d16eb1 Mon Sep 17 00:00:00 2001
From: Diego Valenzuela <dvalenzuela@google.com>
Date: Wed, 21 May 2025 12:47:06 -0700
Subject: [PATCH 286/377] Integrate a fix to better detect local wifi networks
 for mDNS.

Changes:
 - Use setIncludeOtherUidNetworks(true) to match networks created via WifiNetworkSpecifier (local only hotsposts for other networks - Android Auto Projected).
 - Fallback to ConnectivityManager::getAllNetworks and ConnectivityManager::getLinkProperties
  - If S is not supported in the same way, to catch networks created with WifiNetworkSpecifier by another application.
 - Subscribe to WiFiManager::NETWORK_STATE_CHANGED_ACTION event when not using setIncludeOtherUidNetworks to make sure
   that network changes are being noticed even when the ConnectivityManager::NetworkCallback is not enough.

This is not used in platform code. This code path is only used when the
mDNS stack is used as a library.

Bug: 419329782

Flag: EXEMPT dead code in the platform
Test: - Use a pre-S device to test.
 - Test with the updated library and integration with Cast sample to test.
Change-Id: I82c4cd1923a3fb77468ed0cd609996bcce3d09bc
---
 ...ctivityMonitorWithConnectivityManager.java | 57 +++++++++++++++++--
 1 file changed, 53 insertions(+), 4 deletions(-)

diff --git a/service-t/src/com/android/server/connectivity/mdns/ConnectivityMonitorWithConnectivityManager.java b/service-t/src/com/android/server/connectivity/mdns/ConnectivityMonitorWithConnectivityManager.java
index 40be3d92f2..0f5dc7e10a 100644
--- a/service-t/src/com/android/server/connectivity/mdns/ConnectivityMonitorWithConnectivityManager.java
+++ b/service-t/src/com/android/server/connectivity/mdns/ConnectivityMonitorWithConnectivityManager.java
@@ -16,6 +16,9 @@
 
 package com.android.server.connectivity.mdns;
 
+import android.content.BroadcastReceiver;
+import android.content.Intent;
+import android.content.IntentFilter;
 import android.annotation.NonNull;
 import android.annotation.Nullable;
 import android.annotation.TargetApi;
@@ -25,6 +28,7 @@ import android.net.LinkProperties;
 import android.net.Network;
 import android.net.NetworkCapabilities;
 import android.net.NetworkRequest;
+import android.net.wifi.WifiManager;
 import android.os.Build;
 import android.util.ArrayMap;
 import android.util.Pair;
@@ -37,7 +41,9 @@ import com.android.net.module.util.SharedLog;
 import java.net.Inet6Address;
 import java.net.InetAddress;
 import java.net.NetworkInterface;
+import java.util.HashSet;
 import java.util.List;
+import java.util.Set;
 import java.util.function.Predicate;
 
 /** Class for monitoring connectivity changes using {@link ConnectivityManager}. */
@@ -47,6 +53,16 @@ public class ConnectivityMonitorWithConnectivityManager implements ConnectivityM
     private final Listener listener;
     private final ConnectivityManager.NetworkCallback networkCallback;
     private final ConnectivityManager connectivityManager;
+    private final Context context;
+    private final boolean supportsIncludeOtherUidNetworks =
+        Build.VERSION.SDK_INT >= Build.VERSION_CODES.S;
+    private final BroadcastReceiver networkChangedReceiver =
+        new BroadcastReceiver() {
+            @Override
+            public void onReceive(Context context, Intent intent) {
+                notifyConnectivityChange();
+            }
+        };
     @GuardedBy("knownNetworks")
     private final ArrayMap<Network, LinkProperties> knownNetworks = new ArrayMap<>();
     // TODO(b/71901993): Ideally we shouldn't need this flag. However we still don't have clues why
@@ -60,6 +76,7 @@ public class ConnectivityMonitorWithConnectivityManager implements ConnectivityM
             SharedLog sharedLog) {
         this.listener = listener;
         this.sharedLog = sharedLog;
+        this.context = context;
 
         connectivityManager =
                 (ConnectivityManager) context.getSystemService(Context.CONNECTIVITY_SERVICE);
@@ -114,10 +131,21 @@ public class ConnectivityMonitorWithConnectivityManager implements ConnectivityM
             return;
         }
 
-        connectivityManager.registerNetworkCallback(
-                new NetworkRequest.Builder().addTransportType(
-                        NetworkCapabilities.TRANSPORT_WIFI).build(),
-                networkCallback);
+        final NetworkRequest.Builder builder =
+            new NetworkRequest.Builder().addTransportType(NetworkCapabilities.TRANSPORT_WIFI);
+        if (supportsIncludeOtherUidNetworks) {
+            builder.setIncludeOtherUidNetworks(true);
+        }
+        connectivityManager.registerNetworkCallback(builder.build(), networkCallback);
+
+        if (!supportsIncludeOtherUidNetworks) {
+            // Since networks created via ConnectivityManager#requestNetwork with a
+            // WifiNetworkSpecifier cannot be obtained via callbacks before S due to the lack of
+            // setIncludeOtherUidNetworks, register a Wi-Fi BroadcastReceiver to ensure network
+            // state is updated.
+            context.registerReceiver(
+                networkChangedReceiver, new IntentFilter(WifiManager.NETWORK_STATE_CHANGED_ACTION));
+        }
         isCallbackRegistered = true;
     }
 
@@ -131,6 +159,9 @@ public class ConnectivityMonitorWithConnectivityManager implements ConnectivityM
         }
 
         connectivityManager.unregisterNetworkCallback(networkCallback);
+        if (!supportsIncludeOtherUidNetworks) {
+            context.unregisterReceiver(networkChangedReceiver);
+        }
         synchronized (knownNetworks) {
             knownNetworks.clear();
         }
@@ -203,6 +234,7 @@ public class ConnectivityMonitorWithConnectivityManager implements ConnectivityM
 
     private Pair<Network, LinkProperties> findMatchingNetwork(
             @NonNull Predicate<LinkProperties> predicate) {
+        final Set<Network> testedNetworks;
         synchronized (knownNetworks) {
             for (int i = 0; i < knownNetworks.size(); i++) {
                 final LinkProperties lp = knownNetworks.valueAt(i);
@@ -212,6 +244,23 @@ public class ConnectivityMonitorWithConnectivityManager implements ConnectivityM
                     return new Pair<>(knownNetworks.keyAt(i), knownNetworks.valueAt(i));
                 }
             }
+            testedNetworks = new HashSet<>(knownNetworks.keySet());
+        }
+        if (!supportsIncludeOtherUidNetworks) {
+            // Before S setIncludeOtherUidNetworks cannot be set on the NetworkRequest, so it
+            // will not match networks brought up by apps via networkRequest with a
+            // WifiNetworkSpecifier (which have uids set in their NetworkCapabilities on S+, or
+            // requestor UID set on R-).
+            // Fall back to synchronous methods if no matching network could be found.
+            for (Network network : connectivityManager.getAllNetworks()) {
+                if (testedNetworks.contains(network)) {
+                    continue;
+                }
+                final LinkProperties lp = connectivityManager.getLinkProperties(network);
+                if (lp != null && predicate.test(lp)) {
+                    return new Pair<>(network, lp);
+                }
+            }
         }
         return null;
     }

From aceedde4a1b88fedfa37b9bfba64093ba4b32ff9 Mon Sep 17 00:00:00 2001
From: Yuyang Huang <yuyanghuang@google.com>
Date: Thu, 22 May 2025 12:45:39 +0900
Subject: [PATCH 287/377] Skip APF enforcement check on Wear OS for 25Q2
 devices.

This commit adjusts the APF enforcement logic to align with 25Q2 GMS-VSR
and GTVS requirements. APFv6 is currently applicable only to handheld
and tablet devices (GMS-VSR) and TV devices (GTVS). For Wear OS devices,
APF enforcement will commence with Wear OS 7; therefore, the APF
enforcement check is skipped for devices launched/upgraded on Wear OS in 25Q2.

Bug: 381819368
Test: TH
Flag: EXEMPT bugfix
Change-Id: I4224738d9658fb4f6b67e491e7cd7d78e9b48748
---
 .../src/android/net/cts/ApfIntegrationTest.kt | 22 +++++++++----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt b/tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt
index 58dedc2ad3..a731e31932 100644
--- a/tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt
+++ b/tests/cts/net/src/android/net/cts/ApfIntegrationTest.kt
@@ -86,10 +86,10 @@ import com.android.testutils.DevSdkIgnoreRule
 import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
 import com.android.testutils.DevSdkIgnoreRunner
 import com.android.testutils.NetworkStackModuleTest
-import com.android.testutils.TestableNetworkCallback.Event.Available
-import com.android.testutils.TestableNetworkCallback.Event.LinkPropertiesChanged
 import com.android.testutils.SkipPresubmit
 import com.android.testutils.TestableNetworkCallback
+import com.android.testutils.TestableNetworkCallback.Event.Available
+import com.android.testutils.TestableNetworkCallback.Event.LinkPropertiesChanged
 import com.android.testutils.pollingCheck
 import com.android.testutils.runAsShell
 import com.android.testutils.waitForIdle
@@ -110,6 +110,7 @@ import kotlin.test.assertNotNull
 import org.junit.After
 import org.junit.AfterClass
 import org.junit.Assume.assumeFalse
+import org.junit.Assume.assumeTrue
 import org.junit.Before
 import org.junit.BeforeClass
 import org.junit.Rule
@@ -395,12 +396,15 @@ class ApfIntegrationTest {
         }
     }
 
-    private fun shouldEnforceApfV6Support(vsrApiLevel: Int): Boolean {
+    private fun shouldEnforceApfSupport(vsrApiLevel: Int): Boolean {
+        // Note: GMS-VSR requirements related to APFv4/APFv6 are only applicable to handheld
+        // and tablet devices. GTVS requirements related to APFv6 are only applicable to TV devices.
+        // For Wear OS devices, APFv4/APFv6 will not be enforced until Wear OS 7.
         if (pm.hasSystemFeature(FEATURE_WATCH)) {
-            // Enforce APFv6 post VSR-16.
+            // Enforce APF on watch post VSR-16.
             return vsrApiLevel > 202504
         }
-        return vsrApiLevel >= 202504
+        return vsrApiLevel >= 34
     }
 
     @VsrTest(
@@ -413,7 +417,7 @@ class ApfIntegrationTest {
         assertThat(caps.apfVersionSupported).isAnyOf(0, 2, 3, 4, 6000, 6100)
         // APF became mandatory in Android 14 VSR.
         val vsrApiLevel = getVsrApiLevel()
-        assume().that(vsrApiLevel).isAtLeast(34)
+        assumeTrue(shouldEnforceApfSupport(vsrApiLevel))
 
         // DEVICEs launching with Android 14 with CHIPSETs that set ro.board.first_api_level to 34:
         // - [GMS-VSR-5.3.12-003] MUST return 4 or higher as the APF version number from calls to
@@ -446,11 +450,7 @@ class ApfIntegrationTest {
         // - Note, the APF RAM requirement for APF version 6.1 will become 4000 bytes in Android 17
         //   with CHIPSETs that set ro.board.first_api_level or ro.board.api_level to 202604 or
         //   higher.
-        // Note: At 25Q2, GMS-VSR requirements related to APFv6 are only applicable to handheld
-        // and tablet devices. GTVS requirements related to APFv6 are only applicable to TV devices.
-        // For Wear OS devices, APFv6 will not be enforced until specific requirements for Wear OS
-        // are officially incorporated.
-        if (shouldEnforceApfV6Support(vsrApiLevel)) {
+        if (vsrApiLevel >= 202504) {
             assertThat(caps.apfVersionSupported).isAnyOf(6000, 6100)
             if (caps.apfVersionSupported == 6000) {
                 assertThat(caps.maximumApfProgramSize).isAtLeast(4000)

From 99bf60dee551679ecfaf2eae4e295e3498333a78 Mon Sep 17 00:00:00 2001
From: Jimi Chen <jimictw@google.com>
Date: Thu, 22 May 2025 08:04:04 +0000
Subject: [PATCH 288/377] Use lisOf in parameterized test parameters

Flag: EXEMPT mainline
Bug: 410976315
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.connectivity.MultinetworkPolicyTrackerTest
Change-Id: Ib3fef2982b50ac0642da9bca46123651f8e0a228
---
 .../server/connectivity/MultinetworkPolicyTrackerTest.kt   | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTest.kt b/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTest.kt
index 97b3c49cde..90e8beb720 100644
--- a/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTest.kt
+++ b/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTest.kt
@@ -79,12 +79,7 @@ class MultinetworkPolicyTrackerTest {
     companion object {
         @Parameterized.Parameters
         @JvmStatic
-        fun data(): Iterable<Any?> {
-            return mutableListOf(
-                false,
-                true
-            )
-        }
+        fun data() = listOf(false, true)
     }
 
     // This wrapper class prevents JUnit from attempting to load unsupported system classes

From e8cba91fd5a52d125333bb12fa637f99778e6682 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Thu, 22 May 2025 02:01:32 -0700
Subject: [PATCH 289/377] Delete old BPF compat tests for previous SDKs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

R & V+ never needed this as there is no platform
loading of mainline bpf.

On T/U we've been loading via mainline NetBpfLoad
for the past year, so the struct sizes only actually
matter for S.

S switches to mainline NetBpfLoad in M-2025-05
(currently in small canary), at which point the
struct sizes stop mattering.

In M-2025-07 S/T/U still look at the 'min bpf loader'
section of the .o, but don't go any deeper.

In M-2025-08 we no longer ship any bpf .o
files that need to be parsed by platform
bpfloader (as they're in a different subdirectory
in the tethering apex they don't even look in).

Test: TreeHugger
Flag: EXEMPT test deletion
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I72b9ebcf4ea59e61cdfd8bb009ede13670e3421f
---
 tests/cts/net/native/Android.bp            | 61 ---------------------
 tests/cts/net/native/AndroidTest.xml       | 32 -----------
 tests/cts/net/native/src/BpfCompatTest.cpp | 62 ----------------------
 3 files changed, 155 deletions(-)
 delete mode 100644 tests/cts/net/native/Android.bp
 delete mode 100644 tests/cts/net/native/AndroidTest.xml
 delete mode 100644 tests/cts/net/native/src/BpfCompatTest.cpp

diff --git a/tests/cts/net/native/Android.bp b/tests/cts/net/native/Android.bp
deleted file mode 100644
index 3f2459278c..0000000000
--- a/tests/cts/net/native/Android.bp
+++ /dev/null
@@ -1,61 +0,0 @@
-// Copyright (C) 2017 The Android Open Source Project
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// Build the unit tests.
-
-package {
-    default_team: "trendy_team_fwk_core_networking",
-    default_applicable_licenses: ["Android-Apache-2.0"],
-}
-
-cc_test {
-    name: "CtsNativeNetTestCases",
-
-    compile_multilib: "both",
-    multilib: {
-        lib32: {
-            suffix: "32",
-        },
-        lib64: {
-            suffix: "64",
-        },
-    },
-
-    srcs: [
-        "src/BpfCompatTest.cpp",
-    ],
-
-    shared_libs: [
-        "libbase",
-        "liblog",
-    ],
-
-    static_libs: [
-        "libbpf_android",
-        "libgtest",
-        "libmodules-utils-build",
-    ],
-
-    // Tag this module as a cts test artifact
-    test_suites: [
-        "cts",
-        "general-tests",
-    ],
-
-    cflags: [
-        "-Werror",
-        "-Wall",
-    ],
-
-}
diff --git a/tests/cts/net/native/AndroidTest.xml b/tests/cts/net/native/AndroidTest.xml
deleted file mode 100644
index 70d788a34a..0000000000
--- a/tests/cts/net/native/AndroidTest.xml
+++ /dev/null
@@ -1,32 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Copyright 2017 The Android Open Source Project
-
-     Licensed under the Apache License, Version 2.0 (the "License");
-     you may not use this file except in compliance with the License.
-     You may obtain a copy of the License at
-
-          http://www.apache.org/licenses/LICENSE-2.0
-
-     Unless required by applicable law or agreed to in writing, software
-     distributed under the License is distributed on an "AS IS" BASIS,
-     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-     See the License for the specific language governing permissions and
-     limitations under the License.
--->
-<configuration description="Config for CTS Native Network test cases">
-    <option name="test-suite-tag" value="cts" />
-    <option name="config-descriptor:metadata" key="component" value="networking" />
-    <option name="config-descriptor:metadata" key="parameter" value="instant_app" />
-    <option name="config-descriptor:metadata" key="parameter" value="multi_abi" />
-    <option name="config-descriptor:metadata" key="parameter" value="secondary_user" />
-    <target_preparer class="com.android.compatibility.common.tradefed.targetprep.FilePusher">
-        <option name="cleanup" value="true" />
-        <option name="push" value="CtsNativeNetTestCases->/data/local/tmp/CtsNativeNetTestCases" />
-        <option name="append-bitness" value="true" />
-    </target_preparer>
-    <test class="com.android.tradefed.testtype.GTest" >
-        <option name="native-test-device-path" value="/data/local/tmp" />
-        <option name="module-name" value="CtsNativeNetTestCases" />
-        <option name="runtime-hint" value="1m" />
-    </test>
-</configuration>
diff --git a/tests/cts/net/native/src/BpfCompatTest.cpp b/tests/cts/net/native/src/BpfCompatTest.cpp
deleted file mode 100644
index e2fdd3d6ac..0000000000
--- a/tests/cts/net/native/src/BpfCompatTest.cpp
+++ /dev/null
@@ -1,62 +0,0 @@
-/*
- * Copyright (C) 2021 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless requied by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- */
-
-#define LOG_TAG "BpfCompatTest"
-
-#include <fstream>
-
-#include <gtest/gtest.h>
-
-#include "android-modules-utils/sdk_level.h"
-
-#include "libbpf_android.h"
-
-using namespace android::bpf;
-
-void doBpfStructSizeTest(const char *elfPath, unsigned mapSz, unsigned progSz) {
-  std::ifstream elfFile(elfPath, std::ios::in | std::ios::binary);
-  ASSERT_TRUE(elfFile.is_open());
-
-  EXPECT_EQ(mapSz, readSectionUint("size_of_bpf_map_def", elfFile, 0));
-  EXPECT_EQ(progSz, readSectionUint("size_of_bpf_prog_def", elfFile, 0));
-}
-
-TEST(BpfTest, bpfStructSizeTest) {
-  if (android::modules::sdklevel::IsAtLeastV()) {
-    // Due to V+ using mainline netbpfload, there is no longer a need to
-    // enforce consistency between platform and mainline bpf .o files.
-    GTEST_SKIP() << "V+ device.";
-  } else if (android::modules::sdklevel::IsAtLeastU()) {
-    doBpfStructSizeTest("/system/etc/bpf/gpuMem.o", 120, 92);
-    doBpfStructSizeTest("/system/etc/bpf/timeInState.o", 120, 92);
-  } else if (android::modules::sdklevel::IsAtLeastT()) {
-    doBpfStructSizeTest("/system/etc/bpf/gpu_mem.o", 116, 92);
-    doBpfStructSizeTest("/system/etc/bpf/time_in_state.o", 116, 92);
-  } else if (android::modules::sdklevel::IsAtLeastS()) {
-    // These files were moved to mainline in Android T
-    doBpfStructSizeTest("/system/etc/bpf/netd.o", 48, 28);
-    doBpfStructSizeTest("/system/etc/bpf/clatd.o", 48, 28);
-  } else {
-    // There is no mainline bpf code before S.
-    GTEST_SKIP() << "R- device.";
-  }
-}
-
-int main(int argc, char **argv) {
-  testing::InitGoogleTest(&argc, argv);
-  return RUN_ALL_TESTS();
-}

From 49c3c92a4424c17c7a8dd1f9ba0be515ff5822a3 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Wed, 21 May 2025 14:16:38 -0700
Subject: [PATCH 290/377] Assumption check should not affect ethernet enabled
 state

setEthernetEnabled() is used as a synchronization mechanism, so don't
let it affect enabled state.

Test: TH
Flag: EXEMPT test
Bug: 10000001
Change-Id: Ib023b7f944a8a84435dcc546aced9b0eab96d364
---
 tests/cts/net/src/android/net/cts/EthernetManagerTest.kt | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/cts/net/src/android/net/cts/EthernetManagerTest.kt b/tests/cts/net/src/android/net/cts/EthernetManagerTest.kt
index 2e5ea8b1dd..9f3781b5c0 100644
--- a/tests/cts/net/src/android/net/cts/EthernetManagerTest.kt
+++ b/tests/cts/net/src/android/net/cts/EthernetManagerTest.kt
@@ -631,8 +631,8 @@ class EthernetManagerTest {
             // tethering.
             releaseTetheredInterface()
             // Force releaseTetheredInterface() to be processed before proceeding by calling
-            // setEthernetEnabled(true) which always waits on a callback.
-            setEthernetEnabled(true)
+            // setEthernetEnabled() which always waits on a callback.
+            setEthernetEnabled(ethernetEnabled)
         }
     }
 

From cd7f3bffd6e683829ae4768fcfc4efe6c6d64abf Mon Sep 17 00:00:00 2001
From: Elliott Hughes <enh@google.com>
Date: Thu, 22 May 2025 16:37:33 -0400
Subject: [PATCH 291/377] Fix C++23 build: add missing #include.

Change-Id: I781654e989d609df375cdbe4fa4c2175c551e84d
---
 bpf/loader/NetBpfLoad.cpp | 1 +
 1 file changed, 1 insertion(+)

diff --git a/bpf/loader/NetBpfLoad.cpp b/bpf/loader/NetBpfLoad.cpp
index e5d3507a45..8bf10e5617 100644
--- a/bpf/loader/NetBpfLoad.cpp
+++ b/bpf/loader/NetBpfLoad.cpp
@@ -16,6 +16,7 @@
 
 #define LOG_TAG "NetBpfLoad"
 
+#include <algorithm>
 #include <arpa/inet.h>
 #include <bpf/btf.h>
 #include <bpf/libbpf.h>

From f90e9d0006d079a00cee928439665485a97e5f71 Mon Sep 17 00:00:00 2001
From: Sewook Seo <sewookseo@google.com>
Date: Wed, 14 May 2025 22:03:53 +0000
Subject: [PATCH 292/377] Add version control to CTS for QosFilter API
 extension

Bug: 417516321
Flag: EXEMPT bug-fix
Test: atest android.net.cts.NetworkAgentTest
Change-Id: Iacc59f3be5bfc3fdb607d2266b241f48fb14d55b
---
 .../src/android/net/cts/NetworkAgentTest.kt   | 35 ++++++++++---------
 1 file changed, 19 insertions(+), 16 deletions(-)

diff --git a/tests/cts/net/src/android/net/cts/NetworkAgentTest.kt b/tests/cts/net/src/android/net/cts/NetworkAgentTest.kt
index 52bd0c7d91..0fc8ab723a 100644
--- a/tests/cts/net/src/android/net/cts/NetworkAgentTest.kt
+++ b/tests/cts/net/src/android/net/cts/NetworkAgentTest.kt
@@ -1392,22 +1392,25 @@ class NetworkAgentTest {
                 agent.expectCallback<OnRegisterQosCallback>().let {
                     callbackId = it.callbackId
                     assertTrue(it.filter.matchesProtocol(proto))
-                    // This test is only validating QosFilter address match APIs can be called.
-                    // Detail functionality checks are executed on QosSocketFilterTest.
-                    // Verify the match of test socket's Local address, currently the test socket
-                    // binds to the loopback address.
-                    assertTrue(it.filter.matchesLocalPrefix(
-                        IpPrefix(InetAddress.getLoopbackAddress(), 128),
-                        0,
-                        65535
-                    ))
-                    // Since the test socket doesn't connect to the remote address, we expect
-                    // unmatched result.
-                    assertFalse(it.filter.matchesRemotePrefix(
-                        IpPrefix(InetAddress.getLoopbackAddress(), 128),
-                        0,
-                        65535
-                    ))
+                    if (Build.VERSION.SDK_INT_FULL > Build.VERSION_CODES_FULL.BAKLAVA) {
+                        // Available from SDK version 36.1 (25Q4)
+                        // This test is only validating QosFilter address match APIs can be called.
+                        // Detail functionality checks are executed on QosSocketFilterTest.
+                        // Verify the match of test socket's Local address, currently the test
+                        // socket binds to the loopback address.
+                        assertTrue(it.filter.matchesLocalPrefix(
+                            IpPrefix(InetAddress.getLoopbackAddress(), 128),
+                            0,
+                            65535
+                        ))
+                        // Since the test socket doesn't connect to the remote address, we expect
+                        // unmatched result.
+                        assertFalse(it.filter.matchesRemotePrefix(
+                            IpPrefix(InetAddress.getLoopbackAddress(), 128),
+                            0,
+                            65535
+                        ))
+                    }
                 }
 
                 assertFailsWith<QosCallbackRegistrationException>(

From 8f8c78d56f843fc054ee0555a01084b456fe5fe9 Mon Sep 17 00:00:00 2001
From: Handa Wang <handaw@google.com>
Date: Thu, 22 May 2025 21:38:55 -0700
Subject: [PATCH 293/377] Truncate the additional records if the packet is too
 large

When the packet is too large to be sent it may cause the socket to throw
an error. This commit truncates the additional records in this case.

Bug: 407609792
Test: CI
Flag: EXEMPT bugfix

Change-Id: I77a979d7f8799f05cbcb14857061a18aecfef657
---
 .../connectivity/mdns/MdnsPacketWriter.java   |  5 +-
 .../connectivity/mdns/MdnsReplySender.java    | 37 ++++++++++-
 .../connectivity/mdns/MdnsReplySenderTest.kt  | 64 +++++++++++++++++++
 3 files changed, 103 insertions(+), 3 deletions(-)

diff --git a/service-t/src/com/android/server/connectivity/mdns/MdnsPacketWriter.java b/service-t/src/com/android/server/connectivity/mdns/MdnsPacketWriter.java
index cf788be0d1..1d227adc8d 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MdnsPacketWriter.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MdnsPacketWriter.java
@@ -19,6 +19,7 @@ package com.android.server.connectivity.mdns;
 import com.android.net.module.util.DnsUtils;
 import com.android.server.connectivity.mdns.MdnsServiceInfo.TextEntry;
 
+import java.io.EOFException;
 import java.io.IOException;
 import java.net.DatagramPacket;
 import java.net.SocketAddress;
@@ -241,9 +242,9 @@ public class MdnsPacketWriter {
     }
 
     // Checks if the remaining space in the packet is at least |count|.
-    private void checkRemaining(int count) throws IOException {
+    private void checkRemaining(int count) throws EOFException {
         if (getRemaining() < count) {
-            throw new IOException();
+            throw new EOFException();
         }
     }
 
diff --git a/service-t/src/com/android/server/connectivity/mdns/MdnsReplySender.java b/service-t/src/com/android/server/connectivity/mdns/MdnsReplySender.java
index 4708cb62ac..f41d6be8d2 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MdnsReplySender.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MdnsReplySender.java
@@ -33,6 +33,7 @@ import com.android.internal.annotations.VisibleForTesting;
 import com.android.net.module.util.SharedLog;
 import com.android.server.connectivity.mdns.util.MdnsUtils;
 
+import java.io.EOFException;
 import java.io.IOException;
 import java.net.DatagramPacket;
 import java.net.Inet4Address;
@@ -100,6 +101,14 @@ public class MdnsReplySender {
         public void removeMessages(@NonNull Handler handler, int what, @NonNull Object object) {
             handler.removeMessages(what, object);
         }
+
+        /**
+         * @see MdnsUtils#createRawDnsPacket(byte[], MdnsPacket)
+         */
+        public byte[] createRawDnsPacket(@NonNull byte[] buffer, @NonNull MdnsPacket packet)
+                throws IOException {
+            return MdnsUtils.createRawDnsPacket(buffer, packet);
+        }
     }
 
     public MdnsReplySender(@NonNull Looper looper, @NonNull MdnsInterfaceSocket socket,
@@ -210,11 +219,37 @@ public class MdnsReplySender {
             // Skip sending if the socket has not joined the v4/v6 group (there was no address)
             return PACKET_NOT_SENT;
         }
-        final byte[] outBuffer = MdnsUtils.createRawDnsPacket(mPacketCreationBuffer, packet);
+        final byte[] outBuffer = createRawDnsPacket(packet);
         mSocket.send(new DatagramPacket(outBuffer, 0, outBuffer.length, destination));
         return PACKET_SENT;
     }
 
+    private byte[] createRawDnsPacket(MdnsPacket packet)
+            throws IOException {
+        try {
+            return mDependencies.createRawDnsPacket(mPacketCreationBuffer, packet);
+        } catch (EOFException e) {
+            // Try truncating the additional records if the packet is too large.
+            final MdnsPacket packetWithoutAdditionalRecords =
+                    new MdnsPacket(
+                            packet.transactionId,
+                            packet.flags,
+                            packet.questions,
+                            packet.answers,
+                            packet.authorityRecords,
+                            Collections.emptyList() /* additionalRecords */);
+            final byte[] outBuffer =
+                    mDependencies.createRawDnsPacket(
+                            mPacketCreationBuffer, packetWithoutAdditionalRecords);
+            // TODO: The packet may still be too large after truncating the additional records. We
+            // may need to further optimize this.
+            mSharedLog.e(
+                    "The message is too large to fit in a single packet. The additional records are"
+                            + " not included.");
+            return outBuffer;
+        }
+    }
+
     /**
      * Cancel all pending sends.
      */
diff --git a/tests/unit/java/com/android/server/connectivity/mdns/MdnsReplySenderTest.kt b/tests/unit/java/com/android/server/connectivity/mdns/MdnsReplySenderTest.kt
index 9bd0530108..53e5e28eb2 100644
--- a/tests/unit/java/com/android/server/connectivity/mdns/MdnsReplySenderTest.kt
+++ b/tests/unit/java/com/android/server/connectivity/mdns/MdnsReplySenderTest.kt
@@ -28,11 +28,13 @@ import com.android.server.connectivity.mdns.MdnsConstants.IPV6_SOCKET_ADDR
 import com.android.server.connectivity.mdns.MdnsReplySender.getReplyDestination
 import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
 import com.android.testutils.DevSdkIgnoreRunner
+import java.io.IOException
 import java.net.DatagramPacket
 import java.net.InetSocketAddress
 import java.util.concurrent.CompletableFuture
 import java.util.concurrent.TimeUnit
 import kotlin.test.assertEquals
+import kotlin.test.assertFailsWith
 import org.junit.After
 import org.junit.Before
 import org.junit.Test
@@ -41,9 +43,12 @@ import org.mockito.ArgumentCaptor
 import org.mockito.Mockito.any
 import org.mockito.Mockito.anyLong
 import org.mockito.Mockito.argThat
+import org.mockito.Mockito.doCallRealMethod
 import org.mockito.Mockito.doReturn
+import org.mockito.Mockito.doThrow
 import org.mockito.Mockito.eq
 import org.mockito.Mockito.mock
+import org.mockito.Mockito.never
 import org.mockito.Mockito.timeout
 import org.mockito.Mockito.times
 import org.mockito.Mockito.verify
@@ -107,6 +112,23 @@ class MdnsReplySenderTest {
             MdnsNsecRecord(otherHostname, 0L /* receiptTimeMillis */, true /* cacheFlush */,
                     SHORT_TTL, otherHostname /* nextDomain */,
                     intArrayOf(MdnsRecord.TYPE_A, MdnsRecord.TYPE_AAAA)))
+    private val manyServiceNames = (1..30).map {
+        arrayOf("MyTestService", "_testservice", "_tcp", "local")
+    }
+    private val manyAnswers = manyServiceNames.map {
+        MdnsPointerRecord(it, 0L /* receiptTimeMillis */, false /* cacheFlush */, LONG_TTL, it)
+    }
+    private val manyAdditionalAnswers = manyServiceNames.flatMap {
+        listOf(
+            MdnsTextRecord(it, 0L /* receiptTimeMillis */, true /* cacheFlush */, LONG_TTL,
+                    emptyList()),
+            MdnsServiceRecord(it, 0L /* receiptTimeMillis */, true /* cacheFlush */, SHORT_TTL,
+                    0 /* servicePriority */, 0 /* serviceWeight */, TEST_PORT, it),
+            MdnsNsecRecord(it, 0L /* receiptTimeMillis */, true /* cacheFlush */, LONG_TTL,
+                    it /* nextDomain */,
+                    intArrayOf(MdnsRecord.TYPE_TXT, MdnsRecord.TYPE_SRV))
+        )
+    }
     private val thread = HandlerThread(MdnsReplySenderTest::class.simpleName)
     private val socket = mock(MdnsInterfaceSocket::class.java)
     private val buffer = ByteArray(1500)
@@ -119,6 +141,7 @@ class MdnsReplySenderTest {
         thread.start()
         doReturn(true).`when`(socket).hasJoinedIpv4()
         doReturn(true).`when`(socket).hasJoinedIpv6()
+        doCallRealMethod().`when`(deps).createRawDnsPacket(any(), any())
     }
 
     @After
@@ -162,6 +185,47 @@ class MdnsReplySenderTest {
         verify(socket).send(argThat{ it.socketAddress.equals(IPV4_SOCKET_ADDR) })
     }
 
+    @Test
+    fun testSendNow_CreateRawDnsPacketThrowsGeneralIOException_PacketIsNotSent() {
+        val replySender = createSender(enableKAS = false)
+        val packet = MdnsPacket(0x8400,
+                emptyList() /* questions */,
+                answers,
+                emptyList() /* authorityRecords */,
+                additionalAnswers)
+        doThrow(IOException()).`when`(deps).createRawDnsPacket(any(), any())
+        val future = CompletableFuture<Unit>()
+        handler.post {
+            assertFailsWith<IOException> {
+                replySender.sendNow(packet, IPV4_SOCKET_ADDR)
+            }
+            future.complete(null)
+        }
+        future.get(DEFAULT_TIMEOUT_MS, TimeUnit.MILLISECONDS)
+        verify(socket, never()).send(any())
+    }
+
+    @Test
+    fun testSendNow_PacketIsTooLarge_AdditionalRecordsAreTruncated() {
+        val replySender = createSender(enableKAS = false)
+        // The datagram is 2059 bytes which exceeds the 1500 byte limit.
+        val packet = MdnsPacket(0x8400,
+                emptyList() /* questions */,
+                manyAnswers,
+                emptyList() /* authorityRecords */,
+                manyAdditionalAnswers)
+        sendNow(replySender, packet, IPV4_SOCKET_ADDR)
+        verify(socket).send(argThat{
+            val packet = MdnsPacket.parse(MdnsPacketReader(it))
+
+            packet.questions.isEmpty() &&
+            packet.answers.equals(manyAnswers) &&
+            packet.authorityRecords.isEmpty() &&
+            packet.additionalRecords.isEmpty() &&
+            it.socketAddress.equals(IPV4_SOCKET_ADDR)
+        })
+    }
+
     private fun verifyMessageQueued(
             sender: MdnsReplySender,
             replies: List<MdnsReplyInfo>

From ab696ccc1b4b5fa1121dfed110b8a9b56f9f7c98 Mon Sep 17 00:00:00 2001
From: Junyu Lai <junyulai@google.com>
Date: Thu, 22 May 2025 17:31:53 +0800
Subject: [PATCH 294/377] Fix kotlin lint errors in NetworkTemplateTests

Flag: EXEMPT Test only refactor
Test: atest ConnectivityCoverageTests --test-filter \
  'NetworkTemplate*' --update-device
Bug: 419123367
Change-Id: I7f87c4a9f4f3e40c0274bf6539ccff4e42967cc8
---
 .../net/netstats/NetworkTemplateTest.kt       | 152 +++--
 .../java/android/net/NetworkTemplateTest.kt   | 540 ++++++++++++++----
 2 files changed, 523 insertions(+), 169 deletions(-)

diff --git a/tests/common/java/android/net/netstats/NetworkTemplateTest.kt b/tests/common/java/android/net/netstats/NetworkTemplateTest.kt
index f6b655586d..808fa50240 100644
--- a/tests/common/java/android/net/netstats/NetworkTemplateTest.kt
+++ b/tests/common/java/android/net/netstats/NetworkTemplateTest.kt
@@ -66,9 +66,16 @@ class NetworkTemplateTest {
         listOf(MATCH_MOBILE, MATCH_CARRIER).forEach { matchRule ->
             NetworkTemplate.Builder(matchRule).setSubscriberIds(setOf(TEST_IMSI1))
                     .setMeteredness(METERED_YES).build().let {
-                        val expectedTemplate = NetworkTemplate(matchRule, arrayOf(TEST_IMSI1),
-                                emptyArray<String>(), METERED_YES, ROAMING_ALL, DEFAULT_NETWORK_ALL,
-                                NETWORK_TYPE_ALL, OEM_MANAGED_ALL)
+                        val expectedTemplate = NetworkTemplate(
+                                matchRule,
+                                arrayOf(TEST_IMSI1),
+                                emptyArray<String>() /*wifiNetworkKey*/,
+                                METERED_YES,
+                                ROAMING_ALL,
+                                DEFAULT_NETWORK_ALL,
+                                NETWORK_TYPE_ALL,
+                                OEM_MANAGED_ALL
+                        )
                         assertEquals(expectedTemplate, it)
                     }
         }
@@ -78,9 +85,16 @@ class NetworkTemplateTest {
         listOf(MATCH_MOBILE, MATCH_CARRIER).forEach { matchRule ->
             NetworkTemplate.Builder(matchRule).setSubscriberIds(setOf(TEST_IMSI1))
                     .setRoaming(ROAMING_YES).setMeteredness(METERED_YES).build().let {
-                        val expectedTemplate = NetworkTemplate(matchRule, arrayOf(TEST_IMSI1),
-                                emptyArray<String>(), METERED_YES, ROAMING_YES, DEFAULT_NETWORK_ALL,
-                                NETWORK_TYPE_ALL, OEM_MANAGED_ALL)
+                        val expectedTemplate = NetworkTemplate(
+                                matchRule,
+                                arrayOf(TEST_IMSI1),
+                                emptyArray<String>() /*wifiNetworkKey*/,
+                                METERED_YES,
+                                ROAMING_YES,
+                                DEFAULT_NETWORK_ALL,
+                                NETWORK_TYPE_ALL,
+                                OEM_MANAGED_ALL
+                        )
                         assertEquals(expectedTemplate, it)
                     }
         }
@@ -102,14 +116,14 @@ class NetworkTemplateTest {
         } else {
             NetworkTemplate.Builder(MATCH_MOBILE).setSubscriberIds(setOf(null)).build().let {
                 val expectedTemplate = NetworkTemplate(
-                    MATCH_MOBILE,
-                    arrayOfNulls<String>(1) /*subscriberIds*/,
-                    emptyArray<String>() /*wifiNetworkKey*/,
-                    METERED_ALL,
-                    ROAMING_ALL,
-                    DEFAULT_NETWORK_ALL,
-                    NETWORK_TYPE_ALL,
-                    OEM_MANAGED_ALL
+                        MATCH_MOBILE,
+                        arrayOfNulls<String>(1) /*subscriberIds*/,
+                        emptyArray<String>() /*wifiNetworkKey*/,
+                        METERED_ALL,
+                        ROAMING_ALL,
+                        DEFAULT_NETWORK_ALL,
+                        NETWORK_TYPE_ALL,
+                        OEM_MANAGED_ALL
                 )
                 assertEquals(expectedTemplate, it)
             }
@@ -118,10 +132,16 @@ class NetworkTemplateTest {
         // Verify template which matches metered cellular networks,
         // regardless of IMSI. See buildTemplateMobileWildcard.
         NetworkTemplate.Builder(MATCH_MOBILE).setMeteredness(METERED_YES).build().let {
-            val expectedTemplate = NetworkTemplate(MATCH_MOBILE,
-                    emptyArray<String>() /*subscriberIds*/, emptyArray<String>() /*wifiNetworkKey*/,
-                    METERED_YES, ROAMING_ALL, DEFAULT_NETWORK_ALL, NETWORK_TYPE_ALL,
-                    OEM_MANAGED_ALL)
+            val expectedTemplate = NetworkTemplate(
+                    MATCH_MOBILE,
+                    emptyArray<String>() /*subscriberIds*/,
+                    emptyArray<String>() /*wifiNetworkKey*/,
+                    METERED_YES,
+                    ROAMING_ALL,
+                    DEFAULT_NETWORK_ALL,
+                    NETWORK_TYPE_ALL,
+                    OEM_MANAGED_ALL
+            )
             assertEquals(expectedTemplate, it)
         }
 
@@ -129,18 +149,32 @@ class NetworkTemplateTest {
         NetworkTemplate.Builder(MATCH_MOBILE).setSubscriberIds(setOf(TEST_IMSI1))
                 .setMeteredness(METERED_YES).setRatType(TelephonyManager.NETWORK_TYPE_UMTS)
                 .build().let {
-                    val expectedTemplate = NetworkTemplate(MATCH_MOBILE, arrayOf(TEST_IMSI1),
-                            emptyArray<String>(), METERED_YES, ROAMING_ALL, DEFAULT_NETWORK_ALL,
-                            TelephonyManager.NETWORK_TYPE_UMTS, OEM_MANAGED_ALL)
+                    val expectedTemplate = NetworkTemplate(
+                            MATCH_MOBILE,
+                            arrayOf(TEST_IMSI1),
+                            emptyArray<String>() /*wifiNetworkKey*/,
+                            METERED_YES,
+                            ROAMING_ALL,
+                            DEFAULT_NETWORK_ALL,
+                            TelephonyManager.NETWORK_TYPE_UMTS,
+                            OEM_MANAGED_ALL
+                    )
                     assertEquals(expectedTemplate, it)
                 }
 
         // Verify template which matches all wifi networks,
         // regardless of Wifi Network Key. See buildTemplateWifiWildcard and buildTemplateWifi.
         NetworkTemplate.Builder(MATCH_WIFI).build().let {
-            val expectedTemplate = NetworkTemplate(MATCH_WIFI,
-                    emptyArray<String>() /*subscriberIds*/, emptyArray<String>(), METERED_ALL,
-                    ROAMING_ALL, DEFAULT_NETWORK_ALL, NETWORK_TYPE_ALL, OEM_MANAGED_ALL)
+            val expectedTemplate = NetworkTemplate(
+                    MATCH_WIFI,
+                    emptyArray<String>() /*subscriberIds*/,
+                    emptyArray<String>() /*wifiNetworkKey*/,
+                    METERED_ALL,
+                    ROAMING_ALL,
+                    DEFAULT_NETWORK_ALL,
+                    NETWORK_TYPE_ALL,
+                    OEM_MANAGED_ALL
+            )
             assertEquals(expectedTemplate, it)
         }
 
@@ -148,9 +182,16 @@ class NetworkTemplateTest {
         // See buildTemplateWifi(wifiNetworkKey).
         NetworkTemplate.Builder(MATCH_WIFI).setWifiNetworkKeys(setOf(TEST_WIFI_KEY1)).build().let {
             val expectedTemplate =
-                    NetworkTemplate(MATCH_WIFI, emptyArray<String>() /*subscriberIds*/,
-                    arrayOf(TEST_WIFI_KEY1), METERED_ALL, ROAMING_ALL, DEFAULT_NETWORK_ALL,
-                    NETWORK_TYPE_ALL, OEM_MANAGED_ALL)
+                    NetworkTemplate(
+                            MATCH_WIFI,
+                            emptyArray<String>() /*subscriberIds*/,
+                            arrayOf(TEST_WIFI_KEY1),
+                            METERED_ALL,
+                            ROAMING_ALL,
+                            DEFAULT_NETWORK_ALL,
+                            NETWORK_TYPE_ALL,
+                            OEM_MANAGED_ALL
+                    )
             assertEquals(expectedTemplate, it)
         }
 
@@ -158,9 +199,16 @@ class NetworkTemplateTest {
         // given Wifi Network Key, and IMSI. See buildTemplateWifi(wifiNetworkKey, subscriberId).
         NetworkTemplate.Builder(MATCH_WIFI).setSubscriberIds(setOf(TEST_IMSI1))
                 .setWifiNetworkKeys(setOf(TEST_WIFI_KEY1)).build().let {
-                    val expectedTemplate = NetworkTemplate(MATCH_WIFI, arrayOf(TEST_IMSI1),
-                            arrayOf(TEST_WIFI_KEY1), METERED_ALL, ROAMING_ALL, DEFAULT_NETWORK_ALL,
-                            NETWORK_TYPE_ALL, OEM_MANAGED_ALL)
+                    val expectedTemplate = NetworkTemplate(
+                            MATCH_WIFI,
+                            arrayOf(TEST_IMSI1),
+                            arrayOf(TEST_WIFI_KEY1),
+                            METERED_ALL,
+                            ROAMING_ALL,
+                            DEFAULT_NETWORK_ALL,
+                            NETWORK_TYPE_ALL,
+                            OEM_MANAGED_ALL
+                    )
                     assertEquals(expectedTemplate, it)
                 }
 
@@ -168,10 +216,16 @@ class NetworkTemplateTest {
         // See buildTemplateEthernet and buildTemplateBluetooth.
         listOf(MATCH_ETHERNET, MATCH_BLUETOOTH, MATCH_PROXY).forEach { matchRule ->
             NetworkTemplate.Builder(matchRule).build().let {
-                val expectedTemplate = NetworkTemplate(matchRule,
-                        emptyArray<String>() /*subscriberIds*/, emptyArray<String>(),
-                        METERED_ALL, ROAMING_ALL, DEFAULT_NETWORK_ALL, NETWORK_TYPE_ALL,
-                        OEM_MANAGED_ALL)
+                val expectedTemplate = NetworkTemplate(
+                        matchRule,
+                        emptyArray<String>() /*subscriberIds*/,
+                        emptyArray<String>() /*wifiNetworkKey*/,
+                        METERED_ALL,
+                        ROAMING_ALL,
+                        DEFAULT_NETWORK_ALL,
+                        NETWORK_TYPE_ALL,
+                        OEM_MANAGED_ALL
+                )
                 assertEquals(expectedTemplate, it)
             }
         }
@@ -182,15 +236,23 @@ class NetworkTemplateTest {
         // Verify template builder which generates same template with the given different
         // sequence keys.
         NetworkTemplate.Builder(MATCH_WIFI).setWifiNetworkKeys(
-                setOf(TEST_WIFI_KEY1, TEST_WIFI_KEY2)).build().let {
+                setOf(TEST_WIFI_KEY1, TEST_WIFI_KEY2)
+        ).build().let {
             val expectedTemplate = NetworkTemplate.Builder(MATCH_WIFI).setWifiNetworkKeys(
-                    setOf(TEST_WIFI_KEY2, TEST_WIFI_KEY1)).build()
+                    setOf(TEST_WIFI_KEY2, TEST_WIFI_KEY1)
+            ).build()
             assertEquals(expectedTemplate, it)
         }
 
         // Verify template which matches non-wifi networks with the given key is invalid.
-        listOf(MATCH_MOBILE, MATCH_CARRIER, MATCH_ETHERNET, MATCH_BLUETOOTH, -1,
-                Integer.MAX_VALUE).forEach { matchRule ->
+        listOf(
+                MATCH_MOBILE,
+                MATCH_CARRIER,
+                MATCH_ETHERNET,
+                MATCH_BLUETOOTH,
+                -1,
+                Integer.MAX_VALUE
+        ).forEach { matchRule ->
             assertFailsWith<IllegalArgumentException> {
                 NetworkTemplate.Builder(matchRule).setWifiNetworkKeys(setOf(TEST_WIFI_KEY1)).build()
             }
@@ -203,10 +265,16 @@ class NetworkTemplateTest {
 
         // Verify template which matches wifi wildcard with the given empty key set.
         NetworkTemplate.Builder(MATCH_WIFI).setWifiNetworkKeys(setOf<String>()).build().let {
-            val expectedTemplate = NetworkTemplate(MATCH_WIFI,
-                    emptyArray<String>() /*subscriberIds*/, emptyArray<String>(),
-                    METERED_ALL, ROAMING_ALL, DEFAULT_NETWORK_ALL, NETWORK_TYPE_ALL,
-                    OEM_MANAGED_ALL)
+            val expectedTemplate = NetworkTemplate(
+                    MATCH_WIFI,
+                    emptyArray<String>() /*subscriberIds*/,
+                    emptyArray<String>() /*wifiNetworkKey*/,
+                    METERED_ALL,
+                    ROAMING_ALL,
+                    DEFAULT_NETWORK_ALL,
+                    NETWORK_TYPE_ALL,
+                    OEM_MANAGED_ALL
+            )
             assertEquals(expectedTemplate, it)
         }
     }
diff --git a/tests/unit/java/android/net/NetworkTemplateTest.kt b/tests/unit/java/android/net/NetworkTemplateTest.kt
index a8414ca8a9..f1f455b4b3 100644
--- a/tests/unit/java/android/net/NetworkTemplateTest.kt
+++ b/tests/unit/java/android/net/NetworkTemplateTest.kt
@@ -79,26 +79,35 @@ class NetworkTemplateTest {
 
     private fun buildMobileNetworkState(subscriberId: String): NetworkStateSnapshot =
             buildNetworkState(TYPE_MOBILE, subscriberId = subscriberId)
-    private fun buildWifiNetworkState(subscriberId: String?, wifiKey: String?):
-            NetworkStateSnapshot = buildNetworkState(TYPE_WIFI,
-            subscriberId = subscriberId, wifiKey = wifiKey)
+    private fun buildWifiNetworkState(
+            subscriberId: String?,
+            wifiKey: String?
+    ): NetworkStateSnapshot = buildNetworkState(
+            TYPE_WIFI,
+            subscriberId = subscriberId,
+            wifiKey = wifiKey
+    )
 
     private fun buildNetworkState(
-        type: Int,
-        subscriberId: String? = null,
-        wifiKey: String? = null,
-        oemManaged: Int = OEM_NONE,
-        metered: Boolean = true
+            type: Int,
+            subscriberId: String? = null,
+            wifiKey: String? = null,
+            oemManaged: Int = OEM_NONE,
+            metered: Boolean = true
     ): NetworkStateSnapshot {
         `when`(mockWifiInfo.getNetworkKey()).thenReturn(wifiKey)
         val lp = LinkProperties()
         val caps = NetworkCapabilities().apply {
             setCapability(NetworkCapabilities.NET_CAPABILITY_NOT_METERED, !metered)
             setCapability(NetworkCapabilities.NET_CAPABILITY_NOT_ROAMING, true)
-            setCapability(NetworkCapabilities.NET_CAPABILITY_OEM_PAID,
-                    (oemManaged and OEM_PAID) == OEM_PAID)
-            setCapability(NetworkCapabilities.NET_CAPABILITY_OEM_PRIVATE,
-                    (oemManaged and OEM_PRIVATE) == OEM_PRIVATE)
+            setCapability(
+                    NetworkCapabilities.NET_CAPABILITY_OEM_PAID,
+                    (oemManaged and OEM_PAID) == OEM_PAID
+            )
+            setCapability(
+                    NetworkCapabilities.NET_CAPABILITY_OEM_PRIVATE,
+                    (oemManaged and OEM_PRIVATE) == OEM_PRIVATE
+            )
             if (type == TYPE_TEST) {
                 wifiKey?.let { TestNetworkSpecifier(it) }?.let {
                     // Must have a single non-test transport specified to use setNetworkSpecifier.
@@ -127,19 +136,36 @@ class NetworkTemplateTest {
     fun testWifiWildcardMatches() {
         val templateWifiWildcard = buildTemplateWifiWildcard()
 
-        val identMobileImsi1 = buildNetworkIdentity(mockContext,
+        val identMobileImsi1 = buildNetworkIdentity(
+                mockContext,
                 buildMobileNetworkState(TEST_IMSI1),
-                false, TelephonyManager.NETWORK_TYPE_UMTS)
+                false,
+                TelephonyManager.NETWORK_TYPE_UMTS
+        )
         val identWifiImsiNullKey1 = buildNetworkIdentity(
-                mockContext, buildWifiNetworkState(null, TEST_WIFI_KEY1), true, 0)
+                mockContext,
+                buildWifiNetworkState(null, TEST_WIFI_KEY1),
+                true,
+                0
+        )
         val identWifiImsi1Key1 = buildNetworkIdentity(
-                mockContext, buildWifiNetworkState(TEST_IMSI1, TEST_WIFI_KEY1), true, 0)
+                mockContext,
+                buildWifiNetworkState(TEST_IMSI1, TEST_WIFI_KEY1),
+                true,
+                0
+        )
         // This identity with a null wifiNetworkKey is to test matchesWifiNetworkKey won't crash
         // the system when a null wifiNetworkKey is provided, which happens because of a bug in wifi
         // and it should still match the wifi wildcard template. See b/266598304.
         val identWifiNullKey = buildNetworkIdentity(
-                mockContext, buildWifiNetworkState(null /* subscriberId */,
-                null /* wifiNetworkKey */), true, 0)
+                mockContext,
+                buildWifiNetworkState(
+                        null /* subscriberId */,
+                        null /* wifiNetworkKey */
+                ),
+                true,
+                0
+        )
 
         templateWifiWildcard.assertDoesNotMatch(identMobileImsi1)
         templateWifiWildcard.assertMatches(identWifiImsiNullKey1)
@@ -159,26 +185,56 @@ class NetworkTemplateTest {
                 .setWifiNetworkKeys(setOf(TEST_WIFI_KEY1)).build()
         val templateWifiKeyAllImsi1 = NetworkTemplate.Builder(MATCH_WIFI)
                 .setSubscriberIds(setOf(TEST_IMSI1)).build()
-        val templateNullWifiKey = NetworkTemplate(MATCH_WIFI,
-                emptyArray<String>() /* subscriberIds */, arrayOf(null) /* wifiNetworkKeys */,
-                METERED_ALL, ROAMING_ALL, DEFAULT_NETWORK_ALL, NETWORK_TYPE_ALL, OEM_MANAGED_ALL)
+        val templateNullWifiKey = NetworkTemplate(
+                MATCH_WIFI,
+                emptyArray<String>() /* subscriberIds */,
+                arrayOf(null) /* wifiNetworkKeys */,
+                METERED_ALL,
+                ROAMING_ALL,
+                DEFAULT_NETWORK_ALL,
+                NETWORK_TYPE_ALL,
+                OEM_MANAGED_ALL
+        )
 
-        val identMobile1 = buildNetworkIdentity(mockContext, buildMobileNetworkState(TEST_IMSI1),
-                false, TelephonyManager.NETWORK_TYPE_UMTS)
+        val identMobile1 = buildNetworkIdentity(
+                mockContext,
+                buildMobileNetworkState(TEST_IMSI1),
+                false,
+                TelephonyManager.NETWORK_TYPE_UMTS
+        )
         val identWifiImsiNullKey1 = buildNetworkIdentity(
-                mockContext, buildWifiNetworkState(null, TEST_WIFI_KEY1), true, 0)
+                mockContext,
+                buildWifiNetworkState(null, TEST_WIFI_KEY1),
+                true,
+                0
+        )
         val identWifiImsi1Key1 = buildNetworkIdentity(
-                mockContext, buildWifiNetworkState(TEST_IMSI1, TEST_WIFI_KEY1), true, 0)
+                mockContext,
+                buildWifiNetworkState(TEST_IMSI1, TEST_WIFI_KEY1),
+                true,
+                0
+        )
         val identWifiImsi2Key1 = buildNetworkIdentity(
-                mockContext, buildWifiNetworkState(TEST_IMSI2, TEST_WIFI_KEY1), true, 0)
+                mockContext,
+                buildWifiNetworkState(TEST_IMSI2, TEST_WIFI_KEY1),
+                true,
+                0
+        )
         val identWifiImsi1Key2 = buildNetworkIdentity(
-                mockContext, buildWifiNetworkState(TEST_IMSI1, TEST_WIFI_KEY2), true, 0)
+                mockContext,
+                buildWifiNetworkState(TEST_IMSI1, TEST_WIFI_KEY2),
+                true,
+                0
+        )
         // This identity with a null wifiNetworkKey is to test the matchesWifiNetworkKey won't crash
         // the system when a null wifiNetworkKey is provided, which would happen in some unknown
         // cases, see b/266598304.
         val identWifiNullKey = buildNetworkIdentity(
-                mockContext, buildWifiNetworkState(null /* subscriberId */,
-                null /* wifiNetworkKey */), true, 0)
+                mockContext,
+                buildWifiNetworkState(null /* subscriberId */, null /* wifiNetworkKey */),
+                true,
+                0
+        )
 
         // Verify that template with WiFi Network Key only matches any subscriberId and
         // specific WiFi Network Key.
@@ -240,16 +296,33 @@ class NetworkTemplateTest {
                 .setSubscriberIds(setOf(TEST_IMSI2))
                 .setRatType(TelephonyManager.NETWORK_TYPE_UMTS).build()
 
-        val mobileImsi1 = buildNetworkState(TYPE_MOBILE, TEST_IMSI1, null /* wifiKey */,
-                OEM_NONE, true /* metered */)
-        val identMobile1 = buildNetworkIdentity(mockContext, mobileImsi1,
-                false /* defaultNetwork */, TelephonyManager.NETWORK_TYPE_UMTS)
+        val mobileImsi1 = buildNetworkState(
+                TYPE_MOBILE,
+                TEST_IMSI1,
+                null /* wifiKey */,
+                OEM_NONE,
+                true /* metered */
+        )
+        val identMobile1 = buildNetworkIdentity(
+                mockContext,
+                mobileImsi1,
+                false /* defaultNetwork */,
+                TelephonyManager.NETWORK_TYPE_UMTS
+        )
         val mobileImsi2 = buildMobileNetworkState(TEST_IMSI2)
-        val identMobile2Umts = buildNetworkIdentity(mockContext, mobileImsi2,
-                false /* defaultNetwork */, TelephonyManager.NETWORK_TYPE_UMTS)
+        val identMobile2Umts = buildNetworkIdentity(
+                mockContext,
+                mobileImsi2,
+                false /* defaultNetwork */,
+                TelephonyManager.NETWORK_TYPE_UMTS
+        )
 
         val identWifiImsi1Key1 = buildNetworkIdentity(
-                mockContext, buildWifiNetworkState(TEST_IMSI1, TEST_WIFI_KEY1), true, 0)
+                mockContext,
+                buildWifiNetworkState(TEST_IMSI1, TEST_WIFI_KEY1),
+                true,
+                0
+        )
 
         // Verify that the template matches type and the subscriberId.
         templateMobileImsi1.assertMatches(identMobile1)
@@ -269,11 +342,19 @@ class NetworkTemplateTest {
         val templateMobileNullImsiWithRatType = NetworkTemplate.Builder(MATCH_MOBILE)
                 .setRatType(TelephonyManager.NETWORK_TYPE_UMTS).build()
         val mobileImsi1 = buildMobileNetworkState(TEST_IMSI1)
-        val identMobile1 = buildNetworkIdentity(mockContext, mobileImsi1,
-                false /* defaultNetwork */, TelephonyManager.NETWORK_TYPE_UMTS)
+        val identMobile1 = buildNetworkIdentity(
+                mockContext,
+                mobileImsi1,
+                false /* defaultNetwork */,
+                TelephonyManager.NETWORK_TYPE_UMTS
+        )
         val mobileImsi2 = buildMobileNetworkState(TEST_IMSI2)
-        val identMobile2 = buildNetworkIdentity(mockContext, mobileImsi2,
-                false /* defaultNetwork */, TelephonyManager.NETWORK_TYPE_LTE)
+        val identMobile2 = buildNetworkIdentity(
+                mockContext,
+                mobileImsi2,
+                false /* defaultNetwork */,
+                TelephonyManager.NETWORK_TYPE_LTE
+        )
 
         // Verify that the template matches any subscriberId.
         templateMobileWildcard.assertMatches(identMobile1)
@@ -282,7 +363,11 @@ class NetworkTemplateTest {
         templateMobileNullImsiWithRatType.assertDoesNotMatch(identMobile2)
 
         val identWifiImsi1Key1 = buildNetworkIdentity(
-                mockContext, buildWifiNetworkState(TEST_IMSI1, TEST_WIFI_KEY1), true, 0)
+                mockContext,
+                buildWifiNetworkState(TEST_IMSI1, TEST_WIFI_KEY1),
+                true,
+                0
+        )
 
         // Verify that the different type does not match.
         templateMobileWildcard.assertDoesNotMatch(identWifiImsi1Key1)
@@ -297,14 +382,32 @@ class NetworkTemplateTest {
             .setWifiNetworkKeys(setOf(TEST_WIFI_KEY2)).build()
         val templateTestAll = NetworkTemplate.Builder(MATCH_TEST).build()
 
-        val stateWifiKey1 = buildNetworkState(TYPE_WIFI, null /* subscriberId */, TEST_WIFI_KEY1,
-            OEM_NONE, true /* metered */)
-        val stateTestKey1 = buildNetworkState(TYPE_TEST, null /* subscriberId */, TEST_WIFI_KEY1,
-            OEM_NONE, true /* metered */)
-        val identWifi1 = buildNetworkIdentity(mockContext, stateWifiKey1,
-            false /* defaultNetwork */, NetworkTemplate.NETWORK_TYPE_ALL)
-        val identTest1 = buildNetworkIdentity(mockContext, stateTestKey1,
-            false /* defaultNetwork */, NETWORK_TYPE_ALL)
+        val stateWifiKey1 = buildNetworkState(
+                TYPE_WIFI,
+                null /* subscriberId */,
+                TEST_WIFI_KEY1,
+                OEM_NONE,
+                true /* metered */
+        )
+        val stateTestKey1 = buildNetworkState(
+                TYPE_TEST,
+                null /* subscriberId */,
+                TEST_WIFI_KEY1,
+                OEM_NONE,
+                true /* metered */
+        )
+        val identWifi1 = buildNetworkIdentity(
+                mockContext,
+                stateWifiKey1,
+                false /* defaultNetwork */,
+                NETWORK_TYPE_ALL
+        )
+        val identTest1 = buildNetworkIdentity(
+                mockContext,
+                stateTestKey1,
+                false /* defaultNetwork */,
+                NETWORK_TYPE_ALL
+        )
 
         // Verify that the template matches corresponding type and the subscriberId.
         templateTestKey1.assertDoesNotMatch(identWifi1)
@@ -322,28 +425,63 @@ class NetworkTemplateTest {
                 .setSubscriberIds(setOf(TEST_IMSI1)).build()
 
         val mobileImsi1 = buildMobileNetworkState(TEST_IMSI1)
-        val mobileImsi1Unmetered = buildNetworkState(TYPE_MOBILE, TEST_IMSI1,
-                null /* wifiKey */, OEM_NONE, false /* metered */)
+        val mobileImsi1Unmetered = buildNetworkState(
+                TYPE_MOBILE,
+                TEST_IMSI1,
+                null /* wifiKey */,
+                OEM_NONE,
+                false /* metered */
+        )
         val mobileImsi2 = buildMobileNetworkState(TEST_IMSI2)
-        val wifiKey1 = buildWifiNetworkState(null /* subscriberId */,
-                TEST_WIFI_KEY1)
+        val wifiKey1 = buildWifiNetworkState(
+                null /* subscriberId */,
+                TEST_WIFI_KEY1
+        )
         val wifiImsi1Key1 = buildWifiNetworkState(TEST_IMSI1, TEST_WIFI_KEY1)
-        val wifiImsi1Key1Unmetered = buildNetworkState(TYPE_WIFI, TEST_IMSI1,
-                TEST_WIFI_KEY1, OEM_NONE, false /* metered */)
+        val wifiImsi1Key1Unmetered = buildNetworkState(
+                TYPE_WIFI,
+                TEST_IMSI1,
+                TEST_WIFI_KEY1,
+                OEM_NONE,
+                false /* metered */
+        )
 
-        val identMobileImsi1Metered = buildNetworkIdentity(mockContext,
-                mobileImsi1, false /* defaultNetwork */, TelephonyManager.NETWORK_TYPE_UMTS)
-        val identMobileImsi1Unmetered = buildNetworkIdentity(mockContext,
-                mobileImsi1Unmetered, false /* defaultNetwork */,
-                TelephonyManager.NETWORK_TYPE_UMTS)
-        val identMobileImsi2Metered = buildNetworkIdentity(mockContext,
-                mobileImsi2, false /* defaultNetwork */, TelephonyManager.NETWORK_TYPE_UMTS)
+        val identMobileImsi1Metered = buildNetworkIdentity(
+                mockContext,
+                mobileImsi1,
+                false /* defaultNetwork */,
+                TelephonyManager.NETWORK_TYPE_UMTS
+        )
+        val identMobileImsi1Unmetered = buildNetworkIdentity(
+                mockContext,
+                mobileImsi1Unmetered,
+                false /* defaultNetwork */,
+                TelephonyManager.NETWORK_TYPE_UMTS
+        )
+        val identMobileImsi2Metered = buildNetworkIdentity(
+                mockContext,
+                mobileImsi2,
+                false /* defaultNetwork */,
+                TelephonyManager.NETWORK_TYPE_UMTS
+        )
         val identWifiKey1Metered = buildNetworkIdentity(
-                mockContext, wifiKey1, true /* defaultNetwork */, 0 /* subType */)
+                mockContext,
+                wifiKey1,
+                true /* defaultNetwork */,
+                0 /* subType */
+        )
         val identCarrierWifiImsi1Metered = buildNetworkIdentity(
-                mockContext, wifiImsi1Key1, true /* defaultNetwork */, 0 /* subType */)
-        val identCarrierWifiImsi1NonMetered = buildNetworkIdentity(mockContext,
-                wifiImsi1Key1Unmetered, true /* defaultNetwork */, 0 /* subType */)
+                mockContext,
+                wifiImsi1Key1,
+                true /* defaultNetwork */,
+                0 /* subType */
+        )
+        val identCarrierWifiImsi1NonMetered = buildNetworkIdentity(
+                mockContext,
+                wifiImsi1Key1Unmetered,
+                true /* defaultNetwork */,
+                0 /* subType */
+        )
 
         templateCarrierImsi1Metered.assertMatches(identMobileImsi1Metered)
         templateCarrierImsi1Metered.assertDoesNotMatch(identMobileImsi1Unmetered)
@@ -357,10 +495,20 @@ class NetworkTemplateTest {
     @Test
     fun testRatTypeGroupMatches() {
         val stateMobileImsi1Metered = buildMobileNetworkState(TEST_IMSI1)
-        val stateMobileImsi1NonMetered = buildNetworkState(TYPE_MOBILE, TEST_IMSI1,
-                null /* wifiKey */, OEM_NONE, false /* metered */)
-        val stateMobileImsi2NonMetered = buildNetworkState(TYPE_MOBILE, TEST_IMSI2,
-                null /* wifiKey */, OEM_NONE, false /* metered */)
+        val stateMobileImsi1NonMetered = buildNetworkState(
+                TYPE_MOBILE,
+                TEST_IMSI1,
+                null /* wifiKey */,
+                OEM_NONE,
+                false /* metered */
+        )
+        val stateMobileImsi2NonMetered = buildNetworkState(
+                TYPE_MOBILE,
+                TEST_IMSI2,
+                null /* wifiKey */,
+                OEM_NONE,
+                false /* metered */
+        )
 
         // Build UMTS template that matches mobile identities with RAT in the same
         // group with any IMSI. See {@link NetworkTemplate#getCollapsedRatType}.
@@ -385,29 +533,72 @@ class NetworkTemplateTest {
                 .setRatType(TelephonyManager.NETWORK_TYPE_UNKNOWN).build()
 
         val identUmtsMetered = buildNetworkIdentity(
-                mockContext, stateMobileImsi1Metered, false, TelephonyManager.NETWORK_TYPE_UMTS)
+                mockContext,
+                stateMobileImsi1Metered,
+                false,
+                TelephonyManager.NETWORK_TYPE_UMTS
+        )
         val identHsdpaMetered = buildNetworkIdentity(
-                mockContext, stateMobileImsi1Metered, false, TelephonyManager.NETWORK_TYPE_HSDPA)
+                mockContext,
+                stateMobileImsi1Metered,
+                false,
+                TelephonyManager.NETWORK_TYPE_HSDPA
+        )
         val identLteMetered = buildNetworkIdentity(
-                mockContext, stateMobileImsi1Metered, false, TelephonyManager.NETWORK_TYPE_LTE)
+                mockContext,
+                stateMobileImsi1Metered,
+                false,
+                TelephonyManager.NETWORK_TYPE_LTE
+        )
         val identCombinedMetered = buildNetworkIdentity(
-                mockContext, stateMobileImsi1Metered, false, NetworkTemplate.NETWORK_TYPE_ALL)
-        val identImsi2UmtsMetered = buildNetworkIdentity(mockContext,
-                buildMobileNetworkState(TEST_IMSI2), false, TelephonyManager.NETWORK_TYPE_UMTS)
+                mockContext,
+                stateMobileImsi1Metered,
+                false,
+                NETWORK_TYPE_ALL
+        )
+        val identImsi2UmtsMetered = buildNetworkIdentity(
+                mockContext,
+                buildMobileNetworkState(TEST_IMSI2),
+                false,
+                TelephonyManager.NETWORK_TYPE_UMTS
+        )
         val identWifi = buildNetworkIdentity(
-                mockContext, buildWifiNetworkState(null, TEST_WIFI_KEY1), true, 0)
+                mockContext,
+                buildWifiNetworkState(null, TEST_WIFI_KEY1),
+                true,
+                0
+        )
 
         val identUmtsNonMetered = buildNetworkIdentity(
-                mockContext, stateMobileImsi1NonMetered, false, TelephonyManager.NETWORK_TYPE_UMTS)
+                mockContext,
+                stateMobileImsi1NonMetered,
+                false,
+                TelephonyManager.NETWORK_TYPE_UMTS
+        )
         val identHsdpaNonMetered = buildNetworkIdentity(
-                mockContext, stateMobileImsi1NonMetered, false,
-                TelephonyManager.NETWORK_TYPE_HSDPA)
+                mockContext,
+                stateMobileImsi1NonMetered,
+                false,
+                TelephonyManager.NETWORK_TYPE_HSDPA
+        )
         val identLteNonMetered = buildNetworkIdentity(
-                mockContext, stateMobileImsi1NonMetered, false, TelephonyManager.NETWORK_TYPE_LTE)
+                mockContext,
+                stateMobileImsi1NonMetered,
+                false,
+                TelephonyManager.NETWORK_TYPE_LTE
+        )
         val identCombinedNonMetered = buildNetworkIdentity(
-                mockContext, stateMobileImsi1NonMetered, false, NetworkTemplate.NETWORK_TYPE_ALL)
-        val identImsi2UmtsNonMetered = buildNetworkIdentity(mockContext,
-                stateMobileImsi2NonMetered, false, TelephonyManager.NETWORK_TYPE_UMTS)
+                mockContext,
+                stateMobileImsi1NonMetered,
+                false,
+                NETWORK_TYPE_ALL
+        )
+        val identImsi2UmtsNonMetered = buildNetworkIdentity(
+                mockContext,
+                stateMobileImsi2NonMetered,
+                false,
+                TelephonyManager.NETWORK_TYPE_UMTS
+        )
 
         // Assert that identity with the same RAT and meteredness matches.
         // Verify metered template.
@@ -486,9 +677,16 @@ class NetworkTemplateTest {
         val templateImsi1 = NetworkTemplate.Builder(MATCH_MOBILE).setMeteredness(METERED_YES)
                 .setSubscriberIds(setOf(TEST_IMSI1)).setRatType(TelephonyManager.NETWORK_TYPE_UMTS)
                 .build()
-        val dupTemplateImsi1 = NetworkTemplate(MATCH_MOBILE, arrayOf(TEST_IMSI1),
-                emptyArray<String>(), METERED_YES, ROAMING_ALL, DEFAULT_NETWORK_ALL,
-                TelephonyManager.NETWORK_TYPE_UMTS, OEM_MANAGED_ALL)
+        val dupTemplateImsi1 = NetworkTemplate(
+                MATCH_MOBILE,
+                arrayOf(TEST_IMSI1),
+                emptyArray<String>() /* wifiNetworkKey */,
+                METERED_YES,
+                ROAMING_ALL,
+                DEFAULT_NETWORK_ALL,
+                TelephonyManager.NETWORK_TYPE_UMTS,
+                OEM_MANAGED_ALL
+        )
         val templateImsi2 = NetworkTemplate.Builder(MATCH_MOBILE).setMeteredness(METERED_YES)
                 .setSubscriberIds(setOf(TEST_IMSI2)).setRatType(TelephonyManager.NETWORK_TYPE_UMTS)
                 .build()
@@ -499,9 +697,16 @@ class NetworkTemplateTest {
 
         val templateWifiKey1 = NetworkTemplate.Builder(MATCH_WIFI)
                 .setWifiNetworkKeys(setOf(TEST_WIFI_KEY1)).build()
-        val dupTemplateWifiKey1 = NetworkTemplate(MATCH_WIFI, emptyArray<String>(),
-                arrayOf(TEST_WIFI_KEY1), METERED_ALL, ROAMING_ALL, DEFAULT_NETWORK_ALL,
-                NETWORK_TYPE_ALL, OEM_MANAGED_ALL)
+        val dupTemplateWifiKey1 = NetworkTemplate(
+                MATCH_WIFI,
+                emptyArray<String>(),
+                arrayOf(TEST_WIFI_KEY1),
+                METERED_ALL,
+                ROAMING_ALL,
+                DEFAULT_NETWORK_ALL,
+                NETWORK_TYPE_ALL,
+                OEM_MANAGED_ALL
+        )
         val templateWifiKey2 = NetworkTemplate.Builder(MATCH_WIFI)
                 .setWifiNetworkKeys(setOf(TEST_WIFI_KEY2)).build()
 
@@ -512,15 +717,36 @@ class NetworkTemplateTest {
 
     @Test
     fun testParcelUnparcel() {
-        val templateMobile = NetworkTemplate(MATCH_MOBILE, arrayOf(TEST_IMSI1),
-                emptyArray<String>(), METERED_ALL, ROAMING_ALL, DEFAULT_NETWORK_ALL,
-                TelephonyManager.NETWORK_TYPE_LTE, OEM_MANAGED_ALL)
-        val templateWifi = NetworkTemplate(MATCH_WIFI, emptyArray<String>(),
-                arrayOf(TEST_WIFI_KEY1), METERED_ALL, ROAMING_ALL, DEFAULT_NETWORK_ALL, 0,
-                OEM_MANAGED_ALL)
-        val templateOem = NetworkTemplate(MATCH_MOBILE, emptyArray<String>(),
-                emptyArray<String>(), METERED_ALL, ROAMING_ALL, DEFAULT_NETWORK_ALL, 0,
-                OEM_MANAGED_YES)
+        val templateMobile = NetworkTemplate(
+                MATCH_MOBILE,
+                arrayOf(TEST_IMSI1),
+                emptyArray<String>() /* wifiNetworkKey */,
+                METERED_ALL,
+                ROAMING_ALL,
+                DEFAULT_NETWORK_ALL,
+                TelephonyManager.NETWORK_TYPE_LTE,
+                OEM_MANAGED_ALL
+        )
+        val templateWifi = NetworkTemplate(
+                MATCH_WIFI,
+                emptyArray<String>() /* subscriberIds */,
+                arrayOf(TEST_WIFI_KEY1),
+                METERED_ALL,
+                ROAMING_ALL,
+                DEFAULT_NETWORK_ALL,
+                0,
+                OEM_MANAGED_ALL
+        )
+        val templateOem = NetworkTemplate(
+                MATCH_MOBILE,
+                emptyArray<String>() /* subscriberIds */,
+                emptyArray<String>() /* wifiNetworkKey */,
+                METERED_ALL,
+                ROAMING_ALL,
+                DEFAULT_NETWORK_ALL,
+                0,
+                OEM_MANAGED_YES
+        )
         assertParcelSane(templateMobile, 8)
         assertParcelSane(templateWifi, 8)
         assertParcelSane(templateOem, 8)
@@ -538,8 +764,14 @@ class NetworkTemplateTest {
 
     @Test
     fun testOemNetworkConstants() {
-        val constantValues = arrayOf(OEM_MANAGED_YES, OEM_MANAGED_ALL, OEM_MANAGED_NO,
-                OEM_PAID, OEM_PRIVATE, OEM_PAID or OEM_PRIVATE)
+        val constantValues = arrayOf(
+                OEM_MANAGED_YES,
+                OEM_MANAGED_ALL,
+                OEM_MANAGED_NO,
+                OEM_PAID,
+                OEM_PRIVATE,
+                OEM_PAID or OEM_PRIVATE
+        )
 
         // Verify that "not OEM managed network" constants are equal.
         assertEquals(OEM_MANAGED_NO, OEM_NONE)
@@ -578,23 +810,52 @@ class NetworkTemplateTest {
         val matchWifiNetworkKeys =
                 if (templateWifiKey == null) emptyArray<String>() else arrayOf(templateWifiKey)
 
-        val templateOemYes = NetworkTemplate(matchType, matchSubscriberIds,
-                matchWifiNetworkKeys, METERED_ALL, ROAMING_ALL,
-                DEFAULT_NETWORK_ALL, NETWORK_TYPE_ALL, OEM_MANAGED_YES)
-        val templateOemAll = NetworkTemplate(matchType, matchSubscriberIds,
-                matchWifiNetworkKeys, METERED_ALL, ROAMING_ALL,
-                DEFAULT_NETWORK_ALL, NETWORK_TYPE_ALL, OEM_MANAGED_ALL)
+        val templateOemYes = NetworkTemplate(
+                matchType,
+                matchSubscriberIds,
+                matchWifiNetworkKeys,
+                METERED_ALL,
+                ROAMING_ALL,
+                DEFAULT_NETWORK_ALL,
+                NETWORK_TYPE_ALL,
+                OEM_MANAGED_YES
+        )
+        val templateOemAll = NetworkTemplate(
+                matchType,
+                matchSubscriberIds,
+                matchWifiNetworkKeys,
+                METERED_ALL,
+                ROAMING_ALL,
+                DEFAULT_NETWORK_ALL,
+                NETWORK_TYPE_ALL,
+                OEM_MANAGED_ALL
+        )
 
         for (identityOemManagedState in oemManagedStates) {
-            val ident = buildNetworkIdentity(mockContext, buildNetworkState(networkType,
-                    subscriberId, identWifiKey, identityOemManagedState),
-                    /*defaultNetwork=*/false, /*subType=*/0)
+            val ident = buildNetworkIdentity(
+                    mockContext,
+                    buildNetworkState(
+                            networkType,
+                            subscriberId,
+                            identWifiKey,
+                            identityOemManagedState
+                    ),
+                    false /* defaultNetwork */,
+                    0 /* subType */
+            )
 
             // Create a template with each OEM managed type and match it against the NetworkIdentity
             for (templateOemManagedState in oemManagedStates) {
-                val template = NetworkTemplate(matchType, matchSubscriberIds,
-                        matchWifiNetworkKeys, METERED_ALL, ROAMING_ALL,
-                        DEFAULT_NETWORK_ALL, NETWORK_TYPE_ALL, templateOemManagedState)
+                val template = NetworkTemplate(
+                        matchType,
+                        matchSubscriberIds,
+                        matchWifiNetworkKeys,
+                        METERED_ALL,
+                        ROAMING_ALL,
+                        DEFAULT_NETWORK_ALL,
+                        NETWORK_TYPE_ALL,
+                        templateOemManagedState
+                )
                 if (identityOemManagedState == templateOemManagedState) {
                     template.assertMatches(ident)
                 } else {
@@ -616,29 +877,54 @@ class NetworkTemplateTest {
     fun testOemManagedMatchesIdent() {
         matchOemManagedIdent(TYPE_MOBILE, MATCH_MOBILE, subscriberId = TEST_IMSI1)
         matchOemManagedIdent(TYPE_MOBILE, MATCH_MOBILE)
-        matchOemManagedIdent(TYPE_WIFI, MATCH_WIFI, templateWifiKey = TEST_WIFI_KEY1,
-                identWifiKey = TEST_WIFI_KEY1)
+        matchOemManagedIdent(
+                TYPE_WIFI,
+                MATCH_WIFI,
+                templateWifiKey = TEST_WIFI_KEY1,
+                identWifiKey = TEST_WIFI_KEY1
+        )
         matchOemManagedIdent(TYPE_WIFI, MATCH_WIFI, identWifiKey = TEST_WIFI_KEY1)
     }
 
     @Test
     fun testNormalize() {
         var mergedImsiList = arrayOf(TEST_IMSI1, TEST_IMSI2)
-        val identMobileImsi1 = buildNetworkIdentity(mockContext,
-                buildMobileNetworkState(TEST_IMSI1), false /* defaultNetwork */,
-                TelephonyManager.NETWORK_TYPE_UMTS)
-        val identMobileImsi2 = buildNetworkIdentity(mockContext,
-                buildMobileNetworkState(TEST_IMSI2), false /* defaultNetwork */,
-                TelephonyManager.NETWORK_TYPE_UMTS)
-        val identMobileImsi3 = buildNetworkIdentity(mockContext,
-                buildMobileNetworkState(TEST_IMSI3), false /* defaultNetwork */,
-                TelephonyManager.NETWORK_TYPE_UMTS)
+        val identMobileImsi1 = buildNetworkIdentity(
+                mockContext,
+                buildMobileNetworkState(TEST_IMSI1),
+                false /* defaultNetwork */,
+                TelephonyManager.NETWORK_TYPE_UMTS
+        )
+        val identMobileImsi2 = buildNetworkIdentity(
+                mockContext,
+                buildMobileNetworkState(TEST_IMSI2),
+                false /* defaultNetwork */,
+                TelephonyManager.NETWORK_TYPE_UMTS
+        )
+        val identMobileImsi3 = buildNetworkIdentity(
+                mockContext,
+                buildMobileNetworkState(TEST_IMSI3),
+                false /* defaultNetwork */,
+                TelephonyManager.NETWORK_TYPE_UMTS
+        )
         val identWifiImsi1Key1 = buildNetworkIdentity(
-                mockContext, buildWifiNetworkState(TEST_IMSI1, TEST_WIFI_KEY1), true, 0)
+                mockContext,
+                buildWifiNetworkState(TEST_IMSI1, TEST_WIFI_KEY1),
+                true,
+                0
+        )
         val identWifiImsi2Key1 = buildNetworkIdentity(
-                mockContext, buildWifiNetworkState(TEST_IMSI2, TEST_WIFI_KEY1), true, 0)
+                mockContext,
+                buildWifiNetworkState(TEST_IMSI2, TEST_WIFI_KEY1),
+                true,
+                0
+        )
         val identWifiImsi3WifiKey1 = buildNetworkIdentity(
-                mockContext, buildWifiNetworkState(TEST_IMSI3, TEST_WIFI_KEY1), true, 0)
+                mockContext,
+                buildWifiNetworkState(TEST_IMSI3, TEST_WIFI_KEY1),
+                true,
+                0
+        )
 
         normalize(buildTemplateMobileAll(TEST_IMSI1), mergedImsiList).also {
             it.assertMatches(identMobileImsi1)

From 29fce555add36a555a88f811e1378969769338ae Mon Sep 17 00:00:00 2001
From: Manish Singh <psych@google.com>
Date: Fri, 23 May 2025 15:45:35 +0000
Subject: [PATCH 295/377] Add notice of requesting source code in tethering

Flag: EXEMPT license change for b/418865751
Bug: 418865751
Test: presubmits
Test: lunch husky-trunk_staging-eng && m, an extra line is added at the top of NOTICE.html file in NOTICE.html.gz
Change-Id: I52a5bb713e4084ca7e07da8e95dc0f37477b60d9
---
 Tethering/apex/Android.bp | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/Tethering/apex/Android.bp b/Tethering/apex/Android.bp
index 5bdf98d3a1..19e2c6f078 100644
--- a/Tethering/apex/Android.bp
+++ b/Tethering/apex/Android.bp
@@ -116,6 +116,10 @@ apex {
     compat_configs: [
         "connectivity-platform-compat-config",
     ],
+    licenses: [
+        "Android-Apache-2.0",
+        "opensourcerequest",
+    ],
 }
 
 apex_key {

From bebd4090ae35e54384c691cd5e5f4dc6d0a01358 Mon Sep 17 00:00:00 2001
From: Junyu Lai <junyulai@google.com>
Date: Wed, 21 May 2025 10:38:39 +0800
Subject: [PATCH 296/377] Add NetworkCapabilities transport types into
 NetworkIdentity.

This change updates NetworkIdentity to have NetworkCapabilities
transport types for improved network identification, and updates
NetworkIdentitySet for backward compatibility with older data.

Flag: EXEMPT implemented in the counter-part CL
Test: atest ConnectivityCoverageTests --test-filter \
      'NetworkIdentity*' --update-device
Test: atest ConnectivityCoverageTests --test-filter \
      'NetworkStats*' --update-device
Bug: 419123367
Change-Id: I26cc770d90b4687d832dd029d9a11db03404db39
---
 .../src/android/net/NetworkIdentity.java      |  53 +++++--
 .../src/android/net/NetworkIdentitySet.java   |  36 ++++-
 .../src/android/net/NetworkTemplate.java      |   4 +-
 framework/proto/netstats.proto                |   2 +
 .../net/module/util/CollectionUtils.java      |  14 ++
 .../module/util/NetworkCapabilitiesUtils.java |  38 ++++-
 .../net/module/util/CollectionUtilsTest.kt    |  31 +++-
 .../android/net/NetworkIdentitySetTest.kt     | 145 ++++++++++++++++--
 .../java/android/net/NetworkIdentityTest.kt   | 140 +++++++++++++----
 .../net/NetworkStatsCollectionTest.java       |   8 +-
 .../server/net/NetworkStatsObserversTest.java |   5 +-
 11 files changed, 407 insertions(+), 69 deletions(-)

diff --git a/framework-t/src/android/net/NetworkIdentity.java b/framework-t/src/android/net/NetworkIdentity.java
index 947a0925c6..a48032b6b4 100644
--- a/framework-t/src/android/net/NetworkIdentity.java
+++ b/framework-t/src/android/net/NetworkIdentity.java
@@ -22,6 +22,9 @@ import static android.net.ConnectivityManager.TYPE_WIFI;
 import static android.net.NetworkTemplate.NETWORK_TYPE_ALL;
 import static android.telephony.SubscriptionManager.INVALID_SUBSCRIPTION_ID;
 
+import static com.android.net.module.util.CollectionUtils.intArrayToSet;
+import static com.android.net.module.util.NetworkCapabilitiesUtils.TYPE_TEST;
+
 import android.annotation.IntDef;
 import android.annotation.NonNull;
 import android.annotation.Nullable;
@@ -43,6 +46,7 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.util.ArrayList;
 import java.util.Objects;
+import java.util.Set;
 
 /**
  * Network definition that includes strong identity. Analogous to combining
@@ -86,9 +90,6 @@ public class NetworkIdentity {
 
     private static final long SUPPORTED_OEM_MANAGED_TYPES = OEM_PAID | OEM_PRIVATE;
 
-    // Need to be synchronized with ConnectivityManager.
-    // TODO: Use {@code ConnectivityManager#*} when visible.
-    static final int TYPE_TEST = 18;
     private static final int MAX_NETWORK_TYPE = TYPE_TEST;
     private static final int MIN_NETWORK_TYPE = TYPE_MOBILE;
 
@@ -101,11 +102,13 @@ public class NetworkIdentity {
     final boolean mMetered;
     final boolean mDefaultNetwork;
     final int mOemManaged;
+    final long mTransportTypesBits;
 
     /** @hide */
     public NetworkIdentity(
             int type, int ratType, @Nullable String subscriberId, @Nullable String wifiNetworkKey,
-            boolean roaming, boolean metered, boolean defaultNetwork, int oemManaged, int subId) {
+            boolean roaming, boolean metered, boolean defaultNetwork, int oemManaged, int subId,
+            long transportTypesBits) {
         mType = type;
         mRatType = ratType;
         mSubscriberId = subscriberId;
@@ -115,25 +118,26 @@ public class NetworkIdentity {
         mDefaultNetwork = defaultNetwork;
         mOemManaged = oemManaged;
         mSubId = subId;
+        mTransportTypesBits = transportTypesBits;
     }
 
     @Override
     public int hashCode() {
         return Objects.hash(mType, mRatType, mSubscriberId, mWifiNetworkKey, mRoaming, mMetered,
-                mDefaultNetwork, mOemManaged, mSubId);
+                mDefaultNetwork, mOemManaged, mSubId, mTransportTypesBits);
     }
 
     @Override
     public boolean equals(@Nullable Object obj) {
-        if (obj instanceof NetworkIdentity) {
-            final NetworkIdentity ident = (NetworkIdentity) obj;
+        if (obj instanceof NetworkIdentity ident) {
             return mType == ident.mType && mRatType == ident.mRatType && mRoaming == ident.mRoaming
                     && Objects.equals(mSubscriberId, ident.mSubscriberId)
                     && Objects.equals(mWifiNetworkKey, ident.mWifiNetworkKey)
                     && mMetered == ident.mMetered
                     && mDefaultNetwork == ident.mDefaultNetwork
                     && mOemManaged == ident.mOemManaged
-                    && mSubId == ident.mSubId;
+                    && mSubId == ident.mSubId
+                    && mTransportTypesBits == ident.mTransportTypesBits;
         }
         return false;
     }
@@ -162,6 +166,8 @@ public class NetworkIdentity {
         builder.append(", defaultNetwork=").append(mDefaultNetwork);
         builder.append(", oemManaged=").append(getOemManagedNames(mOemManaged));
         builder.append(", subId=").append(mSubId);
+        // TODO: Print human friendly names instead.
+        builder.append(", transports=").append(getTransportTypes());
         return builder.append("}").toString();
     }
 
@@ -204,7 +210,7 @@ public class NetworkIdentity {
         proto.write(NetworkIdentityProto.METERED, mMetered);
         proto.write(NetworkIdentityProto.DEFAULT_NETWORK, mDefaultNetwork);
         proto.write(NetworkIdentityProto.OEM_MANAGED_NETWORK, mOemManaged);
-
+        proto.write(NetworkIdentityProto.TRANSPORT_TYPES, mTransportTypesBits);
         proto.end(start);
     }
 
@@ -273,6 +279,14 @@ public class NetworkIdentity {
         return mSubId;
     }
 
+    /**
+     * Get transport types
+     * @hide
+     */
+    public Set<Integer> getTransportTypes() {
+        return intArrayToSet(BitUtils.unpackBits(mTransportTypesBits));
+    }
+
     /**
      * Assemble a {@link NetworkIdentity} from the passed arguments.
      *
@@ -322,6 +336,9 @@ public class NetworkIdentity {
     public static int compare(@NonNull NetworkIdentity left, @NonNull NetworkIdentity right) {
         Objects.requireNonNull(right);
         int res = Integer.compare(left.mType, right.mType);
+        if (res == 0) {
+            res = Long.compare(left.mTransportTypesBits, right.mTransportTypesBits);
+        }
         if (res == 0) {
             res = Integer.compare(left.mRatType, right.mRatType);
         }
@@ -362,6 +379,7 @@ public class NetworkIdentity {
         private boolean mDefaultNetwork;
         private int mOemManaged;
         private int mSubId;
+        private long mTransportTypes;
 
         /**
          * Creates a new Builder.
@@ -377,6 +395,7 @@ public class NetworkIdentity {
             mDefaultNetwork = false;
             mOemManaged = NetworkTemplate.OEM_MANAGED_NO;
             mSubId = INVALID_SUBSCRIPTION_ID;
+            mTransportTypes = 0L;
         }
 
         /**
@@ -389,6 +408,7 @@ public class NetworkIdentity {
          *  - metered
          *  - oemManaged
          *  - wifiNetworkKey
+         *  - transportTypes
          *
          * @param snapshot The target {@link NetworkStateSnapshot} object.
          * @return The builder object.
@@ -397,6 +417,7 @@ public class NetworkIdentity {
         @NonNull
         public Builder setNetworkStateSnapshot(@NonNull NetworkStateSnapshot snapshot) {
             setType(snapshot.getLegacyType());
+            setTransportTypes(intArrayToSet(snapshot.getNetworkCapabilities().getTransportTypes()));
 
             setSubscriberId(snapshot.getSubscriberId());
             setRoaming(!snapshot.getNetworkCapabilities().hasCapability(
@@ -406,6 +427,7 @@ public class NetworkIdentity {
 
             setOemManaged(getOemBitfield(snapshot.getNetworkCapabilities()));
 
+            // TODO: Use the transports instead.
             if (mType == TYPE_WIFI) {
                 final NetworkCapabilities nc = snapshot.getNetworkCapabilities();
                 final TransportInfo transportInfo = nc.getTransportInfo();
@@ -580,6 +602,17 @@ public class NetworkIdentity {
             return this;
         }
 
+        /**
+         * Set the transport types.
+         *
+         * @hide
+         */
+        @NonNull
+        public Builder setTransportTypes(Set<Integer> transportTypes) {
+            mTransportTypes = BitUtils.packBits(CollectionUtils.toIntArray(transportTypes));
+            return this;
+        }
+
         private void ensureValidParameters() {
             // Assert non-mobile network cannot have a ratType.
             if (mType != TYPE_MOBILE && mRatType != NetworkTemplate.NETWORK_TYPE_ALL) {
@@ -602,7 +635,7 @@ public class NetworkIdentity {
         public NetworkIdentity build() {
             ensureValidParameters();
             return new NetworkIdentity(mType, mRatType, mSubscriberId, mWifiNetworkKey,
-                    mRoaming, mMetered, mDefaultNetwork, mOemManaged, mSubId);
+                    mRoaming, mMetered, mDefaultNetwork, mOemManaged, mSubId, mTransportTypes);
         }
     }
 }
diff --git a/framework-t/src/android/net/NetworkIdentitySet.java b/framework-t/src/android/net/NetworkIdentitySet.java
index d88408eef0..a0b3d3dec2 100644
--- a/framework-t/src/android/net/NetworkIdentitySet.java
+++ b/framework-t/src/android/net/NetworkIdentitySet.java
@@ -19,10 +19,17 @@ package android.net;
 import static android.net.ConnectivityManager.TYPE_MOBILE;
 import static android.telephony.SubscriptionManager.INVALID_SUBSCRIPTION_ID;
 
+import static com.android.net.module.util.CollectionUtils.toIntArray;
+import static com.android.net.module.util.NetworkCapabilitiesUtils.deduceTransportTypeForLegacyNetworkType;
+
 import android.annotation.NonNull;
 import android.service.NetworkIdentitySetProto;
 import android.util.proto.ProtoOutputStream;
 
+import androidx.annotation.VisibleForTesting;
+
+import com.android.net.module.util.BitUtils;
+
 import java.io.DataInput;
 import java.io.DataOutput;
 import java.io.IOException;
@@ -44,6 +51,7 @@ public class NetworkIdentitySet extends HashSet<NetworkIdentity> {
     private static final int VERSION_ADD_DEFAULT_NETWORK = 5;
     private static final int VERSION_ADD_OEM_MANAGED_NETWORK = 6;
     private static final int VERSION_ADD_SUB_ID = 7;
+    private static final int VERSION_ADD_TRANSPORT_TYPES = 8;
 
     /**
      * Construct a {@link NetworkIdentitySet} object.
@@ -112,8 +120,23 @@ public class NetworkIdentitySet extends HashSet<NetworkIdentity> {
                 subId = INVALID_SUBSCRIPTION_ID;
             }
 
+            final long transportTypesBits;
+            if (version >= VERSION_ADD_TRANSPORT_TYPES) {
+                transportTypesBits = in.readLong();
+            } else {
+                final int deducedTransport = deduceTransportTypeForLegacyNetworkType(type);
+                if (deducedTransport != -1) {
+                    transportTypesBits = BitUtils.packBits(new int[]{ deducedTransport });
+                } else {
+                    // Ignore legacy or unknown types. This is fine since this means
+                    // the legacy data cannot be queried by transport types,
+                    // which is not even supported now.
+                    transportTypesBits = 0;
+                }
+            }
+
             add(new NetworkIdentity(type, ratType, subscriberId, networkId, roaming, metered,
-                    defaultNetwork, oemNetCapabilities, subId));
+                    defaultNetwork, oemNetCapabilities, subId, transportTypesBits));
         }
     }
 
@@ -122,7 +145,7 @@ public class NetworkIdentitySet extends HashSet<NetworkIdentity> {
      * @hide
      */
     public void writeToStream(DataOutput out) throws IOException {
-        out.writeInt(VERSION_ADD_SUB_ID);
+        out.writeInt(VERSION_ADD_TRANSPORT_TYPES);
         out.writeInt(size());
         for (NetworkIdentity ident : this) {
             out.writeInt(ident.getType());
@@ -134,6 +157,7 @@ public class NetworkIdentitySet extends HashSet<NetworkIdentity> {
             out.writeBoolean(ident.isDefaultNetwork());
             out.writeInt(ident.getOemManaged());
             out.writeInt(ident.getSubId());
+            out.writeLong(BitUtils.packBits(toIntArray(ident.getTransportTypes())));
         }
     }
 
@@ -186,7 +210,13 @@ public class NetworkIdentitySet extends HashSet<NetworkIdentity> {
         return true;
     }
 
-    private static void writeOptionalString(DataOutput out, String value) throws IOException {
+    /**
+     * Writes an optional string to a {@link DataOutput} stream.
+     *
+     * @hide
+     */
+    @VisibleForTesting
+    public static void writeOptionalString(DataOutput out, String value) throws IOException {
         if (value != null) {
             out.writeByte(1);
             out.writeUTF(value);
diff --git a/framework-t/src/android/net/NetworkTemplate.java b/framework-t/src/android/net/NetworkTemplate.java
index 77b166cc3a..0e9e8d1dde 100644
--- a/framework-t/src/android/net/NetworkTemplate.java
+++ b/framework-t/src/android/net/NetworkTemplate.java
@@ -37,6 +37,8 @@ import static android.net.NetworkStats.ROAMING_ALL;
 import static android.net.NetworkStats.ROAMING_NO;
 import static android.net.NetworkStats.ROAMING_YES;
 
+import static com.android.net.module.util.NetworkCapabilitiesUtils.TYPE_TEST;
+
 import android.annotation.IntDef;
 import android.annotation.NonNull;
 import android.annotation.Nullable;
@@ -870,7 +872,7 @@ public final class NetworkTemplate implements Parcelable {
      * all test networks would be matched.
      */
     private boolean matchesTest(NetworkIdentity ident) {
-        return ident.mType == NetworkIdentity.TYPE_TEST
+        return ident.mType == TYPE_TEST
                 && ((CollectionUtils.isEmpty(mMatchWifiNetworkKeys)
                 || CollectionUtils.contains(mMatchWifiNetworkKeys, ident.mWifiNetworkKey)));
     }
diff --git a/framework/proto/netstats.proto b/framework/proto/netstats.proto
index 3c9f73cc57..24e8714dcf 100644
--- a/framework/proto/netstats.proto
+++ b/framework/proto/netstats.proto
@@ -64,6 +64,8 @@ message NetworkIdentityProto {
   optional bool default_network = 6;
 
   optional int32 oem_managed_network = 7;
+
+  optional int64 transport_types = 8;
 }
 
 // Corresponds to NetworkStatsRecorder.
diff --git a/staticlibs/framework/com/android/net/module/util/CollectionUtils.java b/staticlibs/framework/com/android/net/module/util/CollectionUtils.java
index 760d849d42..df8d9f6030 100644
--- a/staticlibs/framework/com/android/net/module/util/CollectionUtils.java
+++ b/staticlibs/framework/com/android/net/module/util/CollectionUtils.java
@@ -19,6 +19,7 @@ package com.android.net.module.util;
 import android.annotation.NonNull;
 import android.annotation.Nullable;
 import android.util.ArrayMap;
+import android.util.ArraySet;
 import android.util.Pair;
 import android.util.SparseArray;
 
@@ -27,6 +28,7 @@ import java.util.ArrayList;
 import java.util.Collection;
 import java.util.List;
 import java.util.Objects;
+import java.util.Set;
 import java.util.function.Function;
 import java.util.function.Predicate;
 
@@ -51,6 +53,18 @@ public final class CollectionUtils {
         return collection == null || collection.isEmpty();
     }
 
+    /**
+     * Convert an int array to a Integer set.
+     */
+    @NonNull
+    public static Set<Integer> intArrayToSet(@NonNull int[] array) {
+        final Set<Integer> set = new ArraySet<>();
+        for (int item : array) {
+            set.add(item);
+        }
+        return set;
+    }
+
     /**
      * Returns an int array from the given Integer list.
      */
diff --git a/staticlibs/framework/com/android/net/module/util/NetworkCapabilitiesUtils.java b/staticlibs/framework/com/android/net/module/util/NetworkCapabilitiesUtils.java
index 7066131618..710022caaa 100644
--- a/staticlibs/framework/com/android/net/module/util/NetworkCapabilitiesUtils.java
+++ b/staticlibs/framework/com/android/net/module/util/NetworkCapabilitiesUtils.java
@@ -16,6 +16,12 @@
 
 package com.android.net.module.util;
 
+import static android.net.ConnectivityManager.TYPE_BLUETOOTH;
+import static android.net.ConnectivityManager.TYPE_ETHERNET;
+import static android.net.ConnectivityManager.TYPE_MOBILE;
+import static android.net.ConnectivityManager.TYPE_PROXY;
+import static android.net.ConnectivityManager.TYPE_VPN;
+import static android.net.ConnectivityManager.TYPE_WIFI;
 import static android.net.NetworkCapabilities.NET_CAPABILITY_BIP;
 import static android.net.NetworkCapabilities.NET_CAPABILITY_CBS;
 import static android.net.NetworkCapabilities.NET_CAPABILITY_DUN;
@@ -40,13 +46,13 @@ import static android.net.NetworkCapabilities.TRANSPORT_BLUETOOTH;
 import static android.net.NetworkCapabilities.TRANSPORT_CELLULAR;
 import static android.net.NetworkCapabilities.TRANSPORT_ETHERNET;
 import static android.net.NetworkCapabilities.TRANSPORT_SATELLITE;
+import static android.net.NetworkCapabilities.TRANSPORT_TEST;
 import static android.net.NetworkCapabilities.TRANSPORT_USB;
 import static android.net.NetworkCapabilities.TRANSPORT_VPN;
 import static android.net.NetworkCapabilities.TRANSPORT_WIFI;
 import static android.net.NetworkCapabilities.TRANSPORT_WIFI_AWARE;
 
 import static com.android.net.module.util.BitUtils.packBits;
-import static com.android.net.module.util.BitUtils.unpackBits;
 
 import android.annotation.NonNull;
 import android.net.NetworkCapabilities;
@@ -58,6 +64,10 @@ import com.android.internal.annotations.VisibleForTesting;
  * @hide
  */
 public final class NetworkCapabilitiesUtils {
+    // Need to be synchronized with ConnectivityManager.
+    // TODO: Use {@code ConnectivityManager#*} when visible.
+    public static final int TYPE_TEST = 18;
+
     // Transports considered to classify networks in UI, in order of which transport should be
     // surfaced when there are multiple transports. Transports not in this list do not have
     // an ordering preference (in practice they will have a deterministic order based on the
@@ -150,6 +160,32 @@ public final class NetworkCapabilitiesUtils {
         return transports[0];
     }
 
+    /**
+     * Deduces the primary NetworkCapabilities.TRANSPORT_* type from a legacy
+     * ConnectivityManager.TYPE_* network type.
+     *
+     * This is used to deduce transport type for legacy persistent NetworkStats files
+     * with NetworkIdentitySet version under VERSION_ADD_TRANSPORT_TYPES.
+     *
+     * @param legacyNetworkType One of the deprecated ConnectivityManager.TYPE_* constants
+     *        (e.g., ConnectivityManager.TYPE_WIFI, ConnectivityManager.TYPE_MOBILE).
+     * @return The corresponding NetworkCapabilities.TRANSPORT_* constant, or
+     *         -1 if no direct or clear mapping exists or unknown.
+     */
+    public static int deduceTransportTypeForLegacyNetworkType(int legacyNetworkType) {
+        return switch (legacyNetworkType) {
+            case TYPE_WIFI -> TRANSPORT_WIFI;
+            case TYPE_MOBILE -> TRANSPORT_CELLULAR;
+            case TYPE_ETHERNET -> TRANSPORT_ETHERNET;
+            case TYPE_VPN -> TRANSPORT_VPN;
+            // TYPE_PROXY (deprecated) historically represented a network primarily
+            // for proxying traffic, often over Bluetooth (e.g., on Wear OS devices
+            // tethered to a phone). See ProxyNetworkAgent (deprecated) for more detail.
+            case TYPE_BLUETOOTH, TYPE_PROXY -> TRANSPORT_BLUETOOTH;
+            case TYPE_TEST -> TRANSPORT_TEST;
+            default -> -1; // Ignore legacy types such as TYPE_WIMAX, TYPE_MOBILE_*, etc.
+        };
+    }
 
     /**
      * Infers that all the capabilities it provides are typically provided by restricted networks
diff --git a/staticlibs/tests/unit/src/com/android/net/module/util/CollectionUtilsTest.kt b/staticlibs/tests/unit/src/com/android/net/module/util/CollectionUtilsTest.kt
index 1aa943e015..84548fbe5d 100644
--- a/staticlibs/tests/unit/src/com/android/net/module/util/CollectionUtilsTest.kt
+++ b/staticlibs/tests/unit/src/com/android/net/module/util/CollectionUtilsTest.kt
@@ -19,15 +19,16 @@ package com.android.net.module.util
 import android.util.SparseArray
 import androidx.test.filters.SmallTest
 import androidx.test.runner.AndroidJUnit4
+import com.android.net.module.util.CollectionUtils.intArrayToSet
 import kotlin.test.assertContentEquals
-import org.junit.Test
-import org.junit.runner.RunWith
 import kotlin.test.assertEquals
 import kotlin.test.assertFailsWith
 import kotlin.test.assertFalse
 import kotlin.test.assertNull
 import kotlin.test.assertSame
 import kotlin.test.assertTrue
+import org.junit.Test
+import org.junit.runner.RunWith
 
 @RunWith(AndroidJUnit4::class)
 @SmallTest
@@ -144,13 +145,19 @@ class CollectionUtilsTest {
         val listAE = listOf("A", "B", "C", "D", "E")
         val list15 = listOf(1, 2, 3, 4, 5)
         // Normal #zip returns kotlin.Pair, not android.util.Pair
-        assertEquals(list15.zip(listAE).map { android.util.Pair(it.first, it.second) },
-                CollectionUtils.zip(list15, listAE))
+        assertEquals(
+                list15.zip(listAE).map { android.util.Pair(it.first, it.second) },
+                CollectionUtils.zip(list15, listAE)
+        )
         val listNull = listOf("A", null, "B", "C", "D")
-        assertEquals(list15.zip(listNull).map { android.util.Pair(it.first, it.second) },
-                CollectionUtils.zip(list15, listNull))
-        assertEquals(emptyList<android.util.Pair<Int, Int>>(),
-                CollectionUtils.zip(emptyList<Int>(), emptyList<Int>()))
+        assertEquals(
+                list15.zip(listNull).map { android.util.Pair(it.first, it.second) },
+                CollectionUtils.zip(list15, listNull)
+        )
+        assertEquals(
+                emptyList<android.util.Pair<Int, Int>>(),
+                CollectionUtils.zip(emptyList<Int>(), emptyList<Int>())
+        )
         assertFailsWith<IllegalArgumentException> {
             // Different size
             CollectionUtils.zip(listOf(1, 2), list15)
@@ -280,4 +287,12 @@ class CollectionUtilsTest {
                 CollectionUtils.appendArray(String::class.java, stringArr1, "4", "5", "6")
         )
     }
+
+    @Test
+    fun intArrayToSet_arrayWithDuplicateElements_returnsSetWithUniqueElements() {
+        val inputArray = intArrayOf(1, 2, 2, 3, 4, 4, 4, 5, 1)
+        val expectedSet = setOf(1, 2, 3, 4, 5)
+        val result = intArrayToSet(inputArray)
+        assertEquals(expectedSet, result)
+    }
 }
diff --git a/tests/unit/java/android/net/NetworkIdentitySetTest.kt b/tests/unit/java/android/net/NetworkIdentitySetTest.kt
index d61ebf97be..cf94e84d4c 100644
--- a/tests/unit/java/android/net/NetworkIdentitySetTest.kt
+++ b/tests/unit/java/android/net/NetworkIdentitySetTest.kt
@@ -17,15 +17,32 @@
 package android.net
 
 import android.content.Context
+import android.net.ConnectivityManager.TYPE_BLUETOOTH
+import android.net.ConnectivityManager.TYPE_ETHERNET
 import android.net.ConnectivityManager.TYPE_MOBILE
+import android.net.ConnectivityManager.TYPE_VPN
+import android.net.ConnectivityManager.TYPE_WIFI
+import android.net.ConnectivityManager.TYPE_WIMAX
+import android.net.NetworkCapabilities.TRANSPORT_BLUETOOTH
+import android.net.NetworkCapabilities.TRANSPORT_CELLULAR
+import android.net.NetworkCapabilities.TRANSPORT_ETHERNET
+import android.net.NetworkCapabilities.TRANSPORT_TEST
+import android.net.NetworkCapabilities.TRANSPORT_VPN
+import android.net.NetworkCapabilities.TRANSPORT_WIFI
+import android.net.NetworkIdentitySet.writeOptionalString
 import android.os.Build
 import android.telephony.TelephonyManager
+import com.android.net.module.util.NetworkCapabilitiesUtils.TYPE_TEST
 import com.android.testutils.DevSdkIgnoreRule
 import com.android.testutils.DevSdkIgnoreRunner
+import java.io.ByteArrayInputStream
+import java.io.ByteArrayOutputStream
+import java.io.DataInputStream
+import java.io.DataOutputStream
+import kotlin.test.assertEquals
 import org.junit.Test
 import org.junit.runner.RunWith
 import org.mockito.Mockito.mock
-import kotlin.test.assertEquals
 
 private const val TEST_IMSI1 = "testimsi1"
 
@@ -34,22 +51,54 @@ private const val TEST_IMSI1 = "testimsi1"
 class NetworkIdentitySetTest {
     private val mockContext = mock(Context::class.java)
 
-    private fun buildMobileNetworkStateSnapshot(
-        caps: NetworkCapabilities,
-        subscriberId: String
+    private fun buildMobileNetworkStateSnapshot(subscriberId: String) =
+            buildNetworkStateSnapshot(NetworkCapabilities(), subscriberId, TYPE_MOBILE)
+
+    private fun buildNetworkStateSnapshot(
+            caps: NetworkCapabilities,
+            subscriberId: String,
+            legacyNetworkType: Int
     ): NetworkStateSnapshot {
-        return NetworkStateSnapshot(mock(Network::class.java), caps,
-                LinkProperties(), subscriberId, TYPE_MOBILE)
+        return NetworkStateSnapshot(
+                mock(Network::class.java),
+                caps,
+                LinkProperties(),
+                subscriberId,
+                legacyNetworkType
+        )
+    }
+
+    private fun buildNetworkIdentity(
+            legacyNetworkType: Int,
+            vararg transportTypes: Int
+    ): NetworkIdentity {
+        val caps = NetworkCapabilities().apply {
+            transportTypes.forEach {
+                addTransportType(it)
+            }
+        }
+        return NetworkIdentity.buildNetworkIdentity(
+                mockContext,
+                buildNetworkStateSnapshot(caps, TEST_IMSI1, legacyNetworkType),
+                false,
+                0
+        )
     }
 
     @Test
     fun testCompare() {
-        val ident1 = NetworkIdentity.buildNetworkIdentity(mockContext,
-            buildMobileNetworkStateSnapshot(NetworkCapabilities(), TEST_IMSI1),
-            false /* defaultNetwork */, TelephonyManager.NETWORK_TYPE_UMTS)
-        val ident2 = NetworkIdentity.buildNetworkIdentity(mockContext,
-            buildMobileNetworkStateSnapshot(NetworkCapabilities(), TEST_IMSI1),
-            true /* defaultNetwork */, TelephonyManager.NETWORK_TYPE_UMTS)
+        val ident1 = NetworkIdentity.buildNetworkIdentity(
+                mockContext,
+                buildMobileNetworkStateSnapshot(TEST_IMSI1),
+                false /* defaultNetwork */,
+                TelephonyManager.NETWORK_TYPE_UMTS
+        )
+        val ident2 = NetworkIdentity.buildNetworkIdentity(
+                mockContext,
+                buildMobileNetworkStateSnapshot(TEST_IMSI1),
+                true /* defaultNetwork */,
+                TelephonyManager.NETWORK_TYPE_UMTS
+        )
 
         // Verify that the results of comparing two empty sets are equal
         assertEquals(0, NetworkIdentitySet.compare(NetworkIdentitySet(), NetworkIdentitySet()))
@@ -63,4 +112,76 @@ class NetworkIdentitySetTest {
         assertEquals(0, NetworkIdentitySet.compare(identSet1, identSet1))
         assertEquals(-1, NetworkIdentitySet.compare(identSet1, identSet2))
     }
+
+    @Test
+    fun testTransportTypesSerialization() {
+        val originalSet = NetworkIdentitySet()
+        originalSet.add(buildNetworkIdentity(TYPE_MOBILE, TRANSPORT_CELLULAR))
+        originalSet.add(buildNetworkIdentity(TYPE_WIFI, TRANSPORT_VPN, TRANSPORT_WIFI))
+
+        val baos = ByteArrayOutputStream()
+        val outDataStream = DataOutputStream(baos)
+        originalSet.writeToStream(outDataStream)
+
+        val bais = ByteArrayInputStream(baos.toByteArray())
+        val inDataStream = DataInputStream(bais)
+        val deserializedSet = NetworkIdentitySet(inDataStream)
+
+        assertEquals(originalSet, deserializedSet)
+    }
+
+    /**
+     * Writes a single NetworkIdentity to the stream in a specific older version format.
+     * This simulates an old saved state.
+     * Version: VERSION_ADD_SUB_ID (7), which does NOT include transportTypesBits explicitly.
+     */
+    private fun writeNetworkIdentityV7(out: DataOutputStream, ident: NetworkIdentity) {
+        out.writeInt(7) // Write the old version number
+        out.writeInt(1) // Number of identities in the set
+        out.writeInt(ident.type)
+        out.writeInt(ident.ratType)
+        writeOptionalString(out, ident.subscriberId)
+        writeOptionalString(out, ident.wifiNetworkKey)
+        out.writeBoolean(ident.isRoaming)
+        out.writeBoolean(ident.isMetered)
+        out.writeBoolean(ident.isDefaultNetwork)
+        out.writeInt(ident.oemManaged)
+        out.writeInt(ident.subId)
+        // V7 and earlier versions DO NOT write transportTypesBits
+    }
+
+    @Test
+    fun testMigrateToSupportTransportTypes() {
+        doTestMigrateToSupportTransportTypes(TYPE_MOBILE, TRANSPORT_CELLULAR)
+        doTestMigrateToSupportTransportTypes(TYPE_WIFI, TRANSPORT_WIFI)
+        doTestMigrateToSupportTransportTypes(TYPE_BLUETOOTH, TRANSPORT_BLUETOOTH)
+        doTestMigrateToSupportTransportTypes(TYPE_ETHERNET, TRANSPORT_ETHERNET)
+        doTestMigrateToSupportTransportTypes(TYPE_VPN, TRANSPORT_VPN)
+        doTestMigrateToSupportTransportTypes(TYPE_TEST, TRANSPORT_TEST)
+        doTestMigrateToSupportTransportTypes(TYPE_WIMAX)
+    }
+
+    private fun doTestMigrateToSupportTransportTypes(
+            legacyNetworkType: Int,
+            vararg expectedTransportTypes: Int
+    ) {
+        val ident = buildNetworkIdentity(legacyNetworkType)
+
+        val baos = ByteArrayOutputStream()
+        val outDataStream = DataOutputStream(baos)
+        writeNetworkIdentityV7(outDataStream, ident)
+
+        val bais = ByteArrayInputStream(baos.toByteArray())
+        val inDataStream = DataInputStream(bais)
+        val deserializedSet = NetworkIdentitySet(inDataStream)
+
+        // Prepare the expected identity set, verify the transport type deduced from
+        // the legacy network type.
+        val expectedIdent = buildNetworkIdentity(legacyNetworkType, *expectedTransportTypes)
+        val expectedSet = NetworkIdentitySet().also {
+            it.add(expectedIdent)
+        }
+
+        assertEquals(expectedSet, deserializedSet)
+    }
 }
diff --git a/tests/unit/java/android/net/NetworkIdentityTest.kt b/tests/unit/java/android/net/NetworkIdentityTest.kt
index 9667f8fbd3..60f35c270d 100644
--- a/tests/unit/java/android/net/NetworkIdentityTest.kt
+++ b/tests/unit/java/android/net/NetworkIdentityTest.kt
@@ -16,6 +16,7 @@
 
 package android.net
 
+import android.app.usage.NetworkStatsManager
 import android.content.Context
 import android.net.ConnectivityManager.MAX_NETWORK_TYPE
 import android.net.ConnectivityManager.TYPE_ETHERNET
@@ -23,22 +24,26 @@ import android.net.ConnectivityManager.TYPE_MOBILE
 import android.net.ConnectivityManager.TYPE_NONE
 import android.net.ConnectivityManager.TYPE_WIFI
 import android.net.NetworkCapabilities.TRANSPORT_CELLULAR
+import android.net.NetworkCapabilities.TRANSPORT_ETHERNET
+import android.net.NetworkCapabilities.TRANSPORT_SATELLITE
+import android.net.NetworkCapabilities.TRANSPORT_VPN
+import android.net.NetworkCapabilities.TRANSPORT_WIFI
 import android.net.NetworkIdentity.OEM_NONE
 import android.net.NetworkIdentity.OEM_PAID
 import android.net.NetworkIdentity.OEM_PRIVATE
 import android.net.NetworkIdentity.getOemBitfield
-import android.app.usage.NetworkStatsManager
-import android.telephony.TelephonyManager
 import android.os.Build
+import android.telephony.TelephonyManager
+import com.android.net.module.util.BitUtils
 import com.android.testutils.DevSdkIgnoreRule
 import com.android.testutils.DevSdkIgnoreRunner
-import org.junit.Test
-import org.junit.runner.RunWith
-import org.mockito.Mockito.mock
 import kotlin.test.assertEquals
 import kotlin.test.assertFailsWith
 import kotlin.test.assertFalse
 import kotlin.test.assertTrue
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.mockito.Mockito.mock
 
 private const val TEST_WIFI_KEY = "testwifikey"
 private const val TEST_IMSI1 = "testimsi1"
@@ -52,11 +57,16 @@ class NetworkIdentityTest {
     private val mockContext = mock(Context::class.java)
 
     private fun buildMobileNetworkStateSnapshot(
-        caps: NetworkCapabilities,
-        subscriberId: String
+            caps: NetworkCapabilities,
+            subscriberId: String
     ): NetworkStateSnapshot {
-        return NetworkStateSnapshot(mock(Network::class.java), caps,
-                LinkProperties(), subscriberId, TYPE_MOBILE)
+        return NetworkStateSnapshot(
+                mock(Network::class.java),
+                caps,
+                LinkProperties(),
+                subscriberId,
+                TYPE_MOBILE
+        )
     }
 
     @Test
@@ -87,18 +97,24 @@ class NetworkIdentityTest {
     @Test
     fun testIsMetered() {
         // Verify network is metered.
-        val netIdent1 = NetworkIdentity.buildNetworkIdentity(mockContext,
+        val netIdent1 = NetworkIdentity.buildNetworkIdentity(
+                mockContext,
                 buildMobileNetworkStateSnapshot(NetworkCapabilities(), TEST_IMSI1),
-                false /* defaultNetwork */, TelephonyManager.NETWORK_TYPE_UMTS)
+                false /* defaultNetwork */,
+                TelephonyManager.NETWORK_TYPE_UMTS
+        )
         assertTrue(netIdent1.isMetered())
 
         // Verify network is not metered because it has NET_CAPABILITY_NOT_METERED capability.
         val capsNotMetered = NetworkCapabilities.Builder().apply {
             addCapability(NetworkCapabilities.NET_CAPABILITY_NOT_METERED)
         }.build()
-        val netIdent2 = NetworkIdentity.buildNetworkIdentity(mockContext,
+        val netIdent2 = NetworkIdentity.buildNetworkIdentity(
+                mockContext,
                 buildMobileNetworkStateSnapshot(capsNotMetered, TEST_IMSI1),
-                false /* defaultNetwork */, TelephonyManager.NETWORK_TYPE_UMTS)
+                false /* defaultNetwork */,
+                TelephonyManager.NETWORK_TYPE_UMTS
+        )
         assertFalse(netIdent2.isMetered())
 
         // In current design, a network that has NET_CAPABILITY_TEMPORARILY_NOT_METERED
@@ -106,9 +122,12 @@ class NetworkIdentityTest {
         val capsTempNotMetered = NetworkCapabilities().apply {
             setCapability(NetworkCapabilities.NET_CAPABILITY_TEMPORARILY_NOT_METERED, true)
         }
-        val netIdent3 = NetworkIdentity.buildNetworkIdentity(mockContext,
+        val netIdent3 = NetworkIdentity.buildNetworkIdentity(
+                mockContext,
                 buildMobileNetworkStateSnapshot(capsTempNotMetered, TEST_IMSI1),
-                false /* defaultNetwork */, TelephonyManager.NETWORK_TYPE_UMTS)
+                false /* defaultNetwork */,
+                TelephonyManager.NETWORK_TYPE_UMTS
+        )
         assertTrue(netIdent3.isMetered())
     }
 
@@ -122,15 +141,20 @@ class NetworkIdentityTest {
             setNetworkSpecifier(specifier1)
         }
         val identFromSnapshot = NetworkIdentity.Builder().setNetworkStateSnapshot(
-                buildMobileNetworkStateSnapshot(oemPrivateRoamingNotMeteredCap, TEST_IMSI1))
+                buildMobileNetworkStateSnapshot(oemPrivateRoamingNotMeteredCap, TEST_IMSI1)
+        )
                 .setDefaultNetwork(true)
                 .setRatType(TelephonyManager.NETWORK_TYPE_UMTS)
                 .setSubId(TEST_SUBID1)
                 .build()
-        val identFromLegacyBuild = NetworkIdentity.buildNetworkIdentity(mockContext,
+        val identFromLegacyBuild = NetworkIdentity.buildNetworkIdentity(
+                mockContext,
                 buildMobileNetworkStateSnapshot(oemPrivateRoamingNotMeteredCap, TEST_IMSI1),
-                true /* defaultNetwork */, TelephonyManager.NETWORK_TYPE_UMTS)
-        val identFromConstructor = NetworkIdentity(TYPE_MOBILE,
+                true /* defaultNetwork */,
+                TelephonyManager.NETWORK_TYPE_UMTS
+        )
+        val identFromConstructor = NetworkIdentity(
+                TYPE_MOBILE,
                 TelephonyManager.NETWORK_TYPE_UMTS,
                 TEST_IMSI1,
                 null /* wifiNetworkKey */,
@@ -138,7 +162,9 @@ class NetworkIdentityTest {
                 false /* metered */,
                 true /* defaultNetwork */,
                 NetworkTemplate.OEM_MANAGED_PRIVATE,
-                TEST_SUBID1)
+                TEST_SUBID1,
+                BitUtils.packBits(intArrayOf(TRANSPORT_CELLULAR))
+        )
         assertEquals(identFromLegacyBuild, identFromSnapshot)
         assertEquals(identFromConstructor, identFromSnapshot)
 
@@ -180,8 +206,12 @@ class NetworkIdentityTest {
     @Test
     fun testBuilder_ratType() {
         // Assert illegal ratTypes cannot make an identity.
-        listOf(Integer.MIN_VALUE, NetworkTemplate.NETWORK_TYPE_ALL,
-                NetworkStatsManager.NETWORK_TYPE_5G_NSA - 1, Integer.MAX_VALUE)
+        listOf(
+                Integer.MIN_VALUE,
+                NetworkTemplate.NETWORK_TYPE_ALL,
+                NetworkStatsManager.NETWORK_TYPE_5G_NSA - 1,
+                Integer.MAX_VALUE
+        )
                 .forEach {
                     assertFailsWith<IllegalArgumentException> {
                         NetworkIdentity.Builder()
@@ -208,8 +238,12 @@ class NetworkIdentityTest {
     @Test
     fun testBuilder_oemManaged() {
         // Assert illegal oemManage values cannot make an identity.
-        listOf(Integer.MIN_VALUE, NetworkTemplate.OEM_MANAGED_ALL, NetworkTemplate.OEM_MANAGED_YES,
-                Integer.MAX_VALUE)
+        listOf(
+                Integer.MIN_VALUE,
+                NetworkTemplate.OEM_MANAGED_ALL,
+                NetworkTemplate.OEM_MANAGED_YES,
+                Integer.MAX_VALUE
+        )
                 .forEach { oemManaged ->
                     assertFailsWith<IllegalArgumentException> {
                         NetworkIdentity.Builder()
@@ -220,9 +254,13 @@ class NetworkIdentityTest {
                 }
 
         // Verify legitimate oem managed values can make an identity.
-        listOf(NetworkTemplate.OEM_MANAGED_NO, NetworkTemplate.OEM_MANAGED_PAID,
-                NetworkTemplate.OEM_MANAGED_PRIVATE, NetworkTemplate.OEM_MANAGED_PAID or
-                NetworkTemplate.OEM_MANAGED_PRIVATE)
+        listOf(
+                NetworkTemplate.OEM_MANAGED_NO,
+                NetworkTemplate.OEM_MANAGED_PAID,
+                NetworkTemplate.OEM_MANAGED_PRIVATE,
+                NetworkTemplate.OEM_MANAGED_PAID or
+                NetworkTemplate.OEM_MANAGED_PRIVATE
+        )
                 .forEach { oemManaged ->
                     NetworkIdentity.Builder()
                             .setOemManaged(oemManaged)
@@ -245,14 +283,54 @@ class NetworkIdentityTest {
             setNetworkSpecifier(specifier2)
         }
 
-        val netIdent1 = NetworkIdentity.buildNetworkIdentity(mockContext,
+        val netIdent1 = NetworkIdentity.buildNetworkIdentity(
+                mockContext,
                 buildMobileNetworkStateSnapshot(capSUBID1, TEST_IMSI1),
-                false /* defaultNetwork */, TelephonyManager.NETWORK_TYPE_UMTS)
+                false,
+                TelephonyManager.NETWORK_TYPE_UMTS
+        )
         assertEquals(TEST_SUBID1, netIdent1.getSubId())
 
-        val netIdent2 = NetworkIdentity.buildNetworkIdentity(mockContext,
+        val netIdent2 = NetworkIdentity.buildNetworkIdentity(
+                mockContext,
                 buildMobileNetworkStateSnapshot(capSUBID2, TEST_IMSI2),
-                false /* defaultNetwork */, TelephonyManager.NETWORK_TYPE_UMTS)
+                false,
+                TelephonyManager.NETWORK_TYPE_UMTS
+        )
         assertEquals(TEST_SUBID2, netIdent2.getSubId())
     }
+
+    @Test
+    fun testSetTransportTypes() {
+        doTestSetTransportTypes(setOf())
+        doTestSetTransportTypes(setOf(TRANSPORT_WIFI))
+        doTestSetTransportTypes(setOf(TRANSPORT_CELLULAR, TRANSPORT_VPN, TRANSPORT_ETHERNET))
+    }
+
+    private fun doTestSetTransportTypes(transportTypes: Set<Int>) {
+        val identity = NetworkIdentity.Builder()
+                .setType(TYPE_MOBILE) // legacy type, for builder compatibility
+                .setTransportTypes(transportTypes)
+                .build()
+        assertEquals(transportTypes.toSet(), identity.transportTypes)
+    }
+
+    @Test
+    fun testTransportTypes_fromNetworkStateSnapshot() {
+        val caps = NetworkCapabilities().apply {
+            addTransportType(TRANSPORT_SATELLITE)
+            addTransportType(TRANSPORT_VPN)
+            addTransportType(TRANSPORT_WIFI)
+        }
+        val identity = NetworkIdentity.buildNetworkIdentity(
+                mockContext,
+                buildMobileNetworkStateSnapshot(caps, TEST_IMSI1),
+                false,
+                TelephonyManager.NETWORK_TYPE_UMTS
+        )
+        assertEquals(
+                setOf(TRANSPORT_SATELLITE, TRANSPORT_VPN, TRANSPORT_WIFI),
+                identity.transportTypes
+        )
+    }
 }
diff --git a/tests/unit/java/android/net/NetworkStatsCollectionTest.java b/tests/unit/java/android/net/NetworkStatsCollectionTest.java
index 1af89adde9..5d6f980772 100644
--- a/tests/unit/java/android/net/NetworkStatsCollectionTest.java
+++ b/tests/unit/java/android/net/NetworkStatsCollectionTest.java
@@ -17,6 +17,7 @@
 package android.net;
 
 import static android.net.ConnectivityManager.TYPE_MOBILE;
+import static android.net.NetworkCapabilities.TRANSPORT_CELLULAR;
 import static android.net.NetworkIdentity.OEM_NONE;
 import static android.net.NetworkStats.DEFAULT_NETWORK_NO;
 import static android.net.NetworkStats.IFACE_ALL;
@@ -56,6 +57,7 @@ import androidx.test.InstrumentationRegistry;
 import androidx.test.filters.SmallTest;
 
 import com.android.frameworks.tests.net.R;
+import com.android.net.module.util.BitUtils;
 import com.android.testutils.DevSdkIgnoreRule;
 import com.android.testutils.DevSdkIgnoreRunner;
 
@@ -249,7 +251,8 @@ public class NetworkStatsCollectionTest {
         final NetworkStats.Entry entry = new NetworkStats.Entry();
         final NetworkIdentitySet identSet = new NetworkIdentitySet();
         identSet.add(new NetworkIdentity(TYPE_MOBILE, TelephonyManager.NETWORK_TYPE_UNKNOWN,
-                TEST_IMSI, null, false, true, true, OEM_NONE, TEST_SUBID));
+                TEST_IMSI, null, false, true, true, OEM_NONE, TEST_SUBID,
+                BitUtils.packBits(new int[]{TRANSPORT_CELLULAR})));
 
         int myUid = Process.myUid();
         int otherUidInSameUser = Process.myUid() + 1;
@@ -511,7 +514,8 @@ public class NetworkStatsCollectionTest {
         final NetworkStatsCollection large = new NetworkStatsCollection(HOUR_IN_MILLIS);
         final NetworkIdentitySet ident = new NetworkIdentitySet();
         ident.add(new NetworkIdentity(ConnectivityManager.TYPE_MOBILE, -1, TEST_IMSI, null,
-                false, true, true, OEM_NONE, TEST_SUBID));
+                false, true, true, OEM_NONE, TEST_SUBID,
+                BitUtils.packBits(new int[] {TRANSPORT_CELLULAR})));
         large.recordData(ident, UID_ALL, SET_ALL, TAG_NONE, TIME_A, TIME_B,
                 new NetworkStats.Entry(IFACE_ALL, UID_ALL, SET_DEFAULT, TAG_NONE, METERED_NO,
                 ROAMING_NO, DEFAULT_NETWORK_NO, 12_730_893_164L, 1, 0, 0, 0));
diff --git a/tests/unit/java/com/android/server/net/NetworkStatsObserversTest.java b/tests/unit/java/com/android/server/net/NetworkStatsObserversTest.java
index 10b1396071..617c4ec9d0 100644
--- a/tests/unit/java/com/android/server/net/NetworkStatsObserversTest.java
+++ b/tests/unit/java/com/android/server/net/NetworkStatsObserversTest.java
@@ -17,6 +17,7 @@
 package com.android.server.net;
 
 import static android.net.ConnectivityManager.TYPE_MOBILE;
+import static android.net.NetworkCapabilities.TRANSPORT_CELLULAR;
 import static android.net.NetworkIdentity.OEM_NONE;
 import static android.net.NetworkStats.DEFAULT_NETWORK_NO;
 import static android.net.NetworkStats.DEFAULT_NETWORK_YES;
@@ -54,6 +55,7 @@ import android.util.ArrayMap;
 
 import androidx.test.filters.SmallTest;
 
+import com.android.net.module.util.BitUtils;
 import com.android.testutils.DevSdkIgnoreRule;
 import com.android.testutils.DevSdkIgnoreRunner;
 import com.android.testutils.HandlerUtils;
@@ -300,7 +302,8 @@ public class NetworkStatsObserversTest {
         identSet.add(new NetworkIdentity(
                 TYPE_MOBILE, TelephonyManager.NETWORK_TYPE_UNKNOWN,
                 IMSI_1, null /* networkId */, false /* roaming */, true /* metered */,
-                true /* defaultNetwork */, OEM_NONE, SUBID_1));
+                true /* defaultNetwork */, OEM_NONE, SUBID_1,
+                BitUtils.packBits(new int[] { TRANSPORT_CELLULAR })));
         return identSet;
     }
 

From 0c5d4454866aa07e4ae81c767f7b5b1a9e40903b Mon Sep 17 00:00:00 2001
From: Junyu Lai <junyulai@google.com>
Date: Wed, 21 May 2025 16:55:47 +0800
Subject: [PATCH 297/377] Add atom definition for satellite access info

These fields are needed to answer:
  1. Opt-in uid count in the device
  2. How often do apps get on the satellite network

Test: TH
Flag: EXEMPT atom definition only change
Bug: 419123367
Change-Id: Iefebaa0d54b4b616e1b2a64a3357a0102ef61c1d
---
 service/src/com/android/metrics/stats.proto   | 27 +++++++++++++++++++
 .../android/server/ConnectivityService.java   |  3 ++-
 2 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/service/src/com/android/metrics/stats.proto b/service/src/com/android/metrics/stats.proto
index ecc03779a7..39c50508c1 100644
--- a/service/src/com/android/metrics/stats.proto
+++ b/service/src/com/android/metrics/stats.proto
@@ -238,8 +238,21 @@ message ConnectivityStateSample {
 
     // Full list of network details (slice by transport / meteredness / internet+validated)
     optional NetworkList networks = 4;
+
+    // Information for satellite access.
+    optional SatelliteAccessInfo satellite_access_info = 5;
 }
 
+/**
+ * Pulls information for satellite access.
+ *
+ * Pulled from:
+ *   packages/modules/Connectivity/service/src/com/android/server/ConnectivityService.java
+ */
+message SatelliteAccessInfo {
+    // Number of satellite network opt-in uids on the device.
+    optional int32 optin_uid_count = 1;
+}
 
 /**
  * Pulls information for network selection rematch info.
@@ -274,6 +287,20 @@ message DefaultNetworkRematchInfo {
 
     // The time duration the device kept the old network as the default in seconds
     optional int32 time_duration_on_old_network_sec = 5;
+
+    // Uid ranges which applied to this event.
+    optional UidRanges uid_ranges = 6;
+}
+
+message UidRanges {
+    repeated UidRange uid_range = 1;
+}
+
+// Represents a range of UIDs.
+// The range is inclusive, denoted as [begin, end].
+message UidRange {
+    optional int32 begin = 1;
+    optional int32 end = 2;
 }
 
 /**
diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index 0a74857a6c..716c71332f 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -2741,7 +2741,8 @@ public class ConnectivityService extends IConnectivityManager.Stub
                 sample.getNetworkCountPerTransports().toByteArray(),
                 sample.getConnectionDurationPerTransports().toByteArray(),
                 sample.getNetworkRequestCount().toByteArray(),
-                sample.getNetworks().toByteArray());
+                sample.getNetworks().toByteArray(),
+                sample.getSatelliteAccessInfo().toByteArray());
     }
 
     /**

From a88634cb0860241a77b3446c5f2e41d0331ea3db Mon Sep 17 00:00:00 2001
From: Owner Cleanup Bot
 <swarming-tasks@owners-cleanup-prod.google.com.iam.gserviceaccount.com>
Date: Sun, 25 May 2025 09:49:43 -0700
Subject: [PATCH 298/377] [owners] Remove derekjedral@google.com from
 remoteauth/OWNERS

This suggested change is automatically generated based on group
memberships and affiliations.

Please approve this change and vote the highest CR. This will keep the
OWNERS file tidy. We ask that you do not ignore this change and either
approve it if the OWNER is no longer active or deny it if the OWNER is
continuing to review CLs (including under a different affiliation).
This CL can always be reverted if the understanding changes.

If this change is in error, vote the lowest CR value (i.e. reject the
CL) and the bot will abandon it.

See the owner's recent review activity for context:
https://googleplex-android-review.googlesource.com/q/derekjedral@google.com

To report an issue, file a bug in the Infra>Codereview component.

Change-Id: I39763b4aa22a1bf44ed50170836b86a43b7e943b
---
 remoteauth/OWNERS | 1 -
 1 file changed, 1 deletion(-)

diff --git a/remoteauth/OWNERS b/remoteauth/OWNERS
index ee46c1ce66..a05f57d491 100644
--- a/remoteauth/OWNERS
+++ b/remoteauth/OWNERS
@@ -2,7 +2,6 @@
 # Bug template url: http://b/new?component=1145231&template=1715387
 billyhuang@google.com
 boetger@google.com
-derekjedral@google.com
 dlm@google.com
 igorzas@google.com
 jacobhobbie@google.com

From 75349105d15b7bbb40229599feda1518f4e5878c Mon Sep 17 00:00:00 2001
From: Chalard Jean <jchalard@google.com>
Date: Fri, 23 May 2025 15:55:41 +0900
Subject: [PATCH 299/377] Fix NetworkAgent 4-way binder interlock
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

         System server        |    Client (e.g. phone)
------------------------------|-----------------------------
                              |
NetworkAgentMessageHandler ←--|--- INetworkAgentRegistry
              ↓               |              ↑
                              |         NetworkAgent
        NetworkAgentInfo      |              ↑
              ↓               |      NetworkAgentHandler
                              |              ↑
         INetworkAgent     ---|--→   NetworkAgentBinder

The simplest artifact is observed by watching the output of
adb shell dumpsys meminfo -d phone | grep 'Proxy Binders'
while turning airplane mode on and off (slowly, to allow the
cell network to connect and disconnect).
This will display the number of binder proxies. Before this, the binder
proxy count increases by 2 with each connection and never goes down (there
is some noise, as proxy objects are sometimes created for other reasons,
and get GC'd eventually). After this, the binder proxy count is always
eventually stable.

Also see b/133174607.

Bug: 400358935
Flag: EXEMPT bugfix
Test: manual, also regression test on the way
Change-Id: I1dcdaec1f3bd42bc2a406c9e9318208f96266bd6
---
 framework/src/android/net/NetworkAgent.java | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/framework/src/android/net/NetworkAgent.java b/framework/src/android/net/NetworkAgent.java
index d5a1ef3e13..509b533b8e 100644
--- a/framework/src/android/net/NetworkAgent.java
+++ b/framework/src/android/net/NetworkAgent.java
@@ -679,6 +679,21 @@ public abstract class NetworkAgent {
                     synchronized (mRegisterLock) {
                         mState = STATE_UNREGISTERED;
                         mConnected = false;
+                        // Nulling out the registry here is necessary for the GC to notice that
+                        // this object can be reclaimed. Because :
+                        // ■ Here in the client side :
+                        // - the agent is a Binder object to the system server
+                        // - the agent owns the registry
+                        // - the registry is a Binder object from the system server
+                        // ■ On the system server side :
+                        // - the registry is a NetworkAgentInfo Binder to the client
+                        // - the NetworkAgentInfo owns the NetworkAgent
+                        // - the NetworkAgent is a Binder object from the client
+                        // This means there is a four-way binder interlock preventing the GC from
+                        // noticing these objects can be reclaimed. Nulling out the registry here
+                        // breaks that loop, which the GC can then unwind.
+                        // See b/400358935 for details.
+                        mRegistry = null;
                     }
                     break;
                 }

From 20be05514809b7db222013a19ba205665a5f642f Mon Sep 17 00:00:00 2001
From: Jimi Chen <jimictw@google.com>
Date: Mon, 26 May 2025 06:48:48 +0000
Subject: [PATCH 300/377] Refactor: Pass parameterized argument via test
 constructor

Moves the parameterized variable into the test class constructor for cleaner initialization
and improved test flexibility.

Flag: EXEMPT mainline
Bug: 410976315
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.connectivity.MultinetworkPolicyTrackerTest
Change-Id: Iab1388850d3a7c1f8872ad5a561023a8487f006f
---
 .../connectivity/MultinetworkPolicyTrackerTest.kt     | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTest.kt b/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTest.kt
index 97b3c49cde..73e39cec82 100644
--- a/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTest.kt
+++ b/tests/unit/java/com/android/server/connectivity/MultinetworkPolicyTrackerTest.kt
@@ -72,10 +72,13 @@ const val HANDLER_TIMEOUT_MS = 400
  * Build, install and run with:
  * atest FrameworksNetTest:MultinetworkPolicyTrackerTest
  */
+// This test class is initialized with 'supportCarrierConfigManager',
+// which indicates whether CarrierConfigManager is supported. This value
+// is 'false' if FEATURE_TELEPHONY_SUBSCRIPTION is not supported on the device.
 @RunWith(DevSdkIgnoreRunner::class)
 @SmallTest
 @DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.R)
-class MultinetworkPolicyTrackerTest {
+class MultinetworkPolicyTrackerTest(private val supportCarrierConfigManager: Boolean) {
     companion object {
         @Parameterized.Parameters
         @JvmStatic
@@ -110,12 +113,6 @@ class MultinetworkPolicyTrackerTest {
 
     private val featureFlags = HashSet<String>()
 
-    // Indicates where CarrierConfigManager is supported.
-    // It will be false if FEATURE_TELEPHONY_SUBSCRIPTION is not supported.
-    @Parameterized.Parameter(0)
-    @JvmField
-    var supportCarrierConfigManager: Boolean = false
-
     var carrierConfigManager: CarrierConfigManager? = null
 
     // This will set feature flags from @FeatureFlag annotations

From cc1621a28b31d93dcc5688c1c83c5e371d6f4acd Mon Sep 17 00:00:00 2001
From: Motomu Utsumi <motomuman@google.com>
Date: Fri, 23 May 2025 21:45:46 +0900
Subject: [PATCH 301/377] Add test to check binder proxy leak after
 networkAgent unregistration

Bug: 400358935
Test: testRegisterUnregisterDoesNotLeakBinderProxy fails without ag/33689435
Flag: EXEMPT test only change
Change-Id: Ie54820975a7d0168eaf40faa0430294e27e58508
---
 .../src/android/net/cts/NetworkAgentTest.kt   | 38 +++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/tests/cts/net/src/android/net/cts/NetworkAgentTest.kt b/tests/cts/net/src/android/net/cts/NetworkAgentTest.kt
index 8a541ed270..e745016eb8 100644
--- a/tests/cts/net/src/android/net/cts/NetworkAgentTest.kt
+++ b/tests/cts/net/src/android/net/cts/NetworkAgentTest.kt
@@ -2038,4 +2038,42 @@ class NetworkAgentTest {
         val agent = createNetworkAgent()
         agent.unregister()
     }
+
+    fun getBinderProxyCount(): Int {
+        // Call gc before checking binder proxy count.
+        System.gc()
+        System.runFinalization()
+        System.gc()
+
+        // Extracts the number of binder proxy objects from the `dumpsys meminfo` output.
+        // Expects a line in the format: "Local Binders: 13 Proxy Binders: 30".
+        val dumpOutput = ("dumpsys meminfo " + Process.myPid()).execute()
+        val line = dumpOutput.split("\n").firstOrNull { it.contains("Proxy Binders:") }
+        assertNotNull(line, "Dumpsys does not contain \"Proxy Binders:\", output: $dumpOutput")
+
+        val matched = Regex("Proxy Binders:\\s*(\\d+)").find(line)
+        assertNotNull(matched, "Failed to parse, line: $line")
+
+        return matched.groupValues[1].toInt()
+    }
+
+    @Test
+    fun testRegisterUnregisterDoesNotLeakBinderProxy() {
+        val startCount = getBinderProxyCount()
+
+        for (i in 1..30) {
+            val agent = createNetworkAgent(realContext)
+            agent.register()
+            agent.unregister()
+        }
+
+        val deadline = SystemClock.elapsedRealtime() + DEFAULT_TIMEOUT_MS
+        var endCount: Int
+        do {
+            endCount = getBinderProxyCount()
+            if (endCount - startCount < 10) return
+            SystemClock.sleep(50 /* ms */)
+        } while (SystemClock.elapsedRealtime() < deadline)
+        fail("Binder Proxy is leaked: $startCount -> $endCount")
+    }
 }

From 45163857b2ec3d512a5195b16594a569f04e01e3 Mon Sep 17 00:00:00 2001
From: Sewook Seo <sewookseo@google.com>
Date: Sun, 17 Nov 2024 22:38:48 +0000
Subject: [PATCH 302/377] Add socket destroying methods to InetDiagMessage.

Add socket destroying methods by address and permission to InetDiagMessage
to move that functions to ConnectivityService from Netd.

Bug: 373280981
Bug: 331139818
Flag: android.net.platform.flags.connectivity_service_destroy_socket
Test: atest NetworkStaticLibTests
Test: device test
Change-Id: I3c2136df5dfd618d1c757c07bce2b4211b807237
---
 staticlibs/Android.bp                         |   3 +
 .../module/util/netlink/InetDiagMessage.java  | 289 +++++++++++++++---
 .../util/netlink/InetDiagSocketTest.java      | 201 ++++++++++++
 3 files changed, 459 insertions(+), 34 deletions(-)

diff --git a/staticlibs/Android.bp b/staticlibs/Android.bp
index 00f2f9b338..9702715c92 100644
--- a/staticlibs/Android.bp
+++ b/staticlibs/Android.bp
@@ -253,6 +253,9 @@ java_library {
         "net-utils-device-common-struct",
         "net-utils-device-common-struct-base",
     ],
+    static_libs: [
+        "netd_aidl_interface-lateststable-java",
+    ],
     apex_available: [
         "com.android.tethering",
         "//apex_available:platform",
diff --git a/staticlibs/device/com/android/net/module/util/netlink/InetDiagMessage.java b/staticlibs/device/com/android/net/module/util/netlink/InetDiagMessage.java
index f776f4755f..100987910f 100644
--- a/staticlibs/device/com/android/net/module/util/netlink/InetDiagMessage.java
+++ b/staticlibs/device/com/android/net/module/util/netlink/InetDiagMessage.java
@@ -24,9 +24,9 @@ import static android.system.OsConstants.IPPROTO_TCP;
 import static android.system.OsConstants.IPPROTO_UDP;
 import static android.system.OsConstants.NETLINK_INET_DIAG;
 
+import static com.android.net.module.util.netlink.NetlinkConstants.SOCKDIAG_MSG_HEADER_SIZE;
 import static com.android.net.module.util.netlink.NetlinkConstants.SOCK_DESTROY;
 import static com.android.net.module.util.netlink.NetlinkConstants.SOCK_DIAG_BY_FAMILY;
-import static com.android.net.module.util.netlink.NetlinkConstants.SOCKDIAG_MSG_HEADER_SIZE;
 import static com.android.net.module.util.netlink.NetlinkConstants.stringForAddressFamily;
 import static com.android.net.module.util.netlink.NetlinkConstants.stringForProtocol;
 import static com.android.net.module.util.netlink.NetlinkUtils.DEFAULT_RECV_BUFSIZE;
@@ -37,6 +37,7 @@ import static com.android.net.module.util.netlink.NetlinkUtils.connectToKernel;
 import static com.android.net.module.util.netlink.StructNlMsgHdr.NLM_F_DUMP;
 import static com.android.net.module.util.netlink.StructNlMsgHdr.NLM_F_REQUEST;
 
+import android.net.INetd;
 import android.net.util.SocketUtils;
 import android.os.Process;
 import android.os.SystemClock;
@@ -48,6 +49,9 @@ import androidx.annotation.NonNull;
 import androidx.annotation.Nullable;
 import androidx.annotation.VisibleForTesting;
 
+import com.android.net.module.util.CollectionUtils;
+import com.android.net.module.util.InetAddressUtils;
+
 import java.io.FileDescriptor;
 import java.io.IOException;
 import java.io.InterruptedIOException;
@@ -61,6 +65,7 @@ import java.nio.ByteBuffer;
 import java.nio.ByteOrder;
 import java.util.ArrayList;
 import java.util.List;
+import java.util.Objects;
 import java.util.Set;
 import java.util.concurrent.atomic.AtomicInteger;
 import java.util.function.Consumer;
@@ -76,6 +81,13 @@ import java.util.function.Predicate;
 public class InetDiagMessage extends NetlinkMessage {
     public static final String TAG = "InetDiagMessage";
     private static final int TIMEOUT_MS = 500;
+    /** Bitmask position for 'explicitlySelected' in Fwmark.h */
+    public static final int EXPLICITLY_SELECTED_BIT_SHIFT = 16;
+    /** Bitmask position for 'Permission' in Fwmark.h */
+    public static final int PERMISSION_SHIFT = 18;
+
+    /** FWMARK_NET_ID_MASK in Fwmark.h */
+    public static final int FWMARK_NET_ID_MASK = 0xFFFF;
 
     /**
      * Construct an inet_diag_req_v2 message. This method will throw
@@ -342,20 +354,27 @@ public class InetDiagMessage extends NetlinkMessage {
             FileDescriptor destroyFd, int proto, Predicate<InetDiagMessage> filter)
             throws SocketException, InterruptedIOException, ErrnoException {
         AtomicInteger destroyedSockets = new AtomicInteger(0);
-        Consumer<InetDiagMessage> handleNlDumpMsg = (diagMsg) -> {
-            if (filter.test(diagMsg)) {
-                try {
-                    sendNetlinkDestroyRequest(destroyFd, proto, diagMsg.inetDiagMsg.id,
-                            diagMsg.inetDiagMsg.idiag_family, 1 << diagMsg.inetDiagMsg.idiag_state);
-                    destroyedSockets.getAndIncrement();
-                } catch (InterruptedIOException | ErrnoException e) {
-                    if (!(e instanceof ErrnoException
-                            && ((ErrnoException) e).errno == ENOENT)) {
-                        Log.e(TAG, "Failed to destroy socket: diagMsg=" + diagMsg + ", " + e);
+        Consumer<InetDiagMessage> handleNlDumpMsg =
+                diagMsg -> {
+                    if (filter.test(diagMsg)) {
+                        try {
+                            sendNetlinkDestroyRequest(
+                                    destroyFd,
+                                    proto,
+                                    diagMsg.inetDiagMsg.id,
+                                    diagMsg.inetDiagMsg.idiag_family,
+                                    1 << diagMsg.inetDiagMsg.idiag_state);
+                            destroyedSockets.getAndIncrement();
+                        } catch (InterruptedIOException | ErrnoException e) {
+                            if (!(e instanceof ErrnoException
+                                    && ((ErrnoException) e).errno == ENOENT)) {
+                                Log.e(
+                                        TAG,
+                                        "Failed to destroy socket: diagMsg=" + diagMsg + ", " + e);
+                            }
+                        }
                     }
-                }
-            }
-        };
+                };
 
         NetlinkUtils.<InetDiagMessage>getAndProcessNetlinkDumpMessages(dumpReq,
                 NETLINK_INET_DIAG, InetDiagMessage.class, handleNlDumpMsg);
@@ -388,6 +407,26 @@ public class InetDiagMessage extends NetlinkMessage {
         return false;
     }
 
+    private static boolean containsMarkMatchedToNetId(
+            InetDiagMessage msg, @NonNull Set<Range<Integer>> netIdRanges) {
+        final StructNlAttr attr = findInetDiagMarkAttr(msg);
+        if (attr == null) return false;
+
+        final Integer fwMark = attr.getValueAsInteger();
+        if (fwMark == null) return false;
+        return CollectionUtils.any(
+                netIdRanges, range -> range.contains(fwMark & FWMARK_NET_ID_MASK));
+    }
+
+    private static StructNlAttr findInetDiagMarkAttr(InetDiagMessage msg) {
+        for (StructNlAttr attr : msg.nlAttrs) {
+            if (attr.nla_type == NetlinkUtils.INET_DIAG_MARK) {
+                return attr;
+            }
+        }
+        return null;
+    }
+
     private static boolean isLoopbackAddress(InetAddress addr) {
         if (addr.isLoopbackAddress()) return true;
         if (!(addr instanceof Inet6Address)) return false;
@@ -415,6 +454,17 @@ public class InetDiagMessage extends NetlinkMessage {
                 || srcAddr.equals(dstAddr);
     }
 
+    /** This returns the time taken to perform socket destruction including time spent in sleep. */
+    private static long destroyLiveTcpSockets(Predicate<InetDiagMessage> filter)
+            throws SocketException, InterruptedIOException, ErrnoException {
+        final long startTimeMs = SystemClock.elapsedRealtime();
+        destroySockets(
+                IPPROTO_TCP,
+                TCP_ALIVE_STATE_FILTER,
+                diagMsg -> filter.test(diagMsg) && !isLoopback(diagMsg) && !isAdbSocket(diagMsg));
+        return SystemClock.elapsedRealtime() - startTimeMs;
+    }
+
     private static void destroySockets(int proto, int states, Predicate<InetDiagMessage> filter)
             throws ErrnoException, SocketException, InterruptedIOException {
         FileDescriptor destroyFd = null;
@@ -425,7 +475,6 @@ public class InetDiagMessage extends NetlinkMessage {
 
             for (int family : List.of(AF_INET, AF_INET6)) {
                 byte[] req = makeNetlinkDumpRequest(proto, states, family);
-
                 try {
                     final int destroyedSockets = processNetlinkDumpAndDestroySockets(
                             req, destroyFd, proto, filter);
@@ -456,34 +505,27 @@ public class InetDiagMessage extends NetlinkMessage {
      */
     public static void destroyLiveTcpSockets(Set<Range<Integer>> ranges, Set<Integer> exemptUids)
             throws SocketException, InterruptedIOException, ErrnoException {
-        final long startTimeMs = SystemClock.elapsedRealtime();
-        destroySockets(IPPROTO_TCP, TCP_ALIVE_STATE_FILTER,
-                (diagMsg) -> !exemptUids.contains(diagMsg.inetDiagMsg.idiag_uid)
-                        && containsUid(diagMsg, ranges)
-                        && !isLoopback(diagMsg)
-                        && !isAdbSocket(diagMsg));
-        final long durationMs = SystemClock.elapsedRealtime() - startTimeMs;
+        final long durationMs =
+                destroyLiveTcpSockets(
+                        diagMsg ->
+                                !exemptUids.contains(diagMsg.inetDiagMsg.idiag_uid)
+                                        && containsUid(diagMsg, ranges));
         Log.d(TAG, "Destroyed live tcp sockets for uids=" + ranges + " exemptUids=" + exemptUids
                 + " in " + durationMs + "ms");
     }
 
     /**
-     * Close tcp sockets that match the following condition
-     *  1. TCP status is one of TCP_ESTABLISHED, TCP_SYN_SENT, and TCP_SYN_RECV
-     *  2. Owner uid of socket is in the targetUids
-     *  3. Socket is not loopback
-     *  4. Socket is not adb socket
+     * Close tcp sockets that match the following condition 1. TCP status is one of TCP_ESTABLISHED,
+     * TCP_SYN_SENT, and TCP_SYN_RECV 2. Owner uid of socket is in the targetUids 3. Socket is not
+     * loopback 4. Socket is not adb socket
      *
      * @param ownerUids target uids to close sockets
      */
-    public static void destroyLiveTcpSocketsByOwnerUids(Set<Integer> ownerUids)
+    public static void destroyLiveTcpSocketsByOwnerUids(@NonNull Set<Integer> ownerUids)
             throws SocketException, InterruptedIOException, ErrnoException {
-        final long startTimeMs = SystemClock.elapsedRealtime();
-        destroySockets(IPPROTO_TCP, TCP_ALIVE_STATE_FILTER,
-                (diagMsg) -> ownerUids.contains(diagMsg.inetDiagMsg.idiag_uid)
-                        && !isLoopback(diagMsg)
-                        && !isAdbSocket(diagMsg));
-        final long durationMs = SystemClock.elapsedRealtime() - startTimeMs;
+        Objects.requireNonNull(ownerUids);
+        final long durationMs =
+                destroyLiveTcpSockets(diagMsg -> ownerUids.contains(diagMsg.inetDiagMsg.idiag_uid));
         Log.d(TAG, "Destroyed live tcp sockets for uids=" + ownerUids + " in " + durationMs + "ms");
     }
 
@@ -511,6 +553,185 @@ public class InetDiagMessage extends NetlinkMessage {
         }
     }
 
+    /**
+     * Close tcp sockets that match the following condition 1. TCP status is one of TCP_ESTABLISHED,
+     * TCP_SYN_SENT, and TCP_SYN_RECV 2. Local address of socket is equal to the given address 3.
+     * Socket is not loopback 4. Socket is not adb socket 5. Sockets satisfying given
+     * conditions(netId ranges, UID ranges).
+     *
+     * @param address a local address to destroy sockets
+     * @param netIdRanges ranges of net IDs need to be matched
+     * @param uidRanges ranges of UIDs to destroy sockets
+     */
+    public static void destroyLiveTcpSocketsByLocalAddress(
+            @NonNull InetAddress address,
+            @Nullable Set<Range<Integer>> netIdRanges,
+            @Nullable Set<Range<Integer>> uidRanges)
+            throws SocketException, InterruptedIOException, ErrnoException {
+        final long durationMs =
+                destroyLiveTcpSockets(
+                        diagMsg -> matchesLocalAddressWithNetworkAndUser(
+                                address, netIdRanges, uidRanges, diagMsg));
+        Log.d(
+                TAG,
+                "Destroyed live tcp sockets for local address "
+                        + address
+                        + ", netIdRanges"
+                        + netIdRanges
+                        + ", uidRanges:"
+                        + uidRanges
+                        + " in "
+                        + durationMs
+                        + "ms");
+    }
+
+    /**
+     * Close tcp sockets that match the following condition 1. TCP status is one of TCP_ESTABLISHED,
+     * TCP_SYN_SENT, and TCP_SYN_RECV 2. Local address of socket is equal to the given address 3.
+     * Socket is not loopback 4. Socket is not adb socket 5. Sockets satisfying given
+     * conditions(interface ID).
+     *
+     * @param address a local address to destroy sockets
+     * @param interfaceId interface id needs to be referred for destroying sockets.
+     */
+    public static void destroyLiveTcpSocketsByLocalAddress(
+            @NonNull InetAddress address, int interfaceId)
+            throws SocketException, InterruptedIOException, ErrnoException {
+        final long durationMs =
+                destroyLiveTcpSockets(
+                        diagMsg ->
+                                matchesLocalAddressWithInterfaceId(address, interfaceId, diagMsg));
+        Log.d(
+                TAG,
+                "Destroyed live tcp sockets for local address "
+                        + address
+                        + ", interfaceId:"
+                        + interfaceId
+                        + " in "
+                        + durationMs
+                        + "ms");
+    }
+
+    /**
+     * Returns whether the |diagMsg| matches the following conditions : - is for a socket with the
+     * passed address - is on one of the passed netIds - belongs to an app with one of the passed
+     * UIDs
+     *
+     * @param address local address to compare
+     * @param netIdRanges a range of net IDs that needs to be matched. If null, netId is not
+     *     considered in this match result.
+     * @param uidRanges ranges of UIDs to destroy sockets, If null, netId is not considered in this
+     *     match result.
+     * @param diagMsg {@link InetDiagMessage} retrieved from kernel.
+     */
+    @VisibleForTesting
+    public static boolean matchesLocalAddressWithNetworkAndUser(
+            @NonNull InetAddress address,
+            @Nullable Set<Range<Integer>> netIdRanges,
+            @Nullable Set<Range<Integer>> uidRanges,
+            @NonNull InetDiagMessage diagMsg) {
+        if (!matchesLocalAddress(address, diagMsg)) {
+            // Socket's local address should be matched to the given address.
+            return false;
+        }
+        if (netIdRanges != null && !containsMarkMatchedToNetId(diagMsg, netIdRanges)) {
+            return false;
+        }
+        return uidRanges == null || containsUid(diagMsg, uidRanges);
+    }
+
+    /**
+     * Returns whether the address of InetDiagMessage matches the given address.
+     *
+     * @param address local address to compare
+     * @param interfaceId interface id to be referred. If it's 0, interface id is not considered in
+     *     this match result.
+     * @param diagMsg {@link InetDiagMessage} retrieved from kernel.
+     */
+    @VisibleForTesting
+    public static boolean matchesLocalAddressWithInterfaceId(
+            @NonNull InetAddress address, int interfaceId, @NonNull InetDiagMessage diagMsg) {
+        return (interfaceId == 0 || interfaceId == diagMsg.inetDiagMsg.id.ifIndex)
+                && matchesLocalAddress(address, diagMsg);
+    }
+
+    private static boolean matchesLocalAddress(
+            @NonNull InetAddress address, @NonNull InetDiagMessage diagMsg) {
+        final InetAddress addressDiag = diagMsg.inetDiagMsg.id.locSocketAddress.getAddress();
+        return address.equals(addressDiag)
+                || (address instanceof Inet4Address
+                        && addressDiag instanceof Inet6Address
+                        && addressDiag.equals(
+                                // TODO: Improve performance for computing this. b/418877261
+                                InetAddressUtils.v4MappedV6Address((Inet4Address) address)));
+    }
+
+    /**
+     * Close tcp sockets that match the following condition 1. TCP status is one of TCP_ESTABLISHED,
+     * TCP_SYN_SENT, and TCP_SYN_RECV 2. Socket is not loopback 3. Socket is not adb socket 4.
+     * Sockets on the specified netId where: - The opening app no longer has permission to use this
+     * network, or: - The opening app does have permission, but did not explicitly select this
+     * network.
+     *
+     * @param netId a network identifier needs to be referred for destroying sockets.
+     * @param permission network permission, available values are INetd.PERMISSION_NETWORK or
+     *     INetd.PERMISSION_SYSTEM.
+     */
+    public static void destroyLiveTcpSocketsLackingPermission(int netId, int permission)
+            throws SocketException, InterruptedIOException, ErrnoException {
+        if (permission != INetd.PERMISSION_NETWORK && permission != INetd.PERMISSION_SYSTEM) {
+            throw new IllegalArgumentException("Invalid permission");
+        }
+        final long durationMs =
+                destroyLiveTcpSockets(diagMsg -> isLackingPermission(netId, permission, diagMsg));
+        Log.d(
+                TAG,
+                "Destroyed live tcp sockets for lacking permission for netId:"
+                        + netId
+                        + " and permission:"
+                        + permission
+                        + " in "
+                        + durationMs
+                        + "ms");
+    }
+
+    /**
+     * Returns whether the opening app lacking permission or not. "isLacking" because an app is not
+     * lacking a permission on a mismatched netId, while it's not true that it would
+     * "holdPermission"
+     *
+     * @param netId network ID to compare
+     * @param permission network permission defined in INetd.aidl
+     * @param diagMsg {@link InetDiagMessage} retrieved from kernel.
+     */
+    @VisibleForTesting
+    public static boolean isLackingPermission(
+            int netId, int permission, @NonNull InetDiagMessage diagMsg) {
+        final int netdPermission = convertToNetdPermission(permission);
+        StructNlAttr attr = findInetDiagMarkAttr(diagMsg);
+        if (attr == null) return false;
+        final Integer fwMark = attr.getValueAsInteger();
+        if (fwMark == null) return false;
+        if ((fwMark & FWMARK_NET_ID_MASK) != netId) return false;
+        // Makes a mask to find matching sockets where:
+        // 1. The opening app no longer has permission to use this network, or:
+        // 2. The opening app does have permission, but did not explicitly select this network.
+        final int mask =
+                netdPermission << PERMISSION_SHIFT | 1 << EXPLICITLY_SELECTED_BIT_SHIFT;
+        return (fwMark & mask) != mask;
+    }
+
+    private static int convertToNetdPermission(int permission) {
+        // CS will destroy sockets lacking permission instead of Netd, and it follows permission
+        // value defined in INetd. However socket's Fwmark value follows Permission.h, thus we need
+        // conversion.
+        return switch (permission) {
+            case INetd.PERMISSION_NETWORK -> INetd.PERMISSION_NETWORK;
+            case INetd.PERMISSION_SYSTEM -> INetd.PERMISSION_SYSTEM | INetd.PERMISSION_NETWORK;
+            default -> INetd.PERMISSION_NONE;
+        };
+    }
+
     @Override
     public String toString() {
         return "InetDiagMessage{ "
diff --git a/staticlibs/tests/unit/src/com/android/net/module/util/netlink/InetDiagSocketTest.java b/staticlibs/tests/unit/src/com/android/net/module/util/netlink/InetDiagSocketTest.java
index b44e428547..2662f8132e 100644
--- a/staticlibs/tests/unit/src/com/android/net/module/util/netlink/InetDiagSocketTest.java
+++ b/staticlibs/tests/unit/src/com/android/net/module/util/netlink/InetDiagSocketTest.java
@@ -36,10 +36,13 @@ import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
 
+import android.annotation.NonNull;
+import android.net.INetd;
 import android.net.InetAddresses;
 import android.util.ArraySet;
 import android.util.Range;
 
+import androidx.annotation.Nullable;
 import androidx.test.filters.SmallTest;
 import androidx.test.runner.AndroidJUnit4;
 
@@ -56,6 +59,7 @@ import java.nio.ByteBuffer;
 import java.nio.ByteOrder;
 import java.util.List;
 import java.util.Set;
+import java.util.function.Predicate;
 
 @RunWith(AndroidJUnit4.class)
 @SmallTest
@@ -800,4 +804,201 @@ public class InetDiagSocketTest {
         doTestIsAdbSocket(ROOT_UID, false /* expected */);
         doTestIsAdbSocket(appUid, false /* expected */);
     }
+
+    private static final String INET_DIAG_MSG_MAPPED6 =
+            // struct nlmsghdr
+            "6C000000" // length = 108
+                    + "1400" // type = SOCK_DIAG_BY_FAMILY
+                    + "0000" // flags
+                    + "00000000" // seqno
+                    + "f5220000" // pid
+                    // struct inet_diag_msg
+                    + "0a" // family = AF_INET6
+                    + "02" // idiag_state = 2
+                    + "10" // idiag_timer = 16
+                    + "20" // idiag_retrans = 32
+                    // inet_diag_sockid
+                    + "a845" // idiag_sport = 43077
+                    + "01bb" // idiag_dport = 443
+                    + "00000000000000000000ffffc0000201" // idiag_src = ::FFFF:192.0.2.1
+                    + "00000000000000000000ffffc0000202" // idiag_dst = ::FFFF:192.0.2.2
+                    + "08000000" // idiag_if = 8
+                    + "6300000000000000" // idiag_cookie = 99
+                    + "30000000" // idiag_expires = 48
+                    + "40000000" // idiag_rqueue = 64
+                    + "50000000" // idiag_wqueue = 80
+                    + "39300000" // idiag_uid = 12345
+                    + "851a0000" // idiag_inode = 6789
+                    + "0500" // len = 5
+                    + "0800" // type = 8
+                    + "00000000" // data
+                    + "0800" // len = 8
+                    + "0F00" // type = 15(INET_DIAG_MARK)
+                    + "65000500" // Fwmark netId:101, explicitlySelected: true, permission: network
+                    + "0400" // len = 4
+                    + "0200"; // type = 2
+
+    private static final String INET_DIAG_MSG_MAPPED6_OEM_NET_ID =
+            // struct nlmsghdr
+            "6C000000" // length = 108
+                    + "1400" // type = SOCK_DIAG_BY_FAMILY
+                    + "0000" // flags
+                    + "00000000" // seqno
+                    + "f5220000" // pid
+                    // struct inet_diag_msg
+                    + "0a" // family = AF_INET6
+                    + "02" // idiag_state = 2
+                    + "10" // idiag_timer = 16
+                    + "20" // idiag_retrans = 32
+                    // inet_diag_sockid
+                    + "a845" // idiag_sport = 43077
+                    + "01bb" // idiag_dport = 443
+                    + "00000000000000000000ffffc0000201" // idiag_src = ::FFFF:192.0.2.1
+                    + "00000000000000000000ffffc0000202" // idiag_dst = ::FFFF:192.0.2.2
+                    + "08000000" // idiag_if = 8
+                    + "6300000000000000" // idiag_cookie = 99
+                    + "30000000" // idiag_expires = 48
+                    + "40000000" // idiag_rqueue = 64
+                    + "50000000" // idiag_wqueue = 80
+                    + "39300000" // idiag_uid = 12345
+                    + "851a0000" // idiag_inode = 6789
+                    + "0500" // len = 5
+                    + "0800" // type = 8
+                    + "00000000" // data
+                    + "0800" // len = 8
+                    + "0F00" // type = 15(INET_DIAG_MARK)
+                    + "23000500" // Fwmark netId:35, explicitlySelected: true, permission: network
+                    + "0400" // len = 4
+                    + "0200"; // type = 2
+
+    private boolean matchesDestroyCondition(
+            @NonNull String nlmsg, @NonNull Predicate<InetDiagMessage> condition) {
+        final byte[] nlMsgByte = HexEncoding.decode(nlmsg.toCharArray(), false);
+        final ByteBuffer byteBuffer = ByteBuffer.wrap(nlMsgByte);
+        byteBuffer.order(ByteOrder.nativeOrder());
+        final NetlinkMessage msg = NetlinkMessage.parse(byteBuffer, NETLINK_INET_DIAG);
+        final InetDiagMessage inetDiagMsg = (InetDiagMessage) msg;
+        return condition.test(inetDiagMsg);
+    }
+
+    private void doTestMatchingLocalAddress(
+            boolean expected,
+            @NonNull InetAddress address,
+            @Nullable Set<Range<Integer>> netIdRanges,
+            @Nullable Set<Range<Integer>> uidRanges,
+            @NonNull String nlmsg) {
+        assertEquals(
+                expected,
+                matchesDestroyCondition(
+                        nlmsg,
+                        diagMsg ->
+                                InetDiagMessage.matchesLocalAddressWithNetworkAndUser(
+                                        address, netIdRanges, uidRanges, diagMsg)));
+    }
+
+    private void doTestMatchingLocalAddress(
+            boolean expected,
+            @NonNull InetAddress address,
+            int interfaceId,
+            @NonNull String nlmsg) {
+        assertEquals(
+                expected,
+                matchesDestroyCondition(
+                        nlmsg,
+                        diagMsg ->
+                                InetDiagMessage.matchesLocalAddressWithInterfaceId(
+                                        address, interfaceId, diagMsg)));
+    }
+
+    private void doTestIsLackingPermission(
+            boolean expected, int netId, int permission, @NonNull String nlmsg) {
+        assertEquals(
+                expected,
+                matchesDestroyCondition(
+                        nlmsg,
+                        diagMsg ->
+                                InetDiagMessage.isLackingPermission(netId, permission, diagMsg)));
+    }
+
+    @Test
+    public void testMatchingDestroyConditionAddressOnly() {
+        doTestMatchingLocalAddress(
+                true, /* expected */
+                InetAddresses.parseNumericAddress("2001:db8::3"),
+                null, /* netIdRange */
+                null, /* uidRanges */
+                INET_DIAG_MSG_HEX2);
+        doTestMatchingLocalAddress(
+                true, /* expected */
+                InetAddresses.parseNumericAddress("192.0.2.1"),
+                Set.of(new Range<>(100, 65535)),
+                null, /* uidRanges */
+                INET_DIAG_MSG_MAPPED6);
+    }
+
+    @Test
+    public void testMatchingDestroyConditionForInterfaceId() {
+        doTestMatchingLocalAddress(
+                false /* expected */,
+                InetAddresses.parseNumericAddress("192.0.2.1"),
+                7 /* interfaceId */,
+                INET_DIAG_MSG_MAPPED6);
+        doTestMatchingLocalAddress(
+                true /* expected */,
+                InetAddresses.parseNumericAddress("192.0.2.1"),
+                8 /* interfaceId */,
+                INET_DIAG_MSG_MAPPED6);
+    }
+
+    @Test
+    public void testMatchingDestroyConditionForNetIdRange() {
+        doTestMatchingLocalAddress(
+                false /* expected */,
+                InetAddresses.parseNumericAddress("192.0.2.1"),
+                Set.of(new Range<>(0, 99)),
+                null /* uidRanges */,
+                INET_DIAG_MSG_MAPPED6);
+        doTestMatchingLocalAddress(
+                true /* expected */,
+                InetAddresses.parseNumericAddress("192.0.2.1"),
+                Set.of(new Range<>(0, 99)),
+                null /* uidRanges */,
+                INET_DIAG_MSG_MAPPED6_OEM_NET_ID);
+        doTestMatchingLocalAddress(
+                false /* expected */,
+                InetAddresses.parseNumericAddress("192.0.2.1"),
+                Set.of(new Range<>(100, 100), new Range<>(102, 65535)),
+                null /* uidRanges */,
+                INET_DIAG_MSG_MAPPED6);
+        doTestMatchingLocalAddress(
+                true /* expected */,
+                InetAddresses.parseNumericAddress("192.0.2.1"),
+                Set.of(new Range<>(0, 20), new Range<>(100, 65535)),
+                null /* uidRanges */,
+                INET_DIAG_MSG_MAPPED6);
+    }
+
+    @Test
+    public void testMatchingDestroyConditionForUidRanges() {
+        doTestMatchingLocalAddress(
+                true /* expected */,
+                InetAddresses.parseNumericAddress("2001:db8::3"),
+                Set.of(new Range<>(100, 65535)),
+                Set.of(new Range<>(12000, 12346)),
+                INET_DIAG_MSG_HEX2);
+    }
+
+    @Test
+    public void testIsLackingPermission() {
+        int systemPermission = INetd.PERMISSION_SYSTEM;
+        int netPermission = INetd.PERMISSION_NETWORK;
+        doTestIsLackingPermission(
+                true /* expected */, 101 /* netId */, systemPermission, INET_DIAG_MSG_MAPPED6);
+        doTestIsLackingPermission(
+                false /* expected */, 100 /* netId */, systemPermission, INET_DIAG_MSG_MAPPED6);
+        doTestIsLackingPermission(
+                false /* expected */, 101 /* netId */, netPermission, INET_DIAG_MSG_MAPPED6);
+        doTestIsLackingPermission(
+                true /* expected */, 2693 /* netId */, systemPermission, INET_DIAG_MSG_HEX2);
+    }
 }

From 5b061066c93d58da8d90ee8a6c1767bf30b343ca Mon Sep 17 00:00:00 2001
From: Junyu Lai <junyulai@google.com>
Date: Tue, 27 May 2025 13:28:20 +0800
Subject: [PATCH 303/377] Fill Opt-in uid count in ConnetivityStateSample

Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.metrics.ConnectivitySampleMetricsTest \
  --update-device
Flag: EXEMPT controlled with kill switch
Bug: 419123367
Change-Id: I95376e30e160b4db00d018a0919be98b37d44e5e
---
 .../android/server/ConnectivityService.java   | 15 ++++++++++
 .../connectivity/ConnectivityFlags.java       |  3 ++
 .../SatelliteAccessController.java            |  6 ++++
 .../metrics/ConnectivitySampleMetricsTest.kt  | 29 ++++++++++++++++---
 .../server/ConnectivityServiceTest.java       |  1 +
 .../server/connectivityservice/base/CSTest.kt |  1 +
 6 files changed, 51 insertions(+), 4 deletions(-)

diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index 716c71332f..803c682f75 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -158,6 +158,7 @@ import static com.android.net.module.util.PermissionUtils.hasAnyPermissionOf;
 import static com.android.server.ConnectivityStatsLog.CONNECTIVITY_STATE_SAMPLE;
 import static com.android.server.connectivity.ConnectivityFlags.CELLULAR_DATA_INACTIVITY_TIMEOUT;
 import static com.android.server.connectivity.ConnectivityFlags.CLOSE_QUIC_CONNECTION;
+import static com.android.server.connectivity.ConnectivityFlags.CONSTRAINED_DATA_SATELLITE_METRICS;
 import static com.android.server.connectivity.ConnectivityFlags.DELAY_DESTROY_SOCKETS;
 import static com.android.server.connectivity.ConnectivityFlags.INGRESS_TO_VPN_ADDRESS_FILTERING;
 import static com.android.server.connectivity.ConnectivityFlags.NAMESPACE_TETHERING_BOOT;
@@ -338,6 +339,7 @@ import com.android.metrics.NetworkDescription;
 import com.android.metrics.NetworkList;
 import com.android.metrics.NetworkRequestCount;
 import com.android.metrics.RequestCountForType;
+import com.android.metrics.SatelliteAccessInfo;
 import com.android.modules.utils.BasicShellCommandHandler;
 import com.android.modules.utils.build.SdkLevel;
 import com.android.net.module.util.BaseNetdUnsolicitedEventListener;
@@ -551,6 +553,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
     private final boolean mQueueCallbacksForFrozenApps;
     // Flag for early link properties update
     private final boolean mSupportEarlyLinkPropertiesUpdateForVPN;
+    private final boolean mConstrainedDataSatelliteMetrics;
 
     /**
      * Uids ConnectivityService tracks blocked status of to send blocked status callbacks.
@@ -1992,6 +1995,8 @@ public class ConnectivityService extends IConnectivityManager.Stub
         } else {
             mSatelliteAccessController = null;
         }
+        mConstrainedDataSatelliteMetrics = (mSatelliteAccessController != null)
+                && mDeps.isFeatureNotChickenedOut(mContext, CONSTRAINED_DATA_SATELLITE_METRICS);
 
         // To ensure uid state is synchronized with Network Policy, register for
         // NetworkPolicyManagerService events must happen prior to NetworkPolicyManagerService
@@ -2760,6 +2765,9 @@ public class ConnectivityService extends IConnectivityManager.Stub
         builder.setConnectionDurationPerTransports(sampleConnectionDuration(mNetworkAgentInfos));
         builder.setNetworkRequestCount(sampleNetworkRequestCount(mNetworkRequests.values()));
         builder.setNetworks(sampleNetworks(mNetworkAgentInfos));
+        if (mConstrainedDataSatelliteMetrics) {
+            builder.setSatelliteAccessInfo(sampleSatelliteAccessInfo(mSatelliteAccessController));
+        }
         return builder.build();
     }
 
@@ -2859,6 +2867,13 @@ public class ConnectivityService extends IConnectivityManager.Stub
         return builder.build();
     }
 
+    @NonNull
+    private static SatelliteAccessInfo sampleSatelliteAccessInfo(
+            @NonNull final SatelliteAccessController controller) {
+        final int optInUidCount = controller.getCachedOptInUidsCount();
+        return SatelliteAccessInfo.newBuilder().setOptinUidCount(optInUidCount).build();
+    }
+
     @Override
     public boolean isNetworkSupported(int networkType) {
         enforceAccessPermission();
diff --git a/service/src/com/android/server/connectivity/ConnectivityFlags.java b/service/src/com/android/server/connectivity/ConnectivityFlags.java
index 0905fbec1e..19c97fee1d 100644
--- a/service/src/com/android/server/connectivity/ConnectivityFlags.java
+++ b/service/src/com/android/server/connectivity/ConnectivityFlags.java
@@ -70,6 +70,9 @@ public final class ConnectivityFlags {
     public static final String CONSTRAINED_DATA_SATELLITE_OPTIN =
             "constrained_data_satellite_optin";
 
+    public static final String CONSTRAINED_DATA_SATELLITE_METRICS =
+            "constrained_data_satellite_metrics";
+
     /**
      * A feature flag to control whether the early link properties update for vpn should be enabled.
      *
diff --git a/service/src/com/android/server/connectivity/SatelliteAccessController.java b/service/src/com/android/server/connectivity/SatelliteAccessController.java
index 6951624d72..4e804b9c02 100644
--- a/service/src/com/android/server/connectivity/SatelliteAccessController.java
+++ b/service/src/com/android/server/connectivity/SatelliteAccessController.java
@@ -456,6 +456,12 @@ public class SatelliteAccessController {
         return pm;
     }
 
+    // Return cached opt-in uid list for metrics sampling.
+    // Should only be called on handler thread.
+    public int getCachedOptInUidsCount() {
+        return mSatelliteDataOptInUids.size();
+    }
+
     /** Dump info to dumpsys */
     public void dump(@NonNull IndentingPrintWriter pw) {
         HandlerUtils.ensureRunningOnHandlerThread(mConnectivityServiceHandler);
diff --git a/tests/unit/java/com/android/metrics/ConnectivitySampleMetricsTest.kt b/tests/unit/java/com/android/metrics/ConnectivitySampleMetricsTest.kt
index 8a9286fb6a..9fb8d61f4e 100644
--- a/tests/unit/java/com/android/metrics/ConnectivitySampleMetricsTest.kt
+++ b/tests/unit/java/com/android/metrics/ConnectivitySampleMetricsTest.kt
@@ -35,6 +35,7 @@ import androidx.test.filters.SmallTest
 import com.android.net.module.util.BitUtils
 import com.android.server.CSTest
 import com.android.server.FromS
+import com.android.server.connectivity.ConnectivityFlags.CONSTRAINED_DATA_SATELLITE_METRICS
 import com.android.server.connectivity.FullScore
 import com.android.server.connectivity.FullScore.POLICY_IS_UNMETERED
 import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
@@ -46,6 +47,7 @@ import kotlin.test.fail
 import org.junit.Assert.assertTrue
 import org.junit.Test
 import org.junit.runner.RunWith
+import org.mockito.Mockito.doReturn
 
 private fun <T> Handler.onHandler(f: () -> T): T {
     val future = CompletableFuture<T>()
@@ -215,13 +217,12 @@ class ConnectivitySampleMetricsTest : CSTest() {
         }
     }
 
-
     @Test
     fun testSampleConnectivityState_NetworkRequest() {
         val requestCount = 5
-        fileNetworkRequest(RT_APP, requestCount);
-        fileNetworkRequest(RT_SYSTEM, requestCount, SYSTEM_UID);
-        fileNetworkRequest(RT_SYSTEM_ON_BEHALF_OF_APP, requestCount, SYSTEM_UID);
+        fileNetworkRequest(RT_APP, requestCount)
+        fileNetworkRequest(RT_SYSTEM, requestCount, SYSTEM_UID)
+        fileNetworkRequest(RT_SYSTEM_ON_BEHALF_OF_APP, requestCount, SYSTEM_UID)
 
         val stats = csHandler.onHandler { service.sampleConnectivityState() }
 
@@ -246,4 +247,24 @@ class ConnectivitySampleMetricsTest : CSTest() {
                 "found ${systemOnBehalfOfAppRequest.requestCount}",
                 systemOnBehalfOfAppRequest.requestCount >= requestCount)
     }
+
+    @Test
+    fun testSampleConnectivityState_satelliteAccessInfo() {
+        doTestSampleConnectivityState_satelliteAccessInfo(true)
+    }
+
+    @FeatureFlags(flags = [Flag(CONSTRAINED_DATA_SATELLITE_METRICS, false)])
+    @Test
+    fun testSampleConnectivityState_satelliteAccessInfo_disabled() {
+        doTestSampleConnectivityState_satelliteAccessInfo(false)
+    }
+
+    private fun doTestSampleConnectivityState_satelliteAccessInfo(expectUpdated: Boolean) {
+        val statsBefore = csHandler.onHandler { service.sampleConnectivityState() }
+        assertEquals(0, statsBefore.satelliteAccessInfo.optinUidCount)
+
+        doReturn(3).`when`(satelliteAccessController).cachedOptInUidsCount
+        val statsAfter = csHandler.onHandler { service.sampleConnectivityState() }
+        assertEquals(if (expectUpdated) 3 else 0, statsAfter.satelliteAccessInfo.optinUidCount)
+    }
 }
diff --git a/tests/unit/java/com/android/server/ConnectivityServiceTest.java b/tests/unit/java/com/android/server/ConnectivityServiceTest.java
index a8b95b7418..4d70c2f189 100644
--- a/tests/unit/java/com/android/server/ConnectivityServiceTest.java
+++ b/tests/unit/java/com/android/server/ConnectivityServiceTest.java
@@ -2208,6 +2208,7 @@ public class ConnectivityServiceTest {
                 case ConnectivityFlags.QUEUE_NETWORK_AGENT_EVENTS_IN_SYSTEM_SERVER:
                 case ConnectivityFlags.CLOSE_QUIC_CONNECTION:
                 case ConnectivityFlags.EARLY_LINK_PROPERTIES_UPDATE_FOR_VPN:
+                case ConnectivityFlags.CONSTRAINED_DATA_SATELLITE_METRICS:
                     return true;
                 default:
                     throw new UnsupportedOperationException("Unknown flag " + name
diff --git a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
index 0a915df77c..431ce5ac74 100644
--- a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
@@ -179,6 +179,7 @@ open class CSTest {
         it[ConnectivityFlags.QUEUE_NETWORK_AGENT_EVENTS_IN_SYSTEM_SERVER] = true
         it[ConnectivityFlags.CLOSE_QUIC_CONNECTION] = true
         it[ConnectivityFlags.EARLY_LINK_PROPERTIES_UPDATE_FOR_VPN] = true
+        it[ConnectivityFlags.CONSTRAINED_DATA_SATELLITE_METRICS] = true
     }
     fun setFeatureEnabled(flag: String, enabled: Boolean) = enabledFeatures.set(flag, enabled)
 

From 3fd36e5f93a9640e76274cf39b04a37075837bb9 Mon Sep 17 00:00:00 2001
From: Junyu Lai <junyulai@google.com>
Date: Thu, 22 May 2025 17:38:12 +0800
Subject: [PATCH 304/377] Support matches transport types in NetworkTemplate

Flag: EXEMPT implemented in the counter-part CL
Test: atest CtsNetTestCases --test-filter \
      'NetworkStats*' --update-device
Test: atest ConnectivityCoverageTests --test-filter \
      'NetworkStats*' --update-device
Test: atest ConnectivityCoverageTests --test-filter \
      'NetworkTemplate*' --update-device
Bug: 419123367
Change-Id: I0c8bf2e24502befd810081f519ff915491b0a905
---
 .../src/android/net/NetworkTemplate.java      | 73 ++++++++++++--
 .../net/netstats/NetworkTemplateTest.kt       | 60 ++++++++++--
 .../java/android/net/NetworkTemplateTest.kt   | 95 ++++++++++++++++---
 .../server/net/NetworkStatsServiceTest.java   | 72 ++++++++++++++
 4 files changed, 268 insertions(+), 32 deletions(-)

diff --git a/framework-t/src/android/net/NetworkTemplate.java b/framework-t/src/android/net/NetworkTemplate.java
index 0e9e8d1dde..af588047f7 100644
--- a/framework-t/src/android/net/NetworkTemplate.java
+++ b/framework-t/src/android/net/NetworkTemplate.java
@@ -55,6 +55,7 @@ import android.util.Log;
 
 import com.android.internal.annotations.VisibleForTesting;
 import com.android.modules.utils.build.SdkLevel;
+import com.android.net.module.util.BitUtils;
 import com.android.net.module.util.CollectionUtils;
 import com.android.net.module.util.NetworkIdentityUtils;
 
@@ -138,6 +139,10 @@ public final class NetworkTemplate implements Parcelable {
      */
     public static final int NETWORK_TYPE_ALL = -1;
 
+    /** @hide */
+    @VisibleForTesting
+    public static final long TRANSPORT_TYPES_ALL = 0L;
+
     /** @hide */
     @Retention(RetentionPolicy.SOURCE)
     @IntDef(prefix = { "OEM_MANAGED_" }, value = {
@@ -410,6 +415,8 @@ public final class NetworkTemplate implements Parcelable {
     // Bitfield containing OEM network properties{@code NetworkIdentity#OEM_*}.
     private final int mOemManaged;
 
+    private final long mTransportTypesBits;
+
     private static void checkValidMatchSubscriberIds(int matchRule, String[] matchSubscriberIds) {
         switch (matchRule) {
             // CARRIER templates must always specify a valid subscriber ID.
@@ -459,7 +466,7 @@ public final class NetworkTemplate implements Parcelable {
                 subscriberId != null ? new String[] { subscriberId } : new String[0],
                 wifiNetworkKey != null ? new String[] { wifiNetworkKey } : new String[0],
                 getMeterednessForBackwardsCompatibility(matchRule), ROAMING_ALL,
-                DEFAULT_NETWORK_ALL, NETWORK_TYPE_ALL, OEM_MANAGED_ALL);
+                DEFAULT_NETWORK_ALL, NETWORK_TYPE_ALL, OEM_MANAGED_ALL, TRANSPORT_TYPES_ALL);
         if (matchRule == 6 || matchRule == 7) {
             Log.e(TAG, "Use MATCH_MOBILE with empty subscriberIds or MATCH_WIFI with empty "
                     + "wifiNetworkKeys instead of template with matchRule=" + matchRule);
@@ -495,7 +502,7 @@ public final class NetworkTemplate implements Parcelable {
                 wifiNetworkKey != null ? new String[] { wifiNetworkKey } : new String[0],
                 getMeterednessForBackwardsCompatibility(matchRule),
                 ROAMING_ALL, DEFAULT_NETWORK_ALL, NETWORK_TYPE_ALL,
-                OEM_MANAGED_ALL);
+                OEM_MANAGED_ALL, TRANSPORT_TYPES_ALL);
         // TODO : this is part of hidden-o txt, does that mean it should be annotated with
         // @UnsupportedAppUsage(maxTargetSdk = O) ? If yes, can't throwAtLeastU() lest apps
         // targeting O- crash on those devices.
@@ -512,14 +519,15 @@ public final class NetworkTemplate implements Parcelable {
         // subscriberIds.
         this(getBackwardsCompatibleMatchRule(matchRule),
                 matchSubscriberIds == null ? new String[]{} : matchSubscriberIds,
-                matchWifiNetworkKeys, metered, roaming, defaultNetwork, ratType, oemManaged);
+                matchWifiNetworkKeys, metered, roaming, defaultNetwork, ratType, oemManaged,
+                TRANSPORT_TYPES_ALL);
         throwAtLeastU();
     }
 
     /** @hide */
     public NetworkTemplate(int matchRule, String[] matchSubscriberIds,
             String[] matchWifiNetworkKeys, int metered, int roaming, int defaultNetwork,
-            int ratType, int oemManaged) {
+            int ratType, int oemManaged, long transportTypesBits) {
         Objects.requireNonNull(matchWifiNetworkKeys);
         Objects.requireNonNull(matchSubscriberIds);
         mMatchRule = matchRule;
@@ -530,6 +538,7 @@ public final class NetworkTemplate implements Parcelable {
         mDefaultNetwork = defaultNetwork;
         mRatType = ratType;
         mOemManaged = oemManaged;
+        mTransportTypesBits = transportTypesBits;
         checkValidMatchSubscriberIds(matchRule, matchSubscriberIds);
         if (!isKnownMatchRule(matchRule)) {
             throw new IllegalArgumentException("Unknown network template rule " + matchRule
@@ -546,6 +555,7 @@ public final class NetworkTemplate implements Parcelable {
         mDefaultNetwork = in.readInt();
         mRatType = in.readInt();
         mOemManaged = in.readInt();
+        mTransportTypesBits = in.readLong();
     }
 
     @Override
@@ -558,6 +568,7 @@ public final class NetworkTemplate implements Parcelable {
         dest.writeInt(mDefaultNetwork);
         dest.writeInt(mRatType);
         dest.writeInt(mOemManaged);
+        dest.writeLong(mTransportTypesBits);
     }
 
     @Override
@@ -590,6 +601,9 @@ public final class NetworkTemplate implements Parcelable {
         if (mOemManaged != OEM_MANAGED_ALL) {
             builder.append(", oemManaged=").append(getOemManagedNames(mOemManaged));
         }
+        if (mTransportTypesBits != TRANSPORT_TYPES_ALL) {
+            builder.append(", transportTypes=").append(Arrays.toString(getTransportTypes()));
+        }
         return builder.toString();
     }
 
@@ -597,7 +611,7 @@ public final class NetworkTemplate implements Parcelable {
     public int hashCode() {
         return Objects.hash(mMatchRule, Arrays.hashCode(mMatchSubscriberIds),
                 Arrays.hashCode(mMatchWifiNetworkKeys), mMetered, mRoaming, mDefaultNetwork,
-                mRatType, mOemManaged);
+                mRatType, mOemManaged, mTransportTypesBits);
     }
 
     @Override
@@ -611,7 +625,8 @@ public final class NetworkTemplate implements Parcelable {
                     && mRatType == other.mRatType
                     && mOemManaged == other.mOemManaged
                     && Arrays.equals(mMatchSubscriberIds, other.mMatchSubscriberIds)
-                    && Arrays.equals(mMatchWifiNetworkKeys, other.mMatchWifiNetworkKeys);
+                    && Arrays.equals(mMatchWifiNetworkKeys, other.mMatchWifiNetworkKeys)
+                    && mTransportTypesBits == other.mTransportTypesBits;
         }
         return false;
     }
@@ -709,6 +724,16 @@ public final class NetworkTemplate implements Parcelable {
         return mRatType;
     }
 
+    /**
+     * Get the transport types filter of the template.
+     *
+     * @hide
+     */
+    @NonNull
+    public int[] getTransportTypes() {
+        return BitUtils.unpackBits(mTransportTypesBits);
+    }
+
     /**
      * Get the OEM managed filter of the template. See {@code OEM_MANAGED_*} or
      * {@code android.net.NetworkIdentity#OEM_*}.
@@ -730,7 +755,10 @@ public final class NetworkTemplate implements Parcelable {
         if (!matchesRoaming(ident)) return false;
         if (!matchesDefaultNetwork(ident)) return false;
         if (!matchesOemNetwork(ident)) return false;
+        if (!matchesTransportTypes(ident)) return false;
 
+        // TODO: Convert match rule handling into transport type matches and
+        //  eliminate the need of legacy network types.
         switch (mMatchRule) {
             case MATCH_MOBILE:
                 return matchesMobile(ident);
@@ -778,6 +806,13 @@ public final class NetworkTemplate implements Parcelable {
             || (mOemManaged == ident.mOemManaged);
     }
 
+    private boolean matchesTransportTypes(NetworkIdentity ident) {
+        if (this.mTransportTypesBits == TRANSPORT_TYPES_ALL) return true;
+        // Otherwise, for a match, the identity must possess ALL transport types
+        // specified in the template.
+        return (this.mTransportTypesBits & ident.mTransportTypesBits) == this.mTransportTypesBits;
+    }
+
     private boolean matchesCollapsedRatType(NetworkIdentity ident) {
         return mRatType == NETWORK_TYPE_ALL
                 || NetworkStatsManager.getCollapsedRatType(mRatType)
@@ -1004,7 +1039,8 @@ public final class NetworkTemplate implements Parcelable {
                         (template.mMatchRule == MATCH_MOBILE
                                 || template.mMatchRule == MATCH_CARRIER)
                                 ? METERED_YES : METERED_ALL,
-                        ROAMING_ALL, DEFAULT_NETWORK_ALL, NETWORK_TYPE_ALL, OEM_MANAGED_ALL);
+                        ROAMING_ALL, DEFAULT_NETWORK_ALL, NETWORK_TYPE_ALL, OEM_MANAGED_ALL,
+                        TRANSPORT_TYPES_ALL);
             }
         }
 
@@ -1041,6 +1077,7 @@ public final class NetworkTemplate implements Parcelable {
         private int mRoaming;
         private int mDefaultNetwork;
         private int mRatType;
+        private long mTransportTypesBits;
 
         // Bitfield containing OEM network properties {@code NetworkIdentity#OEM_*}.
         private int mOemManaged;
@@ -1059,6 +1096,7 @@ public final class NetworkTemplate implements Parcelable {
             mDefaultNetwork = DEFAULT_NETWORK_ALL;
             mRatType = NETWORK_TYPE_ALL;
             mOemManaged = OEM_MANAGED_ALL;
+            mTransportTypesBits = TRANSPORT_TYPES_ALL;
         }
 
         /**
@@ -1153,6 +1191,25 @@ public final class NetworkTemplate implements Parcelable {
             return this;
         }
 
+        /**
+         * Sets the transport types filter for this template.
+         *
+         * - If the array is empty, matches any transport type (wildcard).
+         * - If not empty, matches networks possessing ALL specified transport types.
+         * For example, a set with {@code TRANSPORT_WIFI} and {@code TRANSPORT_VPN}
+         * requires a network to have both.
+         *
+         * @param transportTypes The array of {@code NetworkCapabilities#TRANSPORT_*} constants.
+         *                       An empty array acts as a wildcard for all transports.
+         * @return This {@code Builder} for chaining.
+         * @hide
+         */
+        @NonNull
+        public Builder setTransportTypes(int[] transportTypes) {
+            mTransportTypesBits = BitUtils.packBits(transportTypes);
+            return this;
+        }
+
         /**
          * Set the OEM managed filter.
          *
@@ -1203,7 +1260,7 @@ public final class NetworkTemplate implements Parcelable {
             return new NetworkTemplate(mMatchRule,
                     mMatchSubscriberIds.toArray(new String[0]),
                     mMatchWifiNetworkKeys.toArray(new String[0]), mMetered, mRoaming,
-                    mDefaultNetwork, mRatType, mOemManaged);
+                    mDefaultNetwork, mRatType, mOemManaged, mTransportTypesBits);
         }
     }
 }
diff --git a/tests/common/java/android/net/netstats/NetworkTemplateTest.kt b/tests/common/java/android/net/netstats/NetworkTemplateTest.kt
index 808fa50240..7aedf95faf 100644
--- a/tests/common/java/android/net/netstats/NetworkTemplateTest.kt
+++ b/tests/common/java/android/net/netstats/NetworkTemplateTest.kt
@@ -16,6 +16,11 @@
 
 package android.net.netstats
 
+import android.net.NetworkCapabilities.TRANSPORT_BLUETOOTH
+import android.net.NetworkCapabilities.TRANSPORT_CELLULAR
+import android.net.NetworkCapabilities.TRANSPORT_ETHERNET
+import android.net.NetworkCapabilities.TRANSPORT_SATELLITE
+import android.net.NetworkCapabilities.TRANSPORT_WIFI
 import android.net.NetworkStats.DEFAULT_NETWORK_ALL
 import android.net.NetworkStats.METERED_ALL
 import android.net.NetworkStats.METERED_YES
@@ -30,6 +35,7 @@ import android.net.NetworkTemplate.MATCH_PROXY
 import android.net.NetworkTemplate.MATCH_WIFI
 import android.net.NetworkTemplate.NETWORK_TYPE_ALL
 import android.net.NetworkTemplate.OEM_MANAGED_ALL
+import android.net.NetworkTemplate.TRANSPORT_TYPES_ALL
 import android.os.Build
 import android.telephony.TelephonyManager
 import com.android.testutils.ConnectivityModuleTest
@@ -74,7 +80,8 @@ class NetworkTemplateTest {
                                 ROAMING_ALL,
                                 DEFAULT_NETWORK_ALL,
                                 NETWORK_TYPE_ALL,
-                                OEM_MANAGED_ALL
+                                OEM_MANAGED_ALL,
+                                TRANSPORT_TYPES_ALL
                         )
                         assertEquals(expectedTemplate, it)
                     }
@@ -93,7 +100,8 @@ class NetworkTemplateTest {
                                 ROAMING_YES,
                                 DEFAULT_NETWORK_ALL,
                                 NETWORK_TYPE_ALL,
-                                OEM_MANAGED_ALL
+                                OEM_MANAGED_ALL,
+                                TRANSPORT_TYPES_ALL
                         )
                         assertEquals(expectedTemplate, it)
                     }
@@ -123,7 +131,8 @@ class NetworkTemplateTest {
                         ROAMING_ALL,
                         DEFAULT_NETWORK_ALL,
                         NETWORK_TYPE_ALL,
-                        OEM_MANAGED_ALL
+                        OEM_MANAGED_ALL,
+                        TRANSPORT_TYPES_ALL
                 )
                 assertEquals(expectedTemplate, it)
             }
@@ -140,7 +149,8 @@ class NetworkTemplateTest {
                     ROAMING_ALL,
                     DEFAULT_NETWORK_ALL,
                     NETWORK_TYPE_ALL,
-                    OEM_MANAGED_ALL
+                    OEM_MANAGED_ALL,
+                    TRANSPORT_TYPES_ALL
             )
             assertEquals(expectedTemplate, it)
         }
@@ -157,7 +167,8 @@ class NetworkTemplateTest {
                             ROAMING_ALL,
                             DEFAULT_NETWORK_ALL,
                             TelephonyManager.NETWORK_TYPE_UMTS,
-                            OEM_MANAGED_ALL
+                            OEM_MANAGED_ALL,
+                            TRANSPORT_TYPES_ALL
                     )
                     assertEquals(expectedTemplate, it)
                 }
@@ -173,7 +184,8 @@ class NetworkTemplateTest {
                     ROAMING_ALL,
                     DEFAULT_NETWORK_ALL,
                     NETWORK_TYPE_ALL,
-                    OEM_MANAGED_ALL
+                    OEM_MANAGED_ALL,
+                    TRANSPORT_TYPES_ALL
             )
             assertEquals(expectedTemplate, it)
         }
@@ -190,7 +202,8 @@ class NetworkTemplateTest {
                             ROAMING_ALL,
                             DEFAULT_NETWORK_ALL,
                             NETWORK_TYPE_ALL,
-                            OEM_MANAGED_ALL
+                            OEM_MANAGED_ALL,
+                            TRANSPORT_TYPES_ALL
                     )
             assertEquals(expectedTemplate, it)
         }
@@ -207,7 +220,8 @@ class NetworkTemplateTest {
                             ROAMING_ALL,
                             DEFAULT_NETWORK_ALL,
                             NETWORK_TYPE_ALL,
-                            OEM_MANAGED_ALL
+                            OEM_MANAGED_ALL,
+                            TRANSPORT_TYPES_ALL
                     )
                     assertEquals(expectedTemplate, it)
                 }
@@ -224,7 +238,8 @@ class NetworkTemplateTest {
                         ROAMING_ALL,
                         DEFAULT_NETWORK_ALL,
                         NETWORK_TYPE_ALL,
-                        OEM_MANAGED_ALL
+                        OEM_MANAGED_ALL,
+                        TRANSPORT_TYPES_ALL
                 )
                 assertEquals(expectedTemplate, it)
             }
@@ -273,9 +288,34 @@ class NetworkTemplateTest {
                     ROAMING_ALL,
                     DEFAULT_NETWORK_ALL,
                     NETWORK_TYPE_ALL,
-                    OEM_MANAGED_ALL
+                    OEM_MANAGED_ALL,
+                    TRANSPORT_TYPES_ALL
             )
             assertEquals(expectedTemplate, it)
         }
     }
+
+    // Verify the builder does not throw, and transports read from the getter is expected.
+    @Test
+    fun testBuilderTransportTypes() {
+        assertGetSetTransportTypes(MATCH_MOBILE, TRANSPORT_CELLULAR)
+        assertGetSetTransportTypes(MATCH_MOBILE, TRANSPORT_SATELLITE)
+        assertGetSetTransportTypes(MATCH_WIFI, TRANSPORT_WIFI)
+        assertGetSetTransportTypes(MATCH_ETHERNET, TRANSPORT_ETHERNET)
+        assertGetSetTransportTypes(MATCH_BLUETOOTH, TRANSPORT_BLUETOOTH)
+        assertGetSetTransportTypes(MATCH_PROXY, TRANSPORT_BLUETOOTH)
+        assertGetSetTransportTypes(MATCH_CARRIER, TRANSPORT_CELLULAR)
+        assertGetSetTransportTypes(MATCH_CARRIER, TRANSPORT_WIFI)
+    }
+
+    private fun assertGetSetTransportTypes(matchRule: Int, transport: Int) {
+        val builder = NetworkTemplate.Builder(matchRule)
+                .setTransportTypes(intArrayOf(transport))
+        if (matchRule == MATCH_CARRIER) {
+            builder.setSubscriberIds(setOf(TEST_IMSI1))
+        }
+        val template = builder.build()
+        assertEquals(1, template.transportTypes.size)
+        assertEquals(transport, template.transportTypes[0])
+    }
 }
diff --git a/tests/unit/java/android/net/NetworkTemplateTest.kt b/tests/unit/java/android/net/NetworkTemplateTest.kt
index f1f455b4b3..10392b47f6 100644
--- a/tests/unit/java/android/net/NetworkTemplateTest.kt
+++ b/tests/unit/java/android/net/NetworkTemplateTest.kt
@@ -21,7 +21,10 @@ import android.content.Context
 import android.net.ConnectivityManager.TYPE_MOBILE
 import android.net.ConnectivityManager.TYPE_TEST
 import android.net.ConnectivityManager.TYPE_WIFI
+import android.net.NetworkCapabilities.TRANSPORT_CELLULAR
+import android.net.NetworkCapabilities.TRANSPORT_SATELLITE
 import android.net.NetworkCapabilities.TRANSPORT_TEST
+import android.net.NetworkCapabilities.TRANSPORT_VPN
 import android.net.NetworkCapabilities.TRANSPORT_WIFI
 import android.net.NetworkIdentity.OEM_NONE
 import android.net.NetworkIdentity.OEM_PAID
@@ -40,6 +43,7 @@ import android.net.NetworkTemplate.NETWORK_TYPE_ALL
 import android.net.NetworkTemplate.OEM_MANAGED_ALL
 import android.net.NetworkTemplate.OEM_MANAGED_NO
 import android.net.NetworkTemplate.OEM_MANAGED_YES
+import android.net.NetworkTemplate.TRANSPORT_TYPES_ALL
 import android.net.NetworkTemplate.buildTemplateMobileAll
 import android.net.NetworkTemplate.buildTemplateMobileWildcard
 import android.net.NetworkTemplate.buildTemplateWifiWildcard
@@ -47,6 +51,7 @@ import android.net.NetworkTemplate.normalize
 import android.net.wifi.WifiInfo
 import android.os.Build
 import android.telephony.TelephonyManager
+import com.android.net.module.util.BitUtils
 import com.android.testutils.DevSdkIgnoreRule
 import com.android.testutils.DevSdkIgnoreRunner
 import com.android.testutils.NonNullTestUtils
@@ -93,7 +98,8 @@ class NetworkTemplateTest {
             subscriberId: String? = null,
             wifiKey: String? = null,
             oemManaged: Int = OEM_NONE,
-            metered: Boolean = true
+            metered: Boolean = true,
+            transportTypes: IntArray = intArrayOf(),
     ): NetworkStateSnapshot {
         `when`(mockWifiInfo.getNetworkKey()).thenReturn(wifiKey)
         val lp = LinkProperties()
@@ -108,6 +114,7 @@ class NetworkTemplateTest {
                     NetworkCapabilities.NET_CAPABILITY_OEM_PRIVATE,
                     (oemManaged and OEM_PRIVATE) == OEM_PRIVATE
             )
+            setTransportTypes(transportTypes)
             if (type == TYPE_TEST) {
                 wifiKey?.let { TestNetworkSpecifier(it) }?.let {
                     // Must have a single non-test transport specified to use setNetworkSpecifier.
@@ -193,7 +200,8 @@ class NetworkTemplateTest {
                 ROAMING_ALL,
                 DEFAULT_NETWORK_ALL,
                 NETWORK_TYPE_ALL,
-                OEM_MANAGED_ALL
+                OEM_MANAGED_ALL,
+                TRANSPORT_TYPES_ALL
         )
 
         val identMobile1 = buildNetworkIdentity(
@@ -676,6 +684,7 @@ class NetworkTemplateTest {
     fun testEquals() {
         val templateImsi1 = NetworkTemplate.Builder(MATCH_MOBILE).setMeteredness(METERED_YES)
                 .setSubscriberIds(setOf(TEST_IMSI1)).setRatType(TelephonyManager.NETWORK_TYPE_UMTS)
+                .setTransportTypes(intArrayOf(TRANSPORT_SATELLITE, TRANSPORT_VPN))
                 .build()
         val dupTemplateImsi1 = NetworkTemplate(
                 MATCH_MOBILE,
@@ -685,7 +694,8 @@ class NetworkTemplateTest {
                 ROAMING_ALL,
                 DEFAULT_NETWORK_ALL,
                 TelephonyManager.NETWORK_TYPE_UMTS,
-                OEM_MANAGED_ALL
+                OEM_MANAGED_ALL,
+                BitUtils.packBits(intArrayOf(TRANSPORT_SATELLITE, TRANSPORT_VPN))
         )
         val templateImsi2 = NetworkTemplate.Builder(MATCH_MOBILE).setMeteredness(METERED_YES)
                 .setSubscriberIds(setOf(TEST_IMSI2)).setRatType(TelephonyManager.NETWORK_TYPE_UMTS)
@@ -696,7 +706,9 @@ class NetworkTemplateTest {
         assertNotEquals(templateImsi1, templateImsi2)
 
         val templateWifiKey1 = NetworkTemplate.Builder(MATCH_WIFI)
-                .setWifiNetworkKeys(setOf(TEST_WIFI_KEY1)).build()
+                .setWifiNetworkKeys(setOf(TEST_WIFI_KEY1))
+                .setTransportTypes(intArrayOf(TRANSPORT_WIFI))
+                .build()
         val dupTemplateWifiKey1 = NetworkTemplate(
                 MATCH_WIFI,
                 emptyArray<String>(),
@@ -705,7 +717,8 @@ class NetworkTemplateTest {
                 ROAMING_ALL,
                 DEFAULT_NETWORK_ALL,
                 NETWORK_TYPE_ALL,
-                OEM_MANAGED_ALL
+                OEM_MANAGED_ALL,
+                BitUtils.packBits(intArrayOf(TRANSPORT_WIFI))
         )
         val templateWifiKey2 = NetworkTemplate.Builder(MATCH_WIFI)
                 .setWifiNetworkKeys(setOf(TEST_WIFI_KEY2)).build()
@@ -725,7 +738,8 @@ class NetworkTemplateTest {
                 ROAMING_ALL,
                 DEFAULT_NETWORK_ALL,
                 TelephonyManager.NETWORK_TYPE_LTE,
-                OEM_MANAGED_ALL
+                OEM_MANAGED_ALL,
+                0x12345678L
         )
         val templateWifi = NetworkTemplate(
                 MATCH_WIFI,
@@ -735,7 +749,8 @@ class NetworkTemplateTest {
                 ROAMING_ALL,
                 DEFAULT_NETWORK_ALL,
                 0,
-                OEM_MANAGED_ALL
+                OEM_MANAGED_ALL,
+                0xDEADBEEFL
         )
         val templateOem = NetworkTemplate(
                 MATCH_MOBILE,
@@ -745,11 +760,12 @@ class NetworkTemplateTest {
                 ROAMING_ALL,
                 DEFAULT_NETWORK_ALL,
                 0,
-                OEM_MANAGED_YES
+                OEM_MANAGED_YES,
+                0xFFFFFFFFL
         )
-        assertParcelSane(templateMobile, 8)
-        assertParcelSane(templateWifi, 8)
-        assertParcelSane(templateOem, 8)
+        assertParcelSane(templateMobile, 9)
+        assertParcelSane(templateWifi, 9)
+        assertParcelSane(templateOem, 9)
     }
 
     // Verify NETWORK_TYPE_* constants in NetworkTemplate do not conflict with
@@ -818,7 +834,8 @@ class NetworkTemplateTest {
                 ROAMING_ALL,
                 DEFAULT_NETWORK_ALL,
                 NETWORK_TYPE_ALL,
-                OEM_MANAGED_YES
+                OEM_MANAGED_YES,
+                TRANSPORT_TYPES_ALL
         )
         val templateOemAll = NetworkTemplate(
                 matchType,
@@ -828,7 +845,8 @@ class NetworkTemplateTest {
                 ROAMING_ALL,
                 DEFAULT_NETWORK_ALL,
                 NETWORK_TYPE_ALL,
-                OEM_MANAGED_ALL
+                OEM_MANAGED_ALL,
+                TRANSPORT_TYPES_ALL
         )
 
         for (identityOemManagedState in oemManagedStates) {
@@ -854,7 +872,8 @@ class NetworkTemplateTest {
                         ROAMING_ALL,
                         DEFAULT_NETWORK_ALL,
                         NETWORK_TYPE_ALL,
-                        templateOemManagedState
+                        templateOemManagedState,
+                        TRANSPORT_TYPES_ALL
                 )
                 if (identityOemManagedState == templateOemManagedState) {
                     template.assertMatches(ident)
@@ -886,6 +905,54 @@ class NetworkTemplateTest {
         matchOemManagedIdent(TYPE_WIFI, MATCH_WIFI, identWifiKey = TEST_WIFI_KEY1)
     }
 
+    @Test
+    fun testTransportTypesMatches() {
+        val identSatellite = NetworkIdentity.Builder()
+                .setType(TYPE_MOBILE)
+                .setTransportTypes(setOf(TRANSPORT_SATELLITE))
+                .build()
+        val identMobileVpn = NetworkIdentity.Builder()
+                .setType(TYPE_MOBILE)
+                .setTransportTypes(setOf(TRANSPORT_CELLULAR, TRANSPORT_VPN))
+                .build()
+        val identOnlyCellular = NetworkIdentity.Builder()
+                .setType(TYPE_MOBILE)
+                .setTransportTypes(setOf(TRANSPORT_CELLULAR))
+                .build()
+
+        val templateMobileNoTransport = NetworkTemplate.Builder(MATCH_MOBILE)
+                .build() // Wildcard for transports
+        val templateMobileWithCellularTransport = NetworkTemplate.Builder(MATCH_MOBILE)
+                .setTransportTypes(intArrayOf(TRANSPORT_CELLULAR))
+                .build()
+        val templateSatellite = NetworkTemplate.Builder(MATCH_MOBILE)
+                .setTransportTypes(intArrayOf(TRANSPORT_SATELLITE))
+                .build()
+        val templateVpnAndCellular = NetworkTemplate.Builder(MATCH_MOBILE)
+                .setTransportTypes(intArrayOf(TRANSPORT_VPN, TRANSPORT_CELLULAR))
+                .build()
+
+        // 1. Mobile wildcard template
+        templateMobileNoTransport.assertMatches(identSatellite)
+        templateMobileNoTransport.assertMatches(identMobileVpn)
+        templateMobileNoTransport.assertMatches(identOnlyCellular)
+
+        // 2. Template requiring TRANSPORT_CELLULAR
+        templateMobileWithCellularTransport.assertDoesNotMatch(identSatellite)
+        templateMobileWithCellularTransport.assertMatches(identMobileVpn)
+        templateMobileWithCellularTransport.assertMatches(identOnlyCellular)
+
+        // 3. Template requiring TRANSPORT_SATELLITE
+        templateSatellite.assertMatches(identSatellite)
+        templateSatellite.assertDoesNotMatch(identMobileVpn)
+        templateSatellite.assertDoesNotMatch(identOnlyCellular)
+
+        // 4. Template requiring TRANSPORT_VPN AND TRANSPORT_CELLULAR
+        templateVpnAndCellular.assertDoesNotMatch(identSatellite)
+        templateVpnAndCellular.assertMatches(identMobileVpn)
+        templateVpnAndCellular.assertDoesNotMatch(identOnlyCellular)
+    }
+
     @Test
     fun testNormalize() {
         var mergedImsiList = arrayOf(TEST_IMSI1, TEST_IMSI2)
diff --git a/tests/unit/java/com/android/server/net/NetworkStatsServiceTest.java b/tests/unit/java/com/android/server/net/NetworkStatsServiceTest.java
index de54e8d145..90c9fc5c0a 100644
--- a/tests/unit/java/com/android/server/net/NetworkStatsServiceTest.java
+++ b/tests/unit/java/com/android/server/net/NetworkStatsServiceTest.java
@@ -1535,6 +1535,78 @@ public class NetworkStatsServiceTest extends NetworkStatsBaseTest {
 
     }
 
+    // This test demonstrates that a network identity with legacy type TYPE_MOBILE
+    // can represent different underlying physical transports (e.g., satellite or cellular).
+    // NetworkTemplate, using MATCH_MOBILE, can then differentiate these further
+    // by applying a transportTypes filter.
+    @Test
+    public void testGetSatelliteStats() throws Exception {
+        mockDefaultSettings();
+        final NetworkTemplate templateSatellite =
+                new NetworkTemplate.Builder(MATCH_MOBILE)
+                        .setMeteredness(METERED_YES)
+                        .setSubscriberIds(Set.of(IMSI_1))
+                        .setTransportTypes(new int[]{NetworkCapabilities.TRANSPORT_SATELLITE})
+                        .build();
+
+        final NetworkTemplate templateCellularOnly =
+                new NetworkTemplate.Builder(MATCH_MOBILE)
+                        .setMeteredness(METERED_YES)
+                        .setSubscriberIds(Set.of(IMSI_1))
+                        .setTransportTypes(new int[]{NetworkCapabilities.TRANSPORT_CELLULAR})
+                        .build();
+
+        // Initial state: Assert all relevant templates are empty
+        assertUidTotal(sTemplateImsi1, UID_RED, 0L, 0L, 0L, 0L, 0);
+        assertUidTotal(templateSatellite, UID_RED, 0L, 0L, 0L, 0L, 0);
+        assertUidTotal(templateCellularOnly, UID_RED, 0L, 0L, 0L, 0L, 0);
+
+        // 1. Bring up SATELLITE mobile network for IMSI_1
+        NetworkStateSnapshot satelliteState = buildSatelliteMobileState(IMSI_1);
+
+        mService.notifyNetworkStatus(NETWORKS_MOBILE, new NetworkStateSnapshot[]{satelliteState},
+                getActiveIface(satelliteState), new UnderlyingNetworkInfo[0]);
+        setMobileRatTypeAndWaitForIdle(TelephonyManager.NETWORK_TYPE_LTE);
+
+        // Record 100 bytes of data on the satellite network for UID_RED
+        incrementCurrentTime(HOUR_IN_MILLIS);
+        mockNetworkStatsUidDetail(new NetworkStats(getElapsedRealtime(), 1)
+                .insertEntry(TEST_IFACE, UID_RED, SET_DEFAULT, TAG_NONE, METERED_YES, ROAMING_NO,
+                        DEFAULT_NETWORK_YES, 100L, 10L, 100L, 10L, 0L));
+        forcePollAndWaitForIdle();
+
+        // Verify data attribution for SATELLITE
+        // sTemplateImsi1 (general mobile) should count satellite data.
+        assertUidTotal(sTemplateImsi1, UID_RED, 100L, 10L, 100L, 10L, 0);
+        // sTemplateMobileSatelliteImsi1 (satellite specific) should count satellite data.
+        assertUidTotal(templateSatellite, UID_RED, 100L, 10L, 100L, 10L, 0);
+        // templateCellularOnly (cellular specific) should NOT count satellite data.
+        assertUidTotal(templateCellularOnly, UID_RED, 0L, 0L, 0L, 0L, 0);
+
+        // 2. Switch to CELLULAR mobile network for IMSI_1 on the same interface
+        NetworkStateSnapshot cellularState = buildMobileState(IMSI_1);
+
+        mService.notifyNetworkStatus(NETWORKS_MOBILE, new NetworkStateSnapshot[]{cellularState},
+                getActiveIface(cellularState), new UnderlyingNetworkInfo[0]);
+        // Mocking UID details to reflect total traffic on the interface since boot/last poll.
+        // Previous satellite data (100B) + new cellular data (200B) = 300B total on iface.
+        incrementCurrentTime(HOUR_IN_MILLIS);
+        mockNetworkStatsUidDetail(new NetworkStats(getElapsedRealtime(), 1)
+                .insertEntry(TEST_IFACE, UID_RED, SET_DEFAULT, TAG_NONE, METERED_YES, ROAMING_NO,
+                        DEFAULT_NETWORK_YES, 300L, 30L, 300L, 30L, 0L)); // 100sat + 200cell
+        forcePollAndWaitForIdle();
+
+        // Verify data attribution after CELLULAR usage
+        // sTemplateImsi1 (general mobile) should count cumulative data (satellite + cellular).
+        // (100 previous + 200 new = 300 total)
+        assertUidTotal(sTemplateImsi1, UID_RED, 300L, 30L, 300L, 30L, 0);
+        // sTemplateMobileSatelliteImsi1 should still only have the satellite data.
+        assertUidTotal(templateSatellite, UID_RED, 100L, 10L, 100L, 10L, 0);
+        // templateCellularOnly should now have the new cellular data (200B).
+        // (Current total on iface 300B - previous total on iface before this poll 100B = 200B)
+        assertUidTotal(templateCellularOnly, UID_RED, 200L, 20L, 200L, 20L, 0);
+    }
+
     @Test
     public void testForegroundBackground() throws Exception {
         // pretend that network comes online

From 720ccd2b3232bd3491070301067d1734845e1a4b Mon Sep 17 00:00:00 2001
From: Sewook Seo <sewookseo@google.com>
Date: Mon, 18 Nov 2024 12:46:12 +0000
Subject: [PATCH 305/377] Add a Map to NetworkAgent list for IP address

Keeping a map from IP addresses to the list of NetworkAgentInfos that have
that IP address in their LinkProperties.

Bug: 373280981
Bug: 331139818i
Flag: android.net.platform.flags.connectivity_service_destroy_socket
Test: atest ConnectivityCoverageTests
Test: device test
Change-Id: I1e39ce00d8bc49252df8088efc768804ae9ee0a8
---
 .../android/server/ConnectivityService.java   |  69 ++++++++
 .../net/module/util/LinkPropertiesUtils.java  |  17 ++
 .../CSDestroySocketTest.kt                    | 147 ++++++++++++++++--
 .../base/CSAgentWrapper.kt                    | 142 ++++++++++++++++-
 .../server/connectivityservice/base/CSTest.kt |   2 +
 5 files changed, 363 insertions(+), 14 deletions(-)

diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index 0a74857a6c..2f28265334 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -275,6 +275,7 @@ import android.net.netd.aidl.NativeUidRangeConfig;
 import android.net.networkstack.ModuleNetworkStackClient;
 import android.net.networkstack.NetworkStackClientBase;
 import android.net.networkstack.aidl.NetworkMonitorParameters;
+import android.net.platform.flags.Flags;
 import android.net.resolv.aidl.DnsHealthEventParcel;
 import android.net.resolv.aidl.IDnsResolverUnsolicitedEventListener;
 import android.net.resolv.aidl.Nat64PrefixEventParcel;
@@ -348,6 +349,7 @@ import com.android.net.module.util.CollectionUtils;
 import com.android.net.module.util.DeviceConfigUtils;
 import com.android.net.module.util.HandlerUtils;
 import com.android.net.module.util.InterfaceParams;
+import com.android.net.module.util.LinkPropertiesUtils;
 import com.android.net.module.util.LinkPropertiesUtils.CompareOrUpdateResult;
 import com.android.net.module.util.LinkPropertiesUtils.CompareResult;
 import com.android.net.module.util.LocationPermissionChecker;
@@ -409,6 +411,7 @@ import java.io.InterruptedIOException;
 import java.io.PrintWriter;
 import java.io.Writer;
 import java.net.Inet4Address;
+import java.net.Inet6Address;
 import java.net.InetAddress;
 import java.net.InetSocketAddress;
 import java.net.SocketException;
@@ -1130,6 +1133,9 @@ public class ConnectivityService extends IConnectivityManager.Stub
     @Nullable
     private final QuicConnectionCloser mQuicConnectionCloser;
 
+    // A map from IP address to networks. Only the handler thread is allowed to access this field.
+    @Nullable @VisibleForTesting final Map<InetAddress, Set<NetworkAgentInfo>> mIpToNetworksMap;
+
     /**
      * Implements support for the legacy "one network per network type" model.
      *
@@ -1859,6 +1865,11 @@ public class ConnectivityService extends IConnectivityManager.Stub
                 final SparseArray<NetworkAgentInfo> networkForNetId, final Handler handler) {
             return new QuicConnectionCloser(networkForNetId, handler);
         }
+
+        /** Whether the flag for connectivity service socket destroy is enabled or not. */
+        public boolean flagConnectivityServiceDestroySocket() {
+            return Flags.connectivityServiceDestroySocket();
+        }
     }
 
     public ConnectivityService(Context context) {
@@ -1993,6 +2004,11 @@ public class ConnectivityService extends IConnectivityManager.Stub
             mSatelliteAccessController = null;
         }
 
+        if (mDeps.flagConnectivityServiceDestroySocket()) {
+            mIpToNetworksMap = new HashMap<>();
+        } else {
+            mIpToNetworksMap = null;
+        }
         // To ensure uid state is synchronized with Network Policy, register for
         // NetworkPolicyManagerService events must happen prior to NetworkPolicyManagerService
         // reading existing policy from disk.
@@ -4586,6 +4602,21 @@ public class ConnectivityService extends IConnectivityManager.Stub
                 (mMulticastRoutingCoordinatorService != null));
         pw.println("Background firewall chain enabled: " + mBackgroundFirewallChainEnabled);
         pw.println("IngressToVpnAddressFiltering: " + mIngressToVpnAddressFiltering);
+
+        if (mIpToNetworksMap != null) {
+            pw.println();
+            pw.println("mIpToNetworksMap:");
+            pw.increaseIndent();
+            for (Map.Entry<InetAddress, Set<NetworkAgentInfo>> info : mIpToNetworksMap.entrySet()) {
+                StringBuilder sb = new StringBuilder();
+                sb.append(info.getKey()).append(": ");
+                for (NetworkAgentInfo nai : info.getValue()) {
+                    sb.append("{").append(nai.network).append("}");
+                }
+                pw.println(sb);
+            }
+            pw.decreaseIndent();
+        }
     }
 
     private void dumpNetworks(IndentingPrintWriter pw) {
@@ -5732,6 +5763,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
             // for an unnecessarily long time.
             destroyNativeNetwork(nai);
         }
+        updateIpAddressesForNetwork(nai, nai.linkProperties, null);
         if (!nai.isCreated() && !mDeps.isAtLeastT()) {
             // Backwards compatibility: send onNetworkDestroyed even if network was never created.
             // This can never run if the code above runs because shouldDestroyNativeNetwork is
@@ -9850,12 +9882,49 @@ public class ConnectivityService extends IConnectivityManager.Stub
             }
             networkAgent.networkMonitor().notifyLinkPropertiesChanged(
                     new LinkProperties(newLp, true /* parcelSensitiveFields */));
+            updateIpAddressesForNetwork(networkAgent, oldLp, newLp);
             notifyNetworkCallbacks(networkAgent, CALLBACK_IP_CHANGED);
         }
 
         mKeepaliveTracker.handleCheckKeepalivesStillValid(networkAgent);
     }
 
+    private void updateIpAddressesForNetwork(
+            NetworkAgentInfo nai, LinkProperties oldLp, LinkProperties newLp) {
+        ensureRunningOnConnectivityServiceThread();
+        if (mIpToNetworksMap == null) {
+            return;
+        }
+
+        final CompareResult<LinkAddress> result =
+                LinkPropertiesUtils.compareAllAddresses(oldLp, newLp);
+
+        if (!result.added.isEmpty()) {
+            for (LinkAddress la : result.added) {
+                if (la.getAddress() instanceof Inet6Address
+                        && la.getAddress().isLinkLocalAddress()) {
+                    // Some NetworkAgents may not report IPv6 link local address to CS, thus socket
+                    // destruction on the address will be done at handling RTM_DELADDR and the
+                    // address doesn't need to be added to mIpToNetworksMap.
+                    continue;
+                }
+                mIpToNetworksMap.computeIfAbsent(la.getAddress(), k -> new ArraySet<>()).add(nai);
+            }
+        }
+
+        if (!result.removed.isEmpty()) {
+            for (LinkAddress la : result.removed) {
+                final Set<NetworkAgentInfo> networks = mIpToNetworksMap.get(la.getAddress());
+                if (networks != null) {
+                    networks.remove(nai);
+                    if (networks.isEmpty()) {
+                        mIpToNetworksMap.remove(la.getAddress());
+                    }
+                }
+            }
+        }
+    }
+
     private void applyInitialLinkProperties(@NonNull NetworkAgentInfo nai) {
         updateLinkProperties(nai, new LinkProperties(nai.linkProperties), null);
     }
diff --git a/staticlibs/framework/com/android/net/module/util/LinkPropertiesUtils.java b/staticlibs/framework/com/android/net/module/util/LinkPropertiesUtils.java
index e271f64902..4760dfca5f 100644
--- a/staticlibs/framework/com/android/net/module/util/LinkPropertiesUtils.java
+++ b/staticlibs/framework/com/android/net/module/util/LinkPropertiesUtils.java
@@ -146,6 +146,23 @@ public final class LinkPropertiesUtils {
                 right != null ? right.getLinkAddresses() : null);
     }
 
+    /**
+     * Compares the all addresses including stacked addresses in {@code left} LinkProperties with
+     * {@code right} LinkProperties, examining only addresses on the base link.
+     *
+     * @param left A LinkProperties with the old list of all addresses.
+     * @param right A LinkProperties with the new list of all addresses.
+     * @return the differences between the addresses.
+     */
+    public static @NonNull CompareResult<LinkAddress> compareAllAddresses(
+            @Nullable LinkProperties left, @Nullable LinkProperties right) {
+        /*
+         * Same logic as compareAddresses()
+         */
+        return new CompareResult<>(left != null ? left.getAllLinkAddresses() : null,
+                right != null ? right.getAllLinkAddresses() : null);
+    }
+
     /**
      * Compares {@code left} {@code LinkProperties} allLinkAddresses against the {@code right}.
      *
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSDestroySocketTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSDestroySocketTest.kt
index 56d934bf51..ab666d2c33 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSDestroySocketTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSDestroySocketTest.kt
@@ -24,13 +24,28 @@ import android.net.ConnectivityManager.BLOCKED_REASON_NONE
 import android.net.ConnectivityManager.FIREWALL_CHAIN_BACKGROUND
 import android.net.ConnectivityManager.FIREWALL_RULE_ALLOW
 import android.net.ConnectivityManager.FIREWALL_RULE_DENY
+import android.net.LinkAddress
 import android.net.LinkProperties
-import android.net.NetworkCapabilities
+import android.net.NetworkCapabilities.NET_CAPABILITY_INTERNET
+import android.net.NetworkCapabilities.TRANSPORT_BLUETOOTH
+import android.net.NetworkCapabilities.TRANSPORT_CELLULAR
+import android.net.NetworkCapabilities.TRANSPORT_ETHERNET
+import android.net.NetworkCapabilities.TRANSPORT_WIFI
+import android.net.NetworkRequest
 import android.os.Build
 import com.android.net.module.util.BaseNetdUnsolicitedEventListener
 import com.android.server.connectivity.ConnectivityFlags.DELAY_DESTROY_SOCKETS
 import com.android.testutils.DevSdkIgnoreRule
 import com.android.testutils.DevSdkIgnoreRunner
+import com.android.testutils.TestableNetworkAgent.Event.OnNetworkDestroyed
+import com.android.testutils.TestableNetworkCallback
+import com.android.testutils.TestableNetworkCallback.Event.LinkPropertiesChanged
+import java.net.Inet6Address
+import java.net.InetAddress
+import junit.framework.Assert.assertFalse
+import junit.framework.Assert.assertTrue
+import kotlin.test.assertEquals
+import kotlin.test.assertNotNull
 import org.junit.Test
 import org.junit.runner.RunWith
 import org.mockito.ArgumentCaptor
@@ -45,17 +60,21 @@ private const val TEST_UID = 1234
 private const val TEST_UID2 = 5678
 private const val TEST_CELL_IFACE = "test_rmnet"
 
-private fun cellNc() = NetworkCapabilities.Builder()
-        .addTransportType(NetworkCapabilities.TRANSPORT_CELLULAR)
-        .addCapability(NetworkCapabilities.NET_CAPABILITY_INTERNET)
-        .addCapability(NetworkCapabilities.NET_CAPABILITY_NOT_SUSPENDED)
-        .addCapability(NetworkCapabilities.NET_CAPABILITY_NOT_VCN_MANAGED)
-        .build()
+private fun cellNc() = makeNc(TRANSPORT_CELLULAR)
 
-private fun cellLp() = LinkProperties().also{
-    it.interfaceName = TEST_CELL_IFACE
+private fun makeNc(transportType: Int) = nc(transportType, NET_CAPABILITY_INTERNET)
+
+private fun cellLp() = makeLp(TEST_CELL_IFACE)
+
+private fun makeLp(interfaceName: String) = LinkProperties().also{
+    it.interfaceName = interfaceName
 }
 
+private fun makeRequest(transportType: Int) = NetworkRequest.Builder()
+    .clearCapabilities()
+    .addTransportType(transportType)
+    .build()
+
 @RunWith(DevSdkIgnoreRunner::class)
 @DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.UPSIDE_DOWN_CAKE)
 class CSDestroySocketTest : CSTest() {
@@ -336,4 +355,114 @@ class CSDestroySocketTest : CSTest() {
                 expectDestroySockets = false
         )
     }
+
+    private fun InetAddress.toLinkAddress() =
+        LinkAddress(this, if (this is Inet6Address) 64 else 24)
+
+    private fun prepareNetworkAgent(
+        interfaceName: String,
+        addresses: List<LinkAddress>,
+        transportType: Int
+    ): Pair<CSAgentWrapper, TestableNetworkCallback> {
+        val callback = TestableNetworkCallback()
+        cm.registerNetworkCallback(makeRequest(transportType), callback)
+        val linkProperties = makeLp(interfaceName)
+        for (address in addresses) {
+            linkProperties.addLinkAddress(address)
+        }
+        val agent = Agent(nc = makeNc(transportType), lp = linkProperties)
+        agent.connect()
+        return agent to callback
+    }
+
+    @Test
+    fun testIpToNetworksMap() {
+        val addressV6_1 = InetAddress.getByName("2001:DB8:0100::1111")
+        val addressV6_2 = InetAddress.getByName("2001:DB8:0200::2222")
+        val addressV6_3 = InetAddress.getByName("2001:DB8:0333::3333")
+        val addressV6LinkLocal = InetAddress.getByName("FE80::1234")
+        val addressV4_1 = InetAddress.getByName("192.0.2.10")
+        val addressV4_2 = InetAddress.getByName("192.0.2.11")
+        // Creates 3 NetworkAgent with various IP addresses(some are used for only one network
+        // agent some are used for multiple network agents.)
+
+        val (cellAgent, cellCallback) = prepareNetworkAgent(
+            "rmnet1",
+            arrayListOf(addressV6_1.toLinkAddress(), addressV4_1.toLinkAddress()),
+            TRANSPORT_CELLULAR
+        )
+
+        val (wlanAgent, wlanCallback) = prepareNetworkAgent(
+            "wlan1",
+            arrayListOf(addressV6_2.toLinkAddress(), addressV4_1.toLinkAddress()),
+            TRANSPORT_WIFI
+        )
+        val (ethAgent, ethCallback) = prepareNetworkAgent(
+            "eth2",
+            arrayListOf(addressV6_2.toLinkAddress(), addressV4_2.toLinkAddress()),
+            TRANSPORT_ETHERNET
+        )
+        val ipToNetworksMap = assertNotNull(service.mIpToNetworksMap)
+        fun InetAddress.getNetworks() = ipToNetworksMap[this]!!.map{ it.network }.toSet()
+
+        // Verify mIpToNetworksMap properly stores network agents based on IP addresses.
+        assertEquals(setOf(cellAgent.network), addressV6_1.getNetworks())
+        assertEquals(
+            setOf(wlanAgent.network, ethAgent.network),
+            addressV6_2.getNetworks()
+        )
+        assertEquals(
+            setOf(wlanAgent.network, cellAgent.network),
+            addressV4_1.getNetworks()
+        )
+        assertEquals(setOf(ethAgent.network), addressV4_2.getNetworks())
+
+        // Disconnect network agent#2 & #3.
+        wlanAgent.disconnect()
+        ethAgent.disconnect()
+        // Update only interface name without IP address change for network agent #1.
+        val linkProperties = makeLp("ipsec1")
+        linkProperties.addLinkAddress(addressV4_1.toLinkAddress())
+        linkProperties.addLinkAddress(addressV6_1.toLinkAddress())
+        cellAgent.sendLinkProperties(linkProperties)
+        cellCallback.eventuallyExpect<LinkPropertiesChanged> {
+            it.network == cellAgent.network && it.lp.interfaceName == "ipsec1"
+        }
+
+        // Verify mIpToNetworksMap for the LinkPropertiesChanged
+        assertFalse(ipToNetworksMap.containsKey(addressV6_2))
+        assertFalse(ipToNetworksMap.containsKey(addressV4_2))
+        assertEquals(setOf(cellAgent.network), addressV6_1.getNetworks())
+        assertEquals(setOf(cellAgent.network), addressV4_1.getNetworks())
+
+        // Change IP addresses for network agent #1.
+        val linkProperties2 = makeLp("rmnet1")
+        linkProperties2.addLinkAddress(addressV4_2.toLinkAddress())
+        linkProperties2.addLinkAddress(addressV6_1.toLinkAddress())
+        linkProperties2.addLinkAddress(addressV6_3.toLinkAddress())
+        cellAgent.sendLinkProperties(linkProperties2)
+        // Add network agent#4
+        val (agent4, callback4) = prepareNetworkAgent(
+            "bt1",
+            arrayListOf(addressV6LinkLocal.toLinkAddress(), addressV4_2.toLinkAddress()),
+            TRANSPORT_BLUETOOTH
+        )
+        assertEquals(3, ipToNetworksMap.size)
+        assertEquals(setOf(cellAgent.network), addressV6_1.getNetworks())
+        assertEquals(
+            setOf(cellAgent.network, agent4.network),
+            addressV4_2.getNetworks()
+        )
+        assertEquals(setOf(cellAgent.network), addressV6_3.getNetworks())
+        assertFalse(ipToNetworksMap.containsKey(addressV4_1))
+        // This map doesn't handle IPv6 link local addresses.
+        assertFalse(ipToNetworksMap.containsKey(addressV6LinkLocal))
+
+        // Disconnect all remaining network agents.
+        cellAgent.disconnect()
+        agent4.disconnect()
+        agent4.eventuallyExpect<OnNetworkDestroyed>()
+        // Verify mIpToNetworksMap is empty.
+        assertTrue(ipToNetworksMap.isEmpty())
+    }
 }
diff --git a/tests/unit/java/com/android/server/connectivityservice/base/CSAgentWrapper.kt b/tests/unit/java/com/android/server/connectivityservice/base/CSAgentWrapper.kt
index 4dd6d82e08..990ef47392 100644
--- a/tests/unit/java/com/android/server/connectivityservice/base/CSAgentWrapper.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/base/CSAgentWrapper.kt
@@ -22,6 +22,7 @@ import android.net.INetworkMonitor
 import android.net.INetworkMonitor.NETWORK_VALIDATION_PROBE_DNS
 import android.net.INetworkMonitor.NETWORK_VALIDATION_PROBE_HTTP
 import android.net.INetworkMonitorCallbacks
+import android.net.KeepalivePacketData
 import android.net.LinkProperties
 import android.net.LocalNetworkConfig
 import android.net.Network
@@ -35,13 +36,36 @@ import android.net.NetworkProvider
 import android.net.NetworkRequest
 import android.net.NetworkScore
 import android.net.NetworkTestResultParcelable
+import android.net.QosFilter
+import android.net.Uri
 import android.net.networkstack.NetworkStackClientBase
 import android.os.HandlerThread
+import android.os.Looper
+import com.android.net.module.util.ArrayTrackRecord
+import com.android.testutils.TestableNetworkAgent.Event
+import com.android.testutils.TestableNetworkAgent.Event.OnAddKeepalivePacketFilter
+import com.android.testutils.TestableNetworkAgent.Event.OnAutomaticReconnectDisabled
+import com.android.testutils.TestableNetworkAgent.Event.OnBandwidthUpdateRequested
+import com.android.testutils.TestableNetworkAgent.Event.OnDscpPolicyStatusUpdated
+import com.android.testutils.TestableNetworkAgent.Event.OnNetworkCreated
+import com.android.testutils.TestableNetworkAgent.Event.OnNetworkDestroyed
+import com.android.testutils.TestableNetworkAgent.Event.OnNetworkUnwanted
+import com.android.testutils.TestableNetworkAgent.Event.OnRegisterQosCallback
+import com.android.testutils.TestableNetworkAgent.Event.OnRemoveKeepalivePacketFilter
+import com.android.testutils.TestableNetworkAgent.Event.OnSaveAcceptUnvalidated
+import com.android.testutils.TestableNetworkAgent.Event.OnSignalStrengthThresholdsUpdated
+import com.android.testutils.TestableNetworkAgent.Event.OnStartSocketKeepalive
+import com.android.testutils.TestableNetworkAgent.Event.OnStopSocketKeepalive
+import com.android.testutils.TestableNetworkAgent.Event.OnUnregisterQosCallback
+import com.android.testutils.TestableNetworkAgent.Event.OnValidationStatus
 import com.android.testutils.TestableNetworkCallback
 import com.android.testutils.TestableNetworkCallback.Event.Available
 import com.android.testutils.TestableNetworkCallback.Event.Lost
+import java.time.Duration
 import java.util.concurrent.atomic.AtomicInteger
 import kotlin.test.assertEquals
+import kotlin.test.assertNotNull
+import kotlin.test.assertTrue
 import kotlin.test.fail
 import org.mockito.ArgumentCaptor
 import org.mockito.ArgumentMatchers.any
@@ -87,9 +111,104 @@ class CSAgentWrapper(
     private var nmValidationResult = NO_PROBE_RESULT
     private var nmProbesCompleted = NO_PROBE_RESULT
     private var nmProbesSucceeded = NO_PROBE_RESULT
+    val history = ArrayTrackRecord<Event>().newReadHead()
+    val DEFAULT_TIMEOUT_MS = 5000L
 
     override val network: Network get() = agent.network!!
 
+    inner class TestAgent : NetworkAgent {
+        constructor(
+            context: Context,
+            looper: Looper,
+            tag: String,
+            nc: NetworkCapabilities,
+            lp: LinkProperties,
+            lnc: LocalNetworkConfig?,
+            score: NetworkScore,
+            nac: NetworkAgentConfig,
+            provider: NetworkProvider?
+        ) :
+                super(context, looper, tag, nc, lp, lnc, score, nac, provider) {
+        }
+
+        constructor(
+            context: Context,
+            looper: Looper,
+            tag: String,
+            nc: NetworkCapabilities,
+            lp: LinkProperties,
+            score: Int,
+            nac: NetworkAgentConfig,
+            provider: NetworkProvider?
+        ) :
+                super(context, looper, tag, nc, lp, score, nac, provider) {
+        }
+
+        override fun onBandwidthUpdateRequested() {
+            history.add(OnBandwidthUpdateRequested)
+        }
+
+        override fun onNetworkUnwanted() {
+            history.add(OnNetworkUnwanted)
+        }
+
+        override fun onAddKeepalivePacketFilter(slot: Int, packet: KeepalivePacketData) {
+            history.add(OnAddKeepalivePacketFilter(slot, packet))
+        }
+
+        override fun onRemoveKeepalivePacketFilter(slot: Int) {
+            history.add(OnRemoveKeepalivePacketFilter(slot))
+        }
+
+        override fun onStartSocketKeepalive(
+            slot: Int,
+            interval: Duration,
+            packet: KeepalivePacketData
+        ) {
+            history.add(OnStartSocketKeepalive(slot, interval.seconds.toInt(), packet))
+        }
+
+        override fun onStopSocketKeepalive(slot: Int) {
+            history.add(OnStopSocketKeepalive(slot))
+        }
+
+        override fun onSaveAcceptUnvalidated(accept: Boolean) {
+            history.add(OnSaveAcceptUnvalidated(accept))
+        }
+
+        override fun onAutomaticReconnectDisabled() {
+            history.add(OnAutomaticReconnectDisabled)
+        }
+
+        override fun onSignalStrengthThresholdsUpdated(thresholds: IntArray) {
+            history.add(OnSignalStrengthThresholdsUpdated(thresholds))
+        }
+
+        override fun onQosCallbackRegistered(qosCallbackId: Int, filter: QosFilter) {
+            history.add(OnRegisterQosCallback(qosCallbackId, filter))
+        }
+
+        override fun onQosCallbackUnregistered(qosCallbackId: Int) {
+            history.add(OnUnregisterQosCallback(qosCallbackId))
+        }
+
+        override fun onValidationStatus(status: Int, uri: Uri?) {
+            history.add(OnValidationStatus(status, uri))
+        }
+
+        override fun onNetworkCreated() {
+            history.add(OnNetworkCreated)
+        }
+
+        override fun onNetworkDestroyed() {
+            history.add(OnNetworkDestroyed)
+        }
+
+        override fun onDscpPolicyStatusUpdated(policyId: Int, status: Int) {
+            history.add(OnDscpPolicyStatusUpdated(policyId, status))
+        }
+    }
+
     init {
         // Capture network monitor callbacks and simulate network monitor
         val validateAnswer = Answer {
@@ -108,12 +227,13 @@ class CSAgentWrapper(
         )
 
         // Create the actual agent. NetworkAgent is abstract, so make an anonymous subclass.
-        if (deps.isAtLeastS()) {
-            agent = object : NetworkAgent(context, csHandlerThread.looper, TAG,
-                    nc, lp, lnc?.value, score.value, nac, provider) {}
+        agent = if (deps.isAtLeastS()) {
+            TestAgent(
+                context, csHandlerThread.looper, TAG, nc, lp, lnc?.value,
+                score.value, nac, provider)
         } else {
-            agent = object : NetworkAgent(context, csHandlerThread.looper, TAG,
-                    nc, lp, 50 /* score */, nac, provider) {}
+            TestAgent(
+                context, csHandlerThread.looper, TAG, nc, lp, 50 /* score */, nac, provider)
         }
         agent.register()
         assertEquals(agent.network!!.netId, nmNetworkCaptor.value.netId)
@@ -225,4 +345,16 @@ class CSAgentWrapper(
             probesSucceeded = NO_PROBE_RESULT
         )
     }
+
+    inline fun <reified T : Event> expect(test: (T) -> Boolean = { true }): T {
+        val foundCallback = history.poll(DEFAULT_TIMEOUT_MS)
+        assertTrue(foundCallback is T, "Expected ${T::class} but found $foundCallback")
+        assertTrue(test(foundCallback), "Unexpected callback : $foundCallback")
+        return foundCallback
+    }
+
+    inline fun <reified T : Event> eventuallyExpect() =
+        history.poll(DEFAULT_TIMEOUT_MS) { it is T }.also {
+            assertNotNull(it, "Callback ${T::class} not received")
+        } as T
 }
diff --git a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
index 0a915df77c..0f3e70c00b 100644
--- a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
@@ -427,6 +427,8 @@ open class CSTest {
                 networkForNetId: SparseArray<NetworkAgentInfo>,
                 handler: Handler
         ): QuicConnectionCloser = quicConnectionCloser
+
+        override fun flagConnectivityServiceDestroySocket() = true
     }
 
     inner class PermDeps : PermissionMonitor.Dependencies() {

From 5e69785de320dc3d89d84ba345301d20255be1bf Mon Sep 17 00:00:00 2001
From: Jimi Chen <jimictw@google.com>
Date: Wed, 28 May 2025 03:57:55 +0000
Subject: [PATCH 306/377] Replace get_apf_counter from apf shell command
 instead of dumpsys

Flag: EXEMPT mainline
Bug: 419423721
Test: atest NetworkStaticLibHostPythonTests
Change-Id: I6f5f93acb13503ce23066b1541c0843f6d7951d2
---
 .../tests/unit/host/python/apf_utils_test.py  | 118 ++++++++++++------
 staticlibs/testutils/host/python/apf_utils.py |  81 +++++-------
 2 files changed, 113 insertions(+), 86 deletions(-)

diff --git a/staticlibs/tests/unit/host/python/apf_utils_test.py b/staticlibs/tests/unit/host/python/apf_utils_test.py
index 55fbe58c7a..b0a70ae40b 100644
--- a/staticlibs/tests/unit/host/python/apf_utils_test.py
+++ b/staticlibs/tests/unit/host/python/apf_utils_test.py
@@ -24,13 +24,14 @@ from net_tests_utils.host.python.apf_utils import (
     UnsupportedOperationException,
     get_apf_capabilities,
     get_apf_counter,
-    get_apf_counters_from_dumpsys,
+    get_apf_counters_from_cmd,
     get_ipv4_addresses,
     get_non_tentative_ipv6_addresses,
     get_exclude_all_host_ipv6_multicast_addresses,
     get_hardware_address,
     is_send_raw_packet_downstream_supported,
     is_packet_capture_supported,
+    is_apf_dump_counters_supported,
     start_capture_packets,
     stop_capture_packets,
     get_matched_packet_counts,
@@ -50,53 +51,24 @@ class TestApfUtils(base_test.BaseTestClass, parameterized.TestCase):
   def setup_test(self):
     self.mock_ad = MagicMock()  # Mock Android device object
 
-  @patch("net_tests_utils.host.python.adb_utils.get_dumpsys_for_service")
-  def test_get_apf_counters_from_dumpsys_success(
-      self, mock_get_dumpsys: MagicMock
-  ) -> None:
-    mock_get_dumpsys.return_value = """
-IpClient.wlan0
-  APF packet counters:
-    COUNTER_NAME1: 123
-    COUNTER_NAME2: 456
-"""
-    counters = get_apf_counters_from_dumpsys(self.mock_ad, "wlan0")
-    asserts.assert_equal(counters, {"COUNTER_NAME1": 123, "COUNTER_NAME2": 456})
-
-  @patch("net_tests_utils.host.python.adb_utils.get_dumpsys_for_service")
-  def test_get_apf_counters_from_dumpsys_exceptions(
-      self, mock_get_dumpsys: MagicMock
-  ) -> None:
-    test_cases = [
-        "",
-        "IpClient.wlan0\n",
-        "IpClient.wlan0\n APF packet counters:\n",
-        """
-IpClient.wlan1
-  APF packet counters:
-    COUNTER_NAME1: 123
-    COUNTER_NAME2: 456
-""",
-    ]
-
-    for dumpsys_output in test_cases:
-      mock_get_dumpsys.return_value = dumpsys_output
-      with asserts.assert_raises(PatternNotFoundException):
-        get_apf_counters_from_dumpsys(self.mock_ad, "wlan0")
-
-  @patch("net_tests_utils.host.python.apf_utils.get_apf_counters_from_dumpsys")
+  @patch("net_tests_utils.host.python.apf_utils.get_apf_counters_from_cmd")
   def test_get_apf_counter(self, mock_get_counters: MagicMock) -> None:
     iface = "wlan0"
     mock_get_counters.return_value = {
-        "COUNTER_NAME1": 123,
-        "COUNTER_NAME2": 456,
+        "COUNTER_NAME1": "123",
+        "COUNTER_NAME2": "456",
+        "COUNTER_NAME3": "[ERROR: impossible]",
     }
     asserts.assert_equal(
         get_apf_counter(self.mock_ad, iface, "COUNTER_NAME1"), 123
     )
+    # Invalid counter value
+    asserts.assert_equal(
+        get_apf_counter(self.mock_ad, iface, "COUNTER_NAME3"), -1
+    )
     # Not found
     asserts.assert_equal(
-        get_apf_counter(self.mock_ad, iface, "COUNTER_NAME3"), 0
+        get_apf_counter(self.mock_ad, iface, "COUNTER_NAME4"), 0
     )
 
   @patch("net_tests_utils.host.python.adb_utils.adb_shell")
@@ -380,6 +352,74 @@ IpClient.wlan1
           "Get matched packet counts should not be supported.",
       )
 
+  @patch("net_tests_utils.host.python.adb_utils.adb_shell")
+  def test_get_apf_counters_from_cmd_success(
+          self, mock_adb_shell: MagicMock
+  ) -> None:
+      mock_adb_shell.return_value = """
+        NDIANNESS: 305419896
+        TOTAL_PACKETS: 157553
+        FILTER_AGE_SECONDS: 356
+        FILTER_AGE_16384THS: 5836719
+        APF_VERSION: 6000
+        APF_PROGRAM_ID: 25
+        PASSED_ARP_UNICAST_REPLY: 7
+        PASSED_IPV4: 14
+        PASSED_IPV4_UNICAST: 153472
+        PASSED_IPV6_ICMP: 1
+        PASSED_IPV6_NON_ICMP: 2764
+        PASSED_IPV6_UNICAST_NON_ICMP: 970
+        PASSED_RA: 6
+        DROPPED_RA: 2
+        DROPPED_IPV4_BROADCAST_ADDR: 48
+        DROPPED_IPV4_BROADCAST_NET: 63
+        DROPPED_IPV4_MULTICAST: 30
+        DROPPED_IPV6_NS_OTHER_HOST: 6
+        DROPPED_IPV6_NS_REPLIED_NON_DAD: 9
+        DROPPED_ETHERTYPE_NOT_ALLOWED: 58
+        DROPPED_ARP_OTHER_HOST: 89
+        DROPPED_ARP_REQUEST_REPLIED: 13
+      """
+      get_apf_counters_from_cmd(
+          self.mock_ad, TEST_IFACE_NAME
+      )
+      mock_adb_shell.assert_called_once_with(
+          self.mock_ad,
+          f"cmd network_stack apf {TEST_IFACE_NAME} dump-counters"
+      )
+
+  @patch("net_tests_utils.host.python.adb_utils.adb_shell")
+  def test_get_apf_counters_from_cmd_failure(
+          self, mock_adb_shell: MagicMock
+  ) -> None:
+      mock_adb_shell.return_value = (  # Unexpected command output
+          "Any Unexpected Output"
+      )
+      with asserts.assert_raises(UnexpectedBehaviorError):
+          get_apf_counters_from_cmd(
+              self.mock_ad, TEST_IFACE_NAME
+          )
+      asserts.assert_true(
+          is_packet_capture_supported(self.mock_ad),
+          "Dump APF packet counters should be supported.",
+      )
+
+  @patch("net_tests_utils.host.python.adb_utils.adb_shell")
+  def test_get_apf_counters_from_cmd_unsupported(
+          self, mock_adb_shell: MagicMock
+  ) -> None:
+      mock_adb_shell.side_effect = AdbError(
+          cmd="", stdout="Unknown command", stderr="", ret_code=3
+      )
+      with asserts.assert_raises(UnsupportedOperationException):
+          get_apf_counters_from_cmd(
+              self.mock_ad, TEST_IFACE_NAME
+          )
+      asserts.assert_false(
+          is_apf_dump_counters_supported(self.mock_ad),
+          "Dump APF packet counters should not be supported.",
+      )
+
   @parameterized.parameters(
       ("2,2048,1", ApfCapabilities(2, 2048, 1)),  # Valid input
       ("3,1024,0", ApfCapabilities(3, 1024, 0)),  # Valid input
diff --git a/staticlibs/testutils/host/python/apf_utils.py b/staticlibs/testutils/host/python/apf_utils.py
index 4835c23c56..1f91a5e715 100644
--- a/staticlibs/testutils/host/python/apf_utils.py
+++ b/staticlibs/testutils/host/python/apf_utils.py
@@ -32,57 +32,28 @@ class UnsupportedOperationException(Exception):
 def get_apf_counter(
     ad: android_device.AndroidDevice, iface: str, counter_name: str
 ) -> int:
-  counters = get_apf_counters_from_dumpsys(ad, iface)
-  return counters.get(counter_name, 0)
+  counters = get_apf_counters_from_cmd(ad, iface)
+  try:
+    return int(counters.get(counter_name, 0))
+  except ValueError:
+    return -1
 
-
-def get_apf_counters_from_dumpsys(
+def get_apf_counters_from_cmd(
     ad: android_device.AndroidDevice, iface_name: str
 ) -> dict:
-  dumpsys = adb_utils.get_dumpsys_for_service(ad, "network_stack")
+  cmd = f'cmd network_stack apf {iface_name} dump-counters'
+  output = AdbOutputHandler(ad, cmd).get_output()
+  data_dict = {}
+  for line in output.strip().split('\n'):
+    if line: # Ensure the line is not empty
+      # split only at the first colon
+      parts = line.split(':', 1)
+      if len(parts) == 2:
+        data_dict[parts[0]] = parts[1]
+      else:
+        raise assert_utils.UnexpectedBehaviorError(f"Got unexpected output: {output}.")
 
-  # Extract IpClient section of the specified interface.
-  # This takes inputs like:
-  # IpClient.wlan0
-  #   ...
-  # IpClient.wlan1
-  #   ...
-  iface_pattern = re.compile(
-      r"^IpClient\." + iface_name + r"\n" + r"((^\s.*\n)+)", re.MULTILINE
-  )
-  iface_result = iface_pattern.search(dumpsys)
-  if iface_result is None:
-    raise PatternNotFoundException("Cannot find IpClient for " + iface_name)
-
-  # Extract APF counters section from IpClient section, which looks like:
-  #     APF packet counters:
-  #       COUNTER_NAME: VALUE
-  #       ....
-  apf_pattern = re.compile(
-      r"APF packet counters:.*\n.(\s+[A-Z_0-9]+: \d+\n)+", re.MULTILINE
-  )
-  apf_result = apf_pattern.search(iface_result.group(0))
-  if apf_result is None:
-    raise PatternNotFoundException(
-        "Cannot find APF counters in text: " + iface_result.group(0)
-    )
-
-  # Extract key-value pairs from APF counters section into a list of tuples,
-  # e.g. [('COUNTER1', '1'), ('COUNTER2', '2')].
-  counter_pattern = re.compile(r"(?P<name>[A-Z_0-9]+): (?P<value>\d+)")
-  counter_result = counter_pattern.findall(apf_result.group(0))
-  if counter_result is None:
-    raise PatternNotFoundException(
-        "Cannot extract APF counters in text: " + apf_result.group(0)
-    )
-
-  # Convert into a dict.
-  result = {}
-  for key, value_str in counter_result:
-    result[key] = int(value_str)
-
-  ad.log.debug("Getting apf counters: " + str(result))
-  return result
+  return data_dict
 
 def get_ipv4_addresses(
     ad: android_device.AndroidDevice, iface_name: str
@@ -240,6 +211,22 @@ def is_packet_capture_supported(
   # If no UnsupportOperationException is thrown, regard it as supported
   return True
 
+def is_apf_dump_counters_supported(
+    ad: android_device.AndroidDevice
+) -> bool:
+  try:
+    # Invoke the shell command with empty argument and see how NetworkStack respond.
+    # If supported, an IllegalArgumentException with help page will be printed.
+    assert_utils.expect_throws(
+      lambda: get_apf_counters_from_cmd(ad, ""),
+      assert_utils.UnexpectedBehaviorError
+    )
+  except assert_utils.UnexpectedExceptionError:
+    return False
+
+  # If no UnsupportOperationException is thrown, regard it as supported
+  return True
+
 def is_send_raw_packet_downstream_supported(
     ad: android_device.AndroidDevice,
 ) -> bool:

From 572575ee953f477caa5ad2fe59832aa0738871ef Mon Sep 17 00:00:00 2001
From: Junyu Lai <junyulai@google.com>
Date: Fri, 23 May 2025 23:56:01 +0800
Subject: [PATCH 307/377] Support checking transport types in NetworkTemplate

This change verifies that:
 1. For a given match rule, if transports are specified, a deduced
    transport type should be included. For example, if MATCH_WIFI
    is specified, TRANSPORT_WIFI should be included if at least one
    transport is specified.

Flag: EXEMPT implemented in the counter-part CL
Test: atest ConnectivityCoverageTests --test-filter \
  'NetworkTemplate*' --update-device
Bug: 419123367
Change-Id: Ic8375e50c3587ef2b757d1c3241f97482d93808b
---
 .../src/android/net/NetworkTemplate.java      | 61 ++++++++++++++++
 .../net/netstats/NetworkTemplateTest.kt       | 70 +++++++++++++++++++
 2 files changed, 131 insertions(+)

diff --git a/framework-t/src/android/net/NetworkTemplate.java b/framework-t/src/android/net/NetworkTemplate.java
index af588047f7..8f62b4d151 100644
--- a/framework-t/src/android/net/NetworkTemplate.java
+++ b/framework-t/src/android/net/NetworkTemplate.java
@@ -24,6 +24,12 @@ import static android.net.ConnectivityManager.TYPE_PROXY;
 import static android.net.ConnectivityManager.TYPE_WIFI;
 import static android.net.ConnectivityManager.TYPE_WIFI_P2P;
 import static android.net.ConnectivityManager.TYPE_WIMAX;
+import static android.net.NetworkCapabilities.TRANSPORT_BLUETOOTH;
+import static android.net.NetworkCapabilities.TRANSPORT_CELLULAR;
+import static android.net.NetworkCapabilities.TRANSPORT_ETHERNET;
+import static android.net.NetworkCapabilities.TRANSPORT_SATELLITE;
+import static android.net.NetworkCapabilities.TRANSPORT_TEST;
+import static android.net.NetworkCapabilities.TRANSPORT_WIFI;
 import static android.net.NetworkIdentity.OEM_NONE;
 import static android.net.NetworkIdentity.OEM_PAID;
 import static android.net.NetworkIdentity.OEM_PRIVATE;
@@ -37,6 +43,7 @@ import static android.net.NetworkStats.ROAMING_ALL;
 import static android.net.NetworkStats.ROAMING_NO;
 import static android.net.NetworkStats.ROAMING_YES;
 
+import static com.android.net.module.util.CollectionUtils.toIntArray;
 import static com.android.net.module.util.NetworkCapabilitiesUtils.TYPE_TEST;
 
 import android.annotation.IntDef;
@@ -1237,6 +1244,7 @@ public final class NetworkTemplate implements Parcelable {
 
         private void assertRequestableParameters() {
             validateWifiNetworkKeys();
+            validateTransportTypes();
             // TODO: Check all the input are legitimate.
         }
 
@@ -1249,6 +1257,59 @@ public final class NetworkTemplate implements Parcelable {
             }
         }
 
+        // Validates if transport types are specified (i.e., mTransportTypesBits is not 0),
+        // they must be consistent with the template's mMatchRule. This means
+        // the specified transports must include at least one type that is
+        // deducible or expected for that matchRule.
+        // For example, if mMatchRule is MATCH_WIFI and transports are specified,
+        // TRANSPORT_WIFI must be among them.
+        private void validateTransportTypes() {
+            assertDeducedTransportTypes(mMatchRule, mTransportTypesBits);
+        }
+
+        /**
+         * Determines possible transport types for a match rule.
+         * @return Set of TRANSPORT_* constants.
+         * @throws IllegalArgumentException for unknown matchRule.
+         */
+        private static Set<Integer> getPossibleTransportsForMatchRule(int matchRule) {
+            return switch (matchRule) {
+                case MATCH_MOBILE -> Set.of(TRANSPORT_CELLULAR, TRANSPORT_SATELLITE);
+                case MATCH_WIFI -> Set.of(TRANSPORT_WIFI);
+                case MATCH_ETHERNET -> Set.of(TRANSPORT_ETHERNET);
+                // See NetworkCapabilitiesUtils#deduceTransportTypeForLegacyIdentity.
+                case MATCH_PROXY, MATCH_BLUETOOTH -> Set.of(TRANSPORT_BLUETOOTH);
+                // Carrier networks are identified by subscriberId and can be either cellular
+                // or carrier-provided Wi-Fi.
+                case MATCH_CARRIER -> Set.of(TRANSPORT_CELLULAR, TRANSPORT_WIFI);
+                case MATCH_TEST -> Set.of(TRANSPORT_TEST);
+                default -> throw new IllegalArgumentException(
+                        "Unexpected match rule: " + matchRule);
+            };
+        }
+
+        /**
+         * Asserts template's transport types are consistent with its match rule.
+         * Called during NetworkTemplate construction.
+         *
+         * @param matchRule The NetworkTemplate match rule.
+         * @param transportTypesBits Bitmask of transport types. No-op if 0.
+         * @throws IllegalArgumentException if transports are inconsistent with the rule.
+         */
+        private static void assertDeducedTransportTypes(int matchRule, long transportTypesBits) {
+            // No transports specified, nothing to check.
+            if (transportTypesBits == 0L) return;
+
+            Set<Integer> possibleTransportsSet = getPossibleTransportsForMatchRule(matchRule);
+            final long possibleTransportBitsForMatchRule =
+                    BitUtils.packBits(toIntArray(possibleTransportsSet));
+
+            // Template transports must overlap with possible transports for the rule.
+            if ((transportTypesBits & possibleTransportBitsForMatchRule) == 0L) {
+                throw new IllegalArgumentException("No deduced transport type: " + matchRule);
+            }
+        }
+
         /**
          * Builds the instance of the NetworkTemplate.
          *
diff --git a/tests/common/java/android/net/netstats/NetworkTemplateTest.kt b/tests/common/java/android/net/netstats/NetworkTemplateTest.kt
index 7aedf95faf..90109d1430 100644
--- a/tests/common/java/android/net/netstats/NetworkTemplateTest.kt
+++ b/tests/common/java/android/net/netstats/NetworkTemplateTest.kt
@@ -20,6 +20,8 @@ import android.net.NetworkCapabilities.TRANSPORT_BLUETOOTH
 import android.net.NetworkCapabilities.TRANSPORT_CELLULAR
 import android.net.NetworkCapabilities.TRANSPORT_ETHERNET
 import android.net.NetworkCapabilities.TRANSPORT_SATELLITE
+import android.net.NetworkCapabilities.TRANSPORT_TEST
+import android.net.NetworkCapabilities.TRANSPORT_VPN
 import android.net.NetworkCapabilities.TRANSPORT_WIFI
 import android.net.NetworkStats.DEFAULT_NETWORK_ALL
 import android.net.NetworkStats.METERED_ALL
@@ -32,6 +34,7 @@ import android.net.NetworkTemplate.MATCH_CARRIER
 import android.net.NetworkTemplate.MATCH_ETHERNET
 import android.net.NetworkTemplate.MATCH_MOBILE
 import android.net.NetworkTemplate.MATCH_PROXY
+import android.net.NetworkTemplate.MATCH_TEST
 import android.net.NetworkTemplate.MATCH_WIFI
 import android.net.NetworkTemplate.NETWORK_TYPE_ALL
 import android.net.NetworkTemplate.OEM_MANAGED_ALL
@@ -50,6 +53,7 @@ import org.junit.runners.JUnit4
 private const val TEST_IMSI1 = "imsi"
 private const val TEST_WIFI_KEY1 = "wifiKey1"
 private const val TEST_WIFI_KEY2 = "wifiKey2"
+private const val INVALID_TRANSPORT = 100
 
 @RunWith(JUnit4::class)
 @ConnectivityModuleTest
@@ -306,6 +310,7 @@ class NetworkTemplateTest {
         assertGetSetTransportTypes(MATCH_PROXY, TRANSPORT_BLUETOOTH)
         assertGetSetTransportTypes(MATCH_CARRIER, TRANSPORT_CELLULAR)
         assertGetSetTransportTypes(MATCH_CARRIER, TRANSPORT_WIFI)
+        assertGetSetTransportTypes(MATCH_TEST, TRANSPORT_TEST)
     }
 
     private fun assertGetSetTransportTypes(matchRule: Int, transport: Int) {
@@ -318,4 +323,69 @@ class NetworkTemplateTest {
         assertEquals(1, template.transportTypes.size)
         assertEquals(transport, template.transportTypes[0])
     }
+
+    @Test
+    fun testValidateTransportTypesNoTransportsSetSuccess() {
+        // Should succeed for any match rule if no transports are explicitly set.
+        listOf(
+                MATCH_WIFI,
+                MATCH_MOBILE,
+                MATCH_ETHERNET,
+                MATCH_BLUETOOTH,
+                MATCH_PROXY,
+                MATCH_TEST
+        ).forEach { matchRule ->
+            NetworkTemplate.Builder(matchRule)
+                    .setTransportTypes(intArrayOf()) // Explicitly empty, or just don't call it
+                    .build() // Should not throw
+        }
+        NetworkTemplate.Builder(MATCH_CARRIER)
+                .setSubscriberIds(setOf(TEST_IMSI1))
+                .setTransportTypes(intArrayOf())
+                .build() // Should not throw
+    }
+
+    @Test
+    fun testValidateTransportTypesDeducedTransportPlusCompatibleSuccess() {
+        NetworkTemplate.Builder(MATCH_WIFI)
+                .setTransportTypes(intArrayOf(TRANSPORT_WIFI, TRANSPORT_VPN))
+                .build()
+        NetworkTemplate.Builder(MATCH_MOBILE)
+                .setTransportTypes(intArrayOf(TRANSPORT_CELLULAR, TRANSPORT_TEST))
+                .build()
+    }
+
+    @Test
+    fun testValidateTransportTypesDeducedTransportMissingThrows() {
+        assertFailsWith<IllegalArgumentException> {
+            NetworkTemplate.Builder(MATCH_WIFI)
+                    .setTransportTypes(intArrayOf(TRANSPORT_CELLULAR))
+                    .build()
+        }
+        assertFailsWith<IllegalArgumentException> {
+            NetworkTemplate.Builder(MATCH_MOBILE)
+                    .setTransportTypes(intArrayOf(TRANSPORT_WIFI))
+                    .build()
+        }
+        assertFailsWith<IllegalArgumentException> {
+            NetworkTemplate.Builder(MATCH_ETHERNET)
+                    .setTransportTypes(intArrayOf(TRANSPORT_WIFI))
+                    .build()
+        }
+        assertFailsWith<IllegalArgumentException> {
+            NetworkTemplate.Builder(MATCH_CARRIER)
+                    .setTransportTypes(intArrayOf(TRANSPORT_SATELLITE))
+                    .build()
+        }
+        assertFailsWith<IllegalArgumentException> {
+            NetworkTemplate.Builder(MATCH_TEST)
+                    .setTransportTypes(intArrayOf(TRANSPORT_SATELLITE))
+                    .build()
+        }
+        assertFailsWith<IllegalArgumentException> {
+            NetworkTemplate.Builder(MATCH_TEST)
+                    .setTransportTypes(intArrayOf(INVALID_TRANSPORT))
+                    .build()
+        }
+    }
 }

From dcbe9b403d64bd3d27fd2cfdb4f2bf76d7536b2c Mon Sep 17 00:00:00 2001
From: Jimi Chen <jimictw@google.com>
Date: Wed, 28 May 2025 09:33:18 +0000
Subject: [PATCH 308/377] Refactor: apply pyformat for coding style consistency

add pyformat for presubmit hook

Flag: EXEMPT mainline
Bug: 419423721
Test: atest CtsConnectivityMultiDevicesTestCases
Change-Id: I9abc5cee454e8c8e21ce7e3c134145857680251f
---
 PREUPLOAD.cfg                                 |   2 +
 preupload_hook_script.py                      |  93 ++++
 .../tests/unit/host/python/apf_utils_test.py  | 420 ++++++++----------
 .../testutils/host/python/apf_test_base.py    |  57 +--
 staticlibs/testutils/host/python/apf_utils.py | 158 ++++---
 .../testutils/host/python/assert_utils.py     |  15 +-
 tests/cts/multidevices/apfv4_test.py          |  27 +-
 tests/cts/multidevices/apfv6_test.py          | 372 ++++++++--------
 tests/cts/multidevices/run_tests.py           |  10 +-
 9 files changed, 638 insertions(+), 516 deletions(-)
 create mode 100755 preupload_hook_script.py

diff --git a/PREUPLOAD.cfg b/PREUPLOAD.cfg
index cbe321c5f9..97a78cf4be 100644
--- a/PREUPLOAD.cfg
+++ b/PREUPLOAD.cfg
@@ -13,3 +13,5 @@ checkstyle_hook = ${REPO_ROOT}/prebuilts/checkstyle/checkstyle.py --sha ${PREUPL
 ktlint_hook = ${REPO_ROOT}/prebuilts/ktlint/ktlint.py --disabled-rules comment-wrapping -f ${PREUPLOAD_FILES}
 
 hidden_api_txt_checksorted_hook = ${REPO_ROOT}/tools/platform-compat/hiddenapi/checksorted_sha.sh ${PREUPLOAD_COMMIT} ${REPO_ROOT}
+
+python_hook = ${REPO_ROOT}/packages/modules/Connectivity/preupload_hook_script.py ${PREUPLOAD_FILES}
diff --git a/preupload_hook_script.py b/preupload_hook_script.py
new file mode 100755
index 0000000000..e2a6401080
--- /dev/null
+++ b/preupload_hook_script.py
@@ -0,0 +1,93 @@
+#!/usr/bin/env python3
+# Copyright 2025, The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Preupload hook to perform necessary checks and formatting on python files."""
+
+import argparse
+import concurrent.futures
+import multiprocessing
+import pathlib
+import shlex
+import subprocess
+import sys
+
+
+def _filter_python_files(files: list[pathlib.Path]) -> list[pathlib.Path]:
+  """Filter a list of files and return a new list of python files only."""
+  return [file for file in files if file.suffix == '.py']
+
+
+def _check_run_shell_command(cmd: str, cwd: str = None) -> None:
+  """Run a shell command and raise error if failed."""
+  if subprocess.run(shlex.split(cmd), cwd=cwd, check=False).returncode:
+    print('Preupload files did not pass Connectivity preupload hook script.')
+    sys.exit(1)
+
+
+def _run_pyformat(files: list[pathlib.Path]) -> None:
+  """Run pyformat on certain projects."""
+  if subprocess.run(
+      shlex.split('which pyformat'),
+      check=False,
+  ).returncode:
+    print('pyformat not available. Please run sudo apt install pyformat.')
+    sys.exit(1)
+
+  def _run_pyformat_on_file(file):
+    completed_process = subprocess.run(
+        shlex.split('pyformat --force_quote_type single ' + file.as_posix()),
+        capture_output=True,
+        check=False,
+    )
+
+    if completed_process.stdout:
+      subprocess.run(
+          shlex.split(
+              'pyformat -i --force_quote_type single ' + file.as_posix()
+          ),
+          check=False,
+      )
+      return True
+    return False
+
+  cpu_count = multiprocessing.cpu_count()
+  with concurrent.futures.ThreadPoolExecutor(max_workers=cpu_count) as executor:
+    need_reformat = executor.map(
+        _run_pyformat_on_file, _filter_python_files(files)
+    )
+
+  if any(need_reformat):
+    print(
+        'Reformatting completed. Please add the modified files to git and rerun'
+        ' the repo preupload hook.'
+    )
+    sys.exit(1)
+
+
+def get_preupload_files() -> list[pathlib.Path]:
+  """Get the list of files to be uploaded."""
+  parser = argparse.ArgumentParser()
+  parser.add_argument('preupload_files', nargs='*', help='Files to upload.')
+  args = parser.parse_args()
+  files_to_upload = args.preupload_files
+  file_paths_to_upload = [
+      pathlib.Path(file).resolve() for file in files_to_upload
+  ]
+  return [file for file in file_paths_to_upload if file.exists()]
+
+
+if __name__ == '__main__':
+  preupload_files = get_preupload_files()
+  _run_pyformat(preupload_files)
diff --git a/staticlibs/tests/unit/host/python/apf_utils_test.py b/staticlibs/tests/unit/host/python/apf_utils_test.py
index b0a70ae40b..6bf7a962a5 100644
--- a/staticlibs/tests/unit/host/python/apf_utils_test.py
+++ b/staticlibs/tests/unit/host/python/apf_utils_test.py
@@ -25,22 +25,22 @@ from net_tests_utils.host.python.apf_utils import (
     get_apf_capabilities,
     get_apf_counter,
     get_apf_counters_from_cmd,
-    get_ipv4_addresses,
-    get_non_tentative_ipv6_addresses,
     get_exclude_all_host_ipv6_multicast_addresses,
     get_hardware_address,
-    is_send_raw_packet_downstream_supported,
-    is_packet_capture_supported,
+    get_ipv4_addresses,
+    get_matched_packet_counts,
+    get_non_tentative_ipv6_addresses,
     is_apf_dump_counters_supported,
+    is_packet_capture_supported,
+    is_send_raw_packet_downstream_supported,
+    send_raw_packet_downstream,
     start_capture_packets,
     stop_capture_packets,
-    get_matched_packet_counts,
-    send_raw_packet_downstream,
 )
 from net_tests_utils.host.python.assert_utils import UnexpectedBehaviorError
 
-TEST_IFACE_NAME = "eth0"
-TEST_PACKET_IN_HEX = "AABBCCDDEEFF"
+TEST_IFACE_NAME = 'eth0'
+TEST_PACKET_IN_HEX = 'AABBCCDDEEFF'
 
 
 class TestApfUtils(base_test.BaseTestClass, parameterized.TestCase):
@@ -51,27 +51,27 @@ class TestApfUtils(base_test.BaseTestClass, parameterized.TestCase):
   def setup_test(self):
     self.mock_ad = MagicMock()  # Mock Android device object
 
-  @patch("net_tests_utils.host.python.apf_utils.get_apf_counters_from_cmd")
+  @patch('net_tests_utils.host.python.apf_utils.get_apf_counters_from_cmd')
   def test_get_apf_counter(self, mock_get_counters: MagicMock) -> None:
-    iface = "wlan0"
+    iface = 'wlan0'
     mock_get_counters.return_value = {
-        "COUNTER_NAME1": "123",
-        "COUNTER_NAME2": "456",
-        "COUNTER_NAME3": "[ERROR: impossible]",
+        'COUNTER_NAME1': '123',
+        'COUNTER_NAME2': '456',
+        'COUNTER_NAME3': '[ERROR: impossible]',
     }
     asserts.assert_equal(
-        get_apf_counter(self.mock_ad, iface, "COUNTER_NAME1"), 123
+        get_apf_counter(self.mock_ad, iface, 'COUNTER_NAME1'), 123
     )
     # Invalid counter value
     asserts.assert_equal(
-        get_apf_counter(self.mock_ad, iface, "COUNTER_NAME3"), -1
+        get_apf_counter(self.mock_ad, iface, 'COUNTER_NAME3'), -1
     )
     # Not found
     asserts.assert_equal(
-        get_apf_counter(self.mock_ad, iface, "COUNTER_NAME4"), 0
+        get_apf_counter(self.mock_ad, iface, 'COUNTER_NAME4'), 0
     )
 
-  @patch("net_tests_utils.host.python.adb_utils.adb_shell")
+  @patch('net_tests_utils.host.python.adb_utils.adb_shell')
   def test_get_hardware_address_success(
       self, mock_adb_shell: MagicMock
   ) -> None:
@@ -83,21 +83,19 @@ class TestApfUtils(base_test.BaseTestClass, parameterized.TestCase):
 47: wlan1: <BROADCAST,MULTICAST> mtu 1500 qdisc ...
  link/ether 6a:16:81:ff:82:9b brd ff:ff:ff:ff:ff:ff
 """
-    mac_address = get_hardware_address(self.mock_ad, "wlan0")
-    asserts.assert_equal(mac_address, "72:05:77:82:21:E0")
+    mac_address = get_hardware_address(self.mock_ad, 'wlan0')
+    asserts.assert_equal(mac_address, '72:05:77:82:21:E0')
 
-  @patch("net_tests_utils.host.python.adb_utils.adb_shell")
+  @patch('net_tests_utils.host.python.adb_utils.adb_shell')
   def test_get_hardware_address_not_found(
       self, mock_adb_shell: MagicMock
   ) -> None:
-    mock_adb_shell.return_value = "Some output without MAC address"
+    mock_adb_shell.return_value = 'Some output without MAC address'
     with asserts.assert_raises(PatternNotFoundException):
-      get_hardware_address(self.mock_ad, "wlan0")
+      get_hardware_address(self.mock_ad, 'wlan0')
 
-  @patch("net_tests_utils.host.python.adb_utils.adb_shell")
-  def test_get_ipv4_addresses_success(
-      self, mock_adb_shell: MagicMock
-  ) -> None:
+  @patch('net_tests_utils.host.python.adb_utils.adb_shell')
+  def test_get_ipv4_addresses_success(self, mock_adb_shell: MagicMock) -> None:
     mock_adb_shell.return_value = """
 54: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
     inet 192.168.195.162/24 brd 192.168.195.255 scope global wlan0
@@ -105,18 +103,18 @@ class TestApfUtils(base_test.BaseTestClass, parameterized.TestCase):
     inet 192.168.200.1/24 brd 192.168.200.255 scope global wlan0
        valid_lft forever preferred_lft forever
 """
-    ip_addresses = get_ipv4_addresses(self.mock_ad, "wlan0")
-    asserts.assert_equal(ip_addresses, ["192.168.195.162", "192.168.200.1"])
+    ip_addresses = get_ipv4_addresses(self.mock_ad, 'wlan0')
+    asserts.assert_equal(ip_addresses, ['192.168.195.162', '192.168.200.1'])
 
-  @patch("net_tests_utils.host.python.adb_utils.adb_shell")
+  @patch('net_tests_utils.host.python.adb_utils.adb_shell')
   def test_get_ipv4_addresses_not_found(
       self, mock_adb_shell: MagicMock
   ) -> None:
-    mock_adb_shell.return_value = ""
-    ip_addresses = get_ipv4_addresses(self.mock_ad, "wlan0")
+    mock_adb_shell.return_value = ''
+    ip_addresses = get_ipv4_addresses(self.mock_ad, 'wlan0')
     asserts.assert_equal(ip_addresses, [])
 
-  @patch("net_tests_utils.host.python.adb_utils.adb_shell")
+  @patch('net_tests_utils.host.python.adb_utils.adb_shell')
   def test_get_non_tentative_ipv6_addresses_success(
       self, mock_adb_shell: MagicMock
   ) -> None:
@@ -129,22 +127,23 @@ class TestApfUtils(base_test.BaseTestClass, parameterized.TestCase):
     inet6 fe80::3aff:2199:2d8e:20d1/64 scope link noprefixroute
         valid_lft forever preferred_lft forever
 """
-    ip_addresses = get_non_tentative_ipv6_addresses(self.mock_ad, "wlan0")
-    asserts.assert_equal(ip_addresses,
-                         ["fe80::10a3:5dff:fe52:de32",
-                          "2001:b400:e53f:164e:9c1e:780e:d1:4658",
-                          "fe80::3aff:2199:2d8e:20d1"])
+    ip_addresses = get_non_tentative_ipv6_addresses(self.mock_ad, 'wlan0')
+    asserts.assert_equal(
+        ip_addresses,
+        [
+            'fe80::10a3:5dff:fe52:de32',
+            '2001:b400:e53f:164e:9c1e:780e:d1:4658',
+            'fe80::3aff:2199:2d8e:20d1',
+        ],
+    )
 
-  @patch("net_tests_utils.host.python.adb_utils.adb_shell")
-  def test_get_ipv6_address_not_found(
-          self, mock_adb_shell: MagicMock
-  ) -> None:
-    mock_adb_shell.return_value = ""
-    ip_addresses = get_non_tentative_ipv6_addresses(self.mock_ad, "wlan0")
+  @patch('net_tests_utils.host.python.adb_utils.adb_shell')
+  def test_get_ipv6_address_not_found(self, mock_adb_shell: MagicMock) -> None:
+    mock_adb_shell.return_value = ''
+    ip_addresses = get_non_tentative_ipv6_addresses(self.mock_ad, 'wlan0')
     asserts.assert_equal(ip_addresses, [])
 
-
-  @patch("net_tests_utils.host.python.adb_utils.adb_shell")
+  @patch('net_tests_utils.host.python.adb_utils.adb_shell')
   def test_get_exclude_all_host_ipv6_multicast_addresses_success(
       self, mock_adb_shell: MagicMock
   ) -> None:
@@ -155,39 +154,43 @@ class TestApfUtils(base_test.BaseTestClass, parameterized.TestCase):
         inet6 ff02::1
         inet6 ff01::1
 """
-    ip_addresses = get_exclude_all_host_ipv6_multicast_addresses(self.mock_ad, "wlan0")
-    asserts.assert_equal(ip_addresses,
-                         ["ff02::1:ff99:37b0",
-                          "ff02::1:ffb7:cba2"])
+    ip_addresses = get_exclude_all_host_ipv6_multicast_addresses(
+        self.mock_ad, 'wlan0'
+    )
+    asserts.assert_equal(
+        ip_addresses, ['ff02::1:ff99:37b0', 'ff02::1:ffb7:cba2']
+    )
 
-  @patch("net_tests_utils.host.python.adb_utils.adb_shell")
+  @patch('net_tests_utils.host.python.adb_utils.adb_shell')
   def test_get_exclude_all_host_ipv6_multicast_addresses_not_found(
-          self, mock_adb_shell: MagicMock
+      self, mock_adb_shell: MagicMock
   ) -> None:
-    mock_adb_shell.return_value = ""
-    ip_addresses = get_exclude_all_host_ipv6_multicast_addresses(self.mock_ad, "wlan0")
+    mock_adb_shell.return_value = ''
+    ip_addresses = get_exclude_all_host_ipv6_multicast_addresses(
+        self.mock_ad, 'wlan0'
+    )
     asserts.assert_equal(ip_addresses, [])
 
-  @patch("net_tests_utils.host.python.adb_utils.adb_shell")
+  @patch('net_tests_utils.host.python.adb_utils.adb_shell')
   def test_send_raw_packet_downstream_success(
       self, mock_adb_shell: MagicMock
   ) -> None:
-    mock_adb_shell.return_value = ""  # Successful command output
+    mock_adb_shell.return_value = ''  # Successful command output
     send_raw_packet_downstream(
         self.mock_ad, TEST_IFACE_NAME, TEST_PACKET_IN_HEX
     )
     mock_adb_shell.assert_called_once_with(
         self.mock_ad,
-        "cmd network_stack send-raw-packet-downstream"
-        f" {TEST_IFACE_NAME} {TEST_PACKET_IN_HEX}",
+        'cmd network_stack send-raw-packet-downstream'
+        f' {TEST_IFACE_NAME} {TEST_PACKET_IN_HEX}',
     )
 
-  @patch("net_tests_utils.host.python.adb_utils.adb_shell")
+  @patch('net_tests_utils.host.python.adb_utils.adb_shell')
   def test_send_raw_packet_downstream_failure(
       self, mock_adb_shell: MagicMock
   ) -> None:
     mock_adb_shell.return_value = (  # Unexpected command output
-        "Any Unexpected Output"
+        'Any Unexpected Output'
     )
     with asserts.assert_raises(UnexpectedBehaviorError):
       send_raw_packet_downstream(
@@ -195,15 +198,15 @@ class TestApfUtils(base_test.BaseTestClass, parameterized.TestCase):
       )
     asserts.assert_true(
         is_send_raw_packet_downstream_supported(self.mock_ad),
-        "Send raw packet should be supported.",
+        'Send raw packet should be supported.',
     )
 
-  @patch("net_tests_utils.host.python.adb_utils.adb_shell")
+  @patch('net_tests_utils.host.python.adb_utils.adb_shell')
   def test_send_raw_packet_downstream_unsupported(
       self, mock_adb_shell: MagicMock
   ) -> None:
     mock_adb_shell.side_effect = AdbError(
-        cmd="", stdout="Unknown command", stderr="", ret_code=3
+        cmd='', stdout='Unknown command', stderr='', ret_code=3
     )
     with asserts.assert_raises(UnsupportedOperationException):
       send_raw_packet_downstream(
@@ -211,152 +214,122 @@ class TestApfUtils(base_test.BaseTestClass, parameterized.TestCase):
       )
     asserts.assert_false(
         is_send_raw_packet_downstream_supported(self.mock_ad),
-        "Send raw packet should not be supported.",
+        'Send raw packet should not be supported.',
     )
 
-  @patch("net_tests_utils.host.python.adb_utils.adb_shell")
-  def test_start_capture_success(
-          self, mock_adb_shell: MagicMock
-  ) -> None:
-      mock_adb_shell.return_value = "success"  # Successful command output
-      start_capture_packets(
-          self.mock_ad, TEST_IFACE_NAME
-      )
-      mock_adb_shell.assert_called_once_with(
-          self.mock_ad,
-          "cmd network_stack capture start"
-          f" {TEST_IFACE_NAME}"
-      )
+  @patch('net_tests_utils.host.python.adb_utils.adb_shell')
+  def test_start_capture_success(self, mock_adb_shell: MagicMock) -> None:
+    mock_adb_shell.return_value = 'success'  # Successful command output
+    start_capture_packets(self.mock_ad, TEST_IFACE_NAME)
+    mock_adb_shell.assert_called_once_with(
+        self.mock_ad, f'cmd network_stack capture start {TEST_IFACE_NAME}'
+    )
 
-  @patch("net_tests_utils.host.python.adb_utils.adb_shell")
-  def test_start_capture_failure(
-          self, mock_adb_shell: MagicMock
-  ) -> None:
-      mock_adb_shell.return_value = (  # Unexpected command output
-          "Any Unexpected Output"
-      )
-      with asserts.assert_raises(UnexpectedBehaviorError):
-          start_capture_packets(
-              self.mock_ad, TEST_IFACE_NAME
-          )
-      asserts.assert_true(
-          is_packet_capture_supported(self.mock_ad),
-          "Start capturing packets should be supported.",
-      )
+  @patch('net_tests_utils.host.python.adb_utils.adb_shell')
+  def test_start_capture_failure(self, mock_adb_shell: MagicMock) -> None:
+    mock_adb_shell.return_value = (  # Unexpected command output
+        'Any Unexpected Output'
+    )
+    with asserts.assert_raises(UnexpectedBehaviorError):
+      start_capture_packets(self.mock_ad, TEST_IFACE_NAME)
+    asserts.assert_true(
+        is_packet_capture_supported(self.mock_ad),
+        'Start capturing packets should be supported.',
+    )
 
-  @patch("net_tests_utils.host.python.adb_utils.adb_shell")
-  def test_start_capture_unsupported(
-          self, mock_adb_shell: MagicMock
-  ) -> None:
-      mock_adb_shell.side_effect = AdbError(
-          cmd="", stdout="Unknown command", stderr="", ret_code=3
-      )
-      with asserts.assert_raises(UnsupportedOperationException):
-          start_capture_packets(
-              self.mock_ad, TEST_IFACE_NAME
-          )
-      asserts.assert_false(
-          is_packet_capture_supported(self.mock_ad),
-          "Start capturing packets should not be supported.",
-      )
+  @patch('net_tests_utils.host.python.adb_utils.adb_shell')
+  def test_start_capture_unsupported(self, mock_adb_shell: MagicMock) -> None:
+    mock_adb_shell.side_effect = AdbError(
+        cmd='', stdout='Unknown command', stderr='', ret_code=3
+    )
+    with asserts.assert_raises(UnsupportedOperationException):
+      start_capture_packets(self.mock_ad, TEST_IFACE_NAME)
+    asserts.assert_false(
+        is_packet_capture_supported(self.mock_ad),
+        'Start capturing packets should not be supported.',
+    )
 
-  @patch("net_tests_utils.host.python.adb_utils.adb_shell")
-  def test_stop_capture_success(
-          self, mock_adb_shell: MagicMock
-  ) -> None:
-      mock_adb_shell.return_value = "success"  # Successful command output
-      stop_capture_packets(
-          self.mock_ad, TEST_IFACE_NAME
-      )
-      mock_adb_shell.assert_called_once_with(
-          self.mock_ad,
-          "cmd network_stack capture stop"
-          f" {TEST_IFACE_NAME}"
-      )
+  @patch('net_tests_utils.host.python.adb_utils.adb_shell')
+  def test_stop_capture_success(self, mock_adb_shell: MagicMock) -> None:
+    mock_adb_shell.return_value = 'success'  # Successful command output
+    stop_capture_packets(self.mock_ad, TEST_IFACE_NAME)
+    mock_adb_shell.assert_called_once_with(
+        self.mock_ad, f'cmd network_stack capture stop {TEST_IFACE_NAME}'
+    )
 
-  @patch("net_tests_utils.host.python.adb_utils.adb_shell")
-  def test_stop_capture_failure(
-          self, mock_adb_shell: MagicMock
-  ) -> None:
-      mock_adb_shell.return_value = (  # Unexpected command output
-          "Any Unexpected Output"
-      )
-      with asserts.assert_raises(UnexpectedBehaviorError):
-          stop_capture_packets(
-              self.mock_ad, TEST_IFACE_NAME
-          )
-      asserts.assert_true(
-          is_packet_capture_supported(self.mock_ad),
-          "Stop capturing packets should be supported.",
-      )
+  @patch('net_tests_utils.host.python.adb_utils.adb_shell')
+  def test_stop_capture_failure(self, mock_adb_shell: MagicMock) -> None:
+    mock_adb_shell.return_value = (  # Unexpected command output
+        'Any Unexpected Output'
+    )
+    with asserts.assert_raises(UnexpectedBehaviorError):
+      stop_capture_packets(self.mock_ad, TEST_IFACE_NAME)
+    asserts.assert_true(
+        is_packet_capture_supported(self.mock_ad),
+        'Stop capturing packets should be supported.',
+    )
 
-  @patch("net_tests_utils.host.python.adb_utils.adb_shell")
-  def test_stop_capture_unsupported(
-          self, mock_adb_shell: MagicMock
-  ) -> None:
-      mock_adb_shell.side_effect = AdbError(
-          cmd="", stdout="Unknown command", stderr="", ret_code=3
-      )
-      with asserts.assert_raises(UnsupportedOperationException):
-          stop_capture_packets(
-              self.mock_ad, TEST_IFACE_NAME
-          )
-      asserts.assert_false(
-          is_packet_capture_supported(self.mock_ad),
-          "Stop capturing packets should not be supported.",
-      )
+  @patch('net_tests_utils.host.python.adb_utils.adb_shell')
+  def test_stop_capture_unsupported(self, mock_adb_shell: MagicMock) -> None:
+    mock_adb_shell.side_effect = AdbError(
+        cmd='', stdout='Unknown command', stderr='', ret_code=3
+    )
+    with asserts.assert_raises(UnsupportedOperationException):
+      stop_capture_packets(self.mock_ad, TEST_IFACE_NAME)
+    asserts.assert_false(
+        is_packet_capture_supported(self.mock_ad),
+        'Stop capturing packets should not be supported.',
+    )
 
-  @patch("net_tests_utils.host.python.adb_utils.adb_shell")
+  @patch('net_tests_utils.host.python.adb_utils.adb_shell')
   def test_get_matched_packet_counts_success(
-          self, mock_adb_shell: MagicMock
+      self, mock_adb_shell: MagicMock
   ) -> None:
-      mock_adb_shell.return_value = "10"  # Successful command output
+    mock_adb_shell.return_value = '10'  # Successful command output
+    get_matched_packet_counts(self.mock_ad, TEST_IFACE_NAME, TEST_PACKET_IN_HEX)
+    mock_adb_shell.assert_called_once_with(
+        self.mock_ad,
+        'cmd network_stack capture matched-packet-counts'
+        f' {TEST_IFACE_NAME} {TEST_PACKET_IN_HEX}',
+    )
+
+  @patch('net_tests_utils.host.python.adb_utils.adb_shell')
+  def test_get_matched_packet_counts_failure(
+      self, mock_adb_shell: MagicMock
+  ) -> None:
+    mock_adb_shell.return_value = (  # Unexpected command output
+        'Any Unexpected Output'
+    )
+    with asserts.assert_raises(UnexpectedBehaviorError):
       get_matched_packet_counts(
           self.mock_ad, TEST_IFACE_NAME, TEST_PACKET_IN_HEX
       )
-      mock_adb_shell.assert_called_once_with(
-          self.mock_ad,
-          "cmd network_stack capture matched-packet-counts"
-          f" {TEST_IFACE_NAME} {TEST_PACKET_IN_HEX}"
-      )
+    asserts.assert_true(
+        is_packet_capture_supported(self.mock_ad),
+        'Get matched packet counts should be supported.',
+    )
 
-  @patch("net_tests_utils.host.python.adb_utils.adb_shell")
-  def test_get_matched_packet_counts_failure(
-          self, mock_adb_shell: MagicMock
-  ) -> None:
-      mock_adb_shell.return_value = (  # Unexpected command output
-          "Any Unexpected Output"
-      )
-      with asserts.assert_raises(UnexpectedBehaviorError):
-          get_matched_packet_counts(
-              self.mock_ad, TEST_IFACE_NAME, TEST_PACKET_IN_HEX
-          )
-      asserts.assert_true(
-          is_packet_capture_supported(self.mock_ad),
-          "Get matched packet counts should be supported.",
-      )
-
-  @patch("net_tests_utils.host.python.adb_utils.adb_shell")
+  @patch('net_tests_utils.host.python.adb_utils.adb_shell')
   def test_get_matched_packet_counts_unsupported(
-          self, mock_adb_shell: MagicMock
+      self, mock_adb_shell: MagicMock
   ) -> None:
-      mock_adb_shell.side_effect = AdbError(
-          cmd="", stdout="Unknown command", stderr="", ret_code=3
-      )
-      with asserts.assert_raises(UnsupportedOperationException):
-          get_matched_packet_counts(
-              self.mock_ad, TEST_IFACE_NAME, TEST_PACKET_IN_HEX
-          )
-      asserts.assert_false(
-          is_packet_capture_supported(self.mock_ad),
-          "Get matched packet counts should not be supported.",
+    mock_adb_shell.side_effect = AdbError(
+        cmd='', stdout='Unknown command', stderr='', ret_code=3
+    )
+    with asserts.assert_raises(UnsupportedOperationException):
+      get_matched_packet_counts(
+          self.mock_ad, TEST_IFACE_NAME, TEST_PACKET_IN_HEX
       )
+    asserts.assert_false(
+        is_packet_capture_supported(self.mock_ad),
+        'Get matched packet counts should not be supported.',
+    )
 
-  @patch("net_tests_utils.host.python.adb_utils.adb_shell")
+  @patch('net_tests_utils.host.python.adb_utils.adb_shell')
   def test_get_apf_counters_from_cmd_success(
-          self, mock_adb_shell: MagicMock
+      self, mock_adb_shell: MagicMock
   ) -> None:
-      mock_adb_shell.return_value = """
+    mock_adb_shell.return_value = """
         NDIANNESS: 305419896
         TOTAL_PACKETS: 157553
         FILTER_AGE_SECONDS: 356
@@ -380,53 +353,46 @@ class TestApfUtils(base_test.BaseTestClass, parameterized.TestCase):
         DROPPED_ARP_OTHER_HOST: 89
         DROPPED_ARP_REQUEST_REPLIED: 13
       """
-      get_apf_counters_from_cmd(
-          self.mock_ad, TEST_IFACE_NAME
-      )
-      mock_adb_shell.assert_called_once_with(
-          self.mock_ad,
-          f"cmd network_stack apf {TEST_IFACE_NAME} dump-counters"
-      )
+    get_apf_counters_from_cmd(self.mock_ad, TEST_IFACE_NAME)
+    mock_adb_shell.assert_called_once_with(
+        self.mock_ad, f'cmd network_stack apf {TEST_IFACE_NAME} dump-counters'
+    )
 
-  @patch("net_tests_utils.host.python.adb_utils.adb_shell")
+  @patch('net_tests_utils.host.python.adb_utils.adb_shell')
   def test_get_apf_counters_from_cmd_failure(
-          self, mock_adb_shell: MagicMock
+      self, mock_adb_shell: MagicMock
   ) -> None:
-      mock_adb_shell.return_value = (  # Unexpected command output
-          "Any Unexpected Output"
-      )
-      with asserts.assert_raises(UnexpectedBehaviorError):
-          get_apf_counters_from_cmd(
-              self.mock_ad, TEST_IFACE_NAME
-          )
-      asserts.assert_true(
-          is_packet_capture_supported(self.mock_ad),
-          "Dump APF packet counters should be supported.",
-      )
+    mock_adb_shell.return_value = (  # Unexpected command output
+        'Any Unexpected Output'
+    )
+    with asserts.assert_raises(UnexpectedBehaviorError):
+      get_apf_counters_from_cmd(self.mock_ad, TEST_IFACE_NAME)
+    asserts.assert_true(
+        is_packet_capture_supported(self.mock_ad),
+        'Dump APF packet counters should be supported.',
+    )
 
-  @patch("net_tests_utils.host.python.adb_utils.adb_shell")
+  @patch('net_tests_utils.host.python.adb_utils.adb_shell')
   def test_get_apf_counters_from_cmd_unsupported(
-          self, mock_adb_shell: MagicMock
+      self, mock_adb_shell: MagicMock
   ) -> None:
-      mock_adb_shell.side_effect = AdbError(
-          cmd="", stdout="Unknown command", stderr="", ret_code=3
-      )
-      with asserts.assert_raises(UnsupportedOperationException):
-          get_apf_counters_from_cmd(
-              self.mock_ad, TEST_IFACE_NAME
-          )
-      asserts.assert_false(
-          is_apf_dump_counters_supported(self.mock_ad),
-          "Dump APF packet counters should not be supported.",
-      )
+    mock_adb_shell.side_effect = AdbError(
+        cmd='', stdout='Unknown command', stderr='', ret_code=3
+    )
+    with asserts.assert_raises(UnsupportedOperationException):
+      get_apf_counters_from_cmd(self.mock_ad, TEST_IFACE_NAME)
+    asserts.assert_false(
+        is_apf_dump_counters_supported(self.mock_ad),
+        'Dump APF packet counters should not be supported.',
+    )
 
   @parameterized.parameters(
-      ("2,2048,1", ApfCapabilities(2, 2048, 1)),  # Valid input
-      ("3,1024,0", ApfCapabilities(3, 1024, 0)),  # Valid input
-      ("invalid,output", ApfCapabilities(0, 0, 0)),  # Invalid input
-      ("", ApfCapabilities(0, 0, 0)),  # Empty input
+      ('2,2048,1', ApfCapabilities(2, 2048, 1)),  # Valid input
+      ('3,1024,0', ApfCapabilities(3, 1024, 0)),  # Valid input
+      ('invalid,output', ApfCapabilities(0, 0, 0)),  # Invalid input
+      ('', ApfCapabilities(0, 0, 0)),  # Empty input
   )
-  @patch("net_tests_utils.host.python.adb_utils.adb_shell")
+  @patch('net_tests_utils.host.python.adb_utils.adb_shell')
   def test_get_apf_capabilities(
       self, mock_output, expected_result, mock_adb_shell
   ):
@@ -435,7 +401,7 @@ class TestApfUtils(base_test.BaseTestClass, parameterized.TestCase):
     mock_adb_shell.return_value = mock_output
 
     # Call the function under test
-    result = get_apf_capabilities(self.mock_ad, "wlan0")
+    result = get_apf_capabilities(self.mock_ad, 'wlan0')
 
     # Assert that the result matches the expected result
     asserts.assert_equal(result, expected_result)
diff --git a/staticlibs/testutils/host/python/apf_test_base.py b/staticlibs/testutils/host/python/apf_test_base.py
index c9cda417a3..f77dd42603 100644
--- a/staticlibs/testutils/host/python/apf_test_base.py
+++ b/staticlibs/testutils/host/python/apf_test_base.py
@@ -12,10 +12,11 @@
 #  See the License for the specific language governing permissions and
 #  limitations under the License.
 
+import time
 from mobly import asserts
 from net_tests_utils.host.python import adb_utils, apf_utils, assert_utils, multi_devices_test_base, tether_utils
 from net_tests_utils.host.python.tether_utils import UpstreamType
-import time
+
 
 class ApfTestBase(multi_devices_test_base.MultiDevicesTestBase):
 
@@ -25,8 +26,8 @@ class ApfTestBase(multi_devices_test_base.MultiDevicesTestBase):
     # Check test preconditions.
     asserts.abort_class_if(
         not self.client.isAtLeastV(),
-        "Do not enforce the test until V+ since chipset potential bugs are"
-        " expected to be fixed on V+ releases.",
+        'Do not enforce the test until V+ since chipset potential bugs are'
+        ' expected to be fixed on V+ releases.',
     )
     tether_utils.assume_hotspot_test_preconditions(
         self.serverDevice, self.clientDevice, UpstreamType.NONE
@@ -35,7 +36,7 @@ class ApfTestBase(multi_devices_test_base.MultiDevicesTestBase):
         not apf_utils.is_send_raw_packet_downstream_supported(
             self.serverDevice
         ),
-        "NetworkStack is too old to support send raw packet, skip test.",
+        'NetworkStack is too old to support send raw packet, skip test.',
     )
 
     # Fetch device properties and storing them locally for later use.
@@ -104,35 +105,35 @@ class ApfTestBase(multi_devices_test_base.MultiDevicesTestBase):
       self, send_packet: str, counter_name: str, receive_packet: str
   ) -> None:
     try:
-        apf_utils.start_capture_packets(self.serverDevice, self.server_iface_name)
+      apf_utils.start_capture_packets(self.serverDevice, self.server_iface_name)
 
-        count_before_test = apf_utils.get_apf_counter(
-            self.clientDevice,
-            self.client_iface_name,
-            counter_name,
-        )
+      count_before_test = apf_utils.get_apf_counter(
+          self.clientDevice,
+          self.client_iface_name,
+          counter_name,
+      )
 
-        apf_utils.send_raw_packet_downstream(
-            self.serverDevice, self.server_iface_name, send_packet
-        )
+      apf_utils.send_raw_packet_downstream(
+          self.serverDevice, self.server_iface_name, send_packet
+      )
 
+      assert_utils.expect_with_retry(
+          lambda: apf_utils.get_matched_packet_counts(
+              self.serverDevice, self.server_iface_name, receive_packet
+          )
+          == 1
+      )
+
+      # TODO: re-enable once the test passes reliably.
+      if False:
         assert_utils.expect_with_retry(
-            lambda: apf_utils.get_matched_packet_counts(
-                self.serverDevice, self.server_iface_name, receive_packet
+            lambda: apf_utils.get_apf_counter(
+                self.clientDevice,
+                self.client_iface_name,
+                counter_name,
             )
-            == 1
+            > count_before_test
         )
 
-        # TODO: re-enable once the test passes reliably.
-        if False:
-            assert_utils.expect_with_retry(
-                lambda: apf_utils.get_apf_counter(
-                    self.clientDevice,
-                    self.client_iface_name,
-                    counter_name,
-                )
-                > count_before_test
-            )
-
     finally:
-        apf_utils.stop_capture_packets(self.serverDevice, self.server_iface_name)
+      apf_utils.stop_capture_packets(self.serverDevice, self.server_iface_name)
diff --git a/staticlibs/testutils/host/python/apf_utils.py b/staticlibs/testutils/host/python/apf_utils.py
index 1f91a5e715..3a1c8f5e3e 100644
--- a/staticlibs/testutils/host/python/apf_utils.py
+++ b/staticlibs/testutils/host/python/apf_utils.py
@@ -13,12 +13,12 @@
 #  limitations under the License.
 
 from dataclasses import dataclass
+import functools
 import re
 from mobly import asserts
 from mobly.controllers import android_device
 from mobly.controllers.android_device_lib.adb import AdbError
 from net_tests_utils.host.python import adb_utils, assert_utils
-import functools
 
 
 class PatternNotFoundException(Exception):
@@ -38,6 +38,7 @@ def get_apf_counter(
   except ValueError:
     return -1
 
+
 def get_apf_counters_from_cmd(
     ad: android_device.AndroidDevice, iface_name: str
 ) -> dict:
@@ -45,16 +46,19 @@ def get_apf_counters_from_cmd(
   output = AdbOutputHandler(ad, cmd).get_output()
   data_dict = {}
   for line in output.strip().split('\n'):
-    if line: # Ensure the line is not empty
+    if line:  # Ensure the line is not empty
       # split only at the first colon
       parts = line.split(':', 1)
       if len(parts) == 2:
         data_dict[parts[0]] = parts[1]
       else:
-        raise assert_utils.UnexpectedBehaviorError(f"Got unexpected output: {output}.")
+        raise assert_utils.UnexpectedBehaviorError(
+            f'Got unexpected output: {output}.'
+        )
 
   return data_dict
 
+
 def get_ipv4_addresses(
     ad: android_device.AndroidDevice, iface_name: str
 ) -> list[str]:
@@ -78,8 +82,8 @@ def get_ipv4_addresses(
   #         valid_lft forever preferred_lft forever
   #     inet 192.168.1.1/24 brd 192.168.1.255 scope global wlan2
   #         valid_lft forever preferred_lft forever
-  output = adb_utils.adb_shell(ad, f"ip -4 address show {iface_name}")
-  pattern = r"inet\s+(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\/\d+"
+  output = adb_utils.adb_shell(ad, f'ip -4 address show {iface_name}')
+  pattern = r'inet\s+(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\/\d+'
   matches = re.findall(pattern, output)
 
   if matches:
@@ -87,12 +91,14 @@ def get_ipv4_addresses(
   else:
     return []
 
+
 def get_non_tentative_ipv6_addresses(
     ad: android_device.AndroidDevice, iface_name: str
 ) -> list[str]:
   """Retrieves the non-tentative IPv6 addresses of a given interface on an Android device.
 
-  This function executes an ADB shell command (`ip -6 address show -tentative`) to get the
+  This function executes an ADB shell command (`ip -6 address show -tentative`)
+  to get the
   network interface information and extracts the IPv6 address from the output.
   If devices have no IPv6 address, raise PatternNotFoundException.
 
@@ -110,8 +116,10 @@ def get_non_tentative_ipv6_addresses(
   #         valid_lft forever preferred_lft forever
   #     inet6 fe80::1233:aadb:3d32:1234/64 scope link
   #         valid_lft forever preferred_lft forever
-  output = adb_utils.adb_shell(ad, f"ip -6 address show -tentative {iface_name}")
-  pattern = r"inet6\s+([0-9a-fA-F:]+)\/\d+"
+  output = adb_utils.adb_shell(
+      ad, f'ip -6 address show -tentative {iface_name}'
+  )
+  pattern = r'inet6\s+([0-9a-fA-F:]+)\/\d+'
   matches = re.findall(pattern, output)
 
   if matches:
@@ -119,13 +127,15 @@ def get_non_tentative_ipv6_addresses(
   else:
     return []
 
+
 def get_exclude_all_host_ipv6_multicast_addresses(
     ad: android_device.AndroidDevice, iface_name: str
 ) -> list[str]:
   """Retrieves the IPv6 multicast addresses of a given interface on an Android device.
 
   This function executes an ADB shell command (`ip -6 maddr show`) to get the
-  network interface information and extracts the IPv6 multicast address from the output.
+  network interface information and extracts the IPv6 multicast address from the
+  output.
   If devices have no IPv6 multicast address, raise PatternNotFoundException.
 
   Args:
@@ -142,15 +152,16 @@ def get_exclude_all_host_ipv6_multicast_addresses(
   #         inet6 ff02::1:ffb7:cba2 users 2
   #         inet6 ff02::1
   #         inet6 ff01::1
-  output = adb_utils.adb_shell(ad, f"ip -6 maddr show {iface_name}")
-  pattern = r"inet6\s+([a-fA-F0-9:]+)(?:\s+users\s+\d+)?"
+  output = adb_utils.adb_shell(ad, f'ip -6 maddr show {iface_name}')
+  pattern = r'inet6\s+([a-fA-F0-9:]+)(?:\s+users\s+\d+)?'
   matches = re.findall(pattern, output)
 
   if matches:
-    return [addr for addr in matches if addr not in ("ff02::1", "ff01::1")]
+    return [addr for addr in matches if addr not in ('ff02::1', 'ff01::1')]
   else:
     return []
 
+
 def get_hardware_address(
     ad: android_device.AndroidDevice, iface_name: str
 ) -> str:
@@ -166,7 +177,7 @@ def get_hardware_address(
   """
 
   # Run the "ip link" command and get its output.
-  ip_link_output = adb_utils.adb_shell(ad, f"ip link")
+  ip_link_output = adb_utils.adb_shell(ad, f'ip link')
 
   # Regular expression to extract the MAC address.
   # Parse hardware address from ip link output like below:
@@ -176,34 +187,37 @@ def get_hardware_address(
   #    link/ether 72:05:77:82:21:e0 brd ff:ff:ff:ff:ff:ff
   # 47: wlan1: <BROADCAST,MULTICAST> mtu 1500 qdisc ...
   #    link/ether 6a:16:81:ff:82:9b brd ff:ff:ff:ff:ff:ff"
-  pattern = rf"{iface_name}:.*?link/ether (([0-9a-fA-F]{{2}}:){{5}}[0-9a-fA-F]{{2}})"
+  pattern = (
+      rf'{iface_name}:.*?link/ether (([0-9a-fA-F]{{2}}:){{5}}[0-9a-fA-F]{{2}})'
+  )
   match = re.search(pattern, ip_link_output, re.DOTALL)
 
   if match:
     return match.group(1).upper()  # Extract the MAC address string.
   else:
     raise PatternNotFoundException(
-        "Cannot get hardware address for " + iface_name
+        'Cannot get hardware address for ' + iface_name
     )
 
+
 def is_packet_capture_supported(
-        ad: android_device.AndroidDevice,
+    ad: android_device.AndroidDevice,
 ) -> bool:
 
   try:
     # Invoke the shell command with empty argument and see how NetworkStack respond.
     # If supported, an IllegalArgumentException with help page will be printed.
     assert_utils.expect_throws(
-      lambda: start_capture_packets(ad, ""),
-      assert_utils.UnexpectedBehaviorError
+        lambda: start_capture_packets(ad, ''),
+        assert_utils.UnexpectedBehaviorError,
     )
     assert_utils.expect_throws(
-      lambda: stop_capture_packets(ad, ""),
-      assert_utils.UnexpectedBehaviorError
+        lambda: stop_capture_packets(ad, ''),
+        assert_utils.UnexpectedBehaviorError,
     )
     assert_utils.expect_throws(
-      lambda: get_matched_packet_counts(ad, "", ""),
-      assert_utils.UnexpectedBehaviorError
+        lambda: get_matched_packet_counts(ad, '', ''),
+        assert_utils.UnexpectedBehaviorError,
     )
   except assert_utils.UnexpectedExceptionError:
     return False
@@ -211,15 +225,14 @@ def is_packet_capture_supported(
   # If no UnsupportOperationException is thrown, regard it as supported
   return True
 
-def is_apf_dump_counters_supported(
-    ad: android_device.AndroidDevice
-) -> bool:
+
+def is_apf_dump_counters_supported(ad: android_device.AndroidDevice) -> bool:
   try:
     # Invoke the shell command with empty argument and see how NetworkStack respond.
     # If supported, an IllegalArgumentException with help page will be printed.
     assert_utils.expect_throws(
-      lambda: get_apf_counters_from_cmd(ad, ""),
-      assert_utils.UnexpectedBehaviorError
+        lambda: get_apf_counters_from_cmd(ad, ''),
+        assert_utils.UnexpectedBehaviorError,
     )
   except assert_utils.UnexpectedExceptionError:
     return False
@@ -227,13 +240,14 @@ def is_apf_dump_counters_supported(
   # If no UnsupportOperationException is thrown, regard it as supported
   return True
 
+
 def is_send_raw_packet_downstream_supported(
     ad: android_device.AndroidDevice,
 ) -> bool:
   try:
     # Invoke the shell command with empty argument and see how NetworkStack respond.
     # If supported, an IllegalArgumentException with help page will be printed.
-    send_raw_packet_downstream(ad, "", "")
+    send_raw_packet_downstream(ad, '', '')
   except assert_utils.UnexpectedBehaviorError:
     return True
   except UnsupportedOperationException:
@@ -272,18 +286,21 @@ def send_raw_packet_downstream(
         representation of a packet starting from L2 header.
   """
 
-  cmd = f"cmd network_stack send-raw-packet-downstream {iface_name} {packet_in_hex}"
+  cmd = (
+      'cmd network_stack send-raw-packet-downstream'
+      f' {iface_name} {packet_in_hex}'
+  )
 
   # Expect no output or Unknown command if NetworkStack is too old. Throw otherwise.
   adb_output = AdbOutputHandler(ad, cmd).get_output()
   if adb_output:
     raise assert_utils.UnexpectedBehaviorError(
-      f"Got unexpected output: {adb_output} for command: {cmd}."
+        f'Got unexpected output: {adb_output} for command: {cmd}.'
     )
 
+
 def start_capture_packets(
-        ad: android_device.AndroidDevice,
-        iface_name: str
+    ad: android_device.AndroidDevice, iface_name: str
 ) -> None:
   """Starts packet capturing on a specified network interface.
 
@@ -296,18 +313,18 @@ def start_capture_packets(
     ad: The Android device object.
     iface_name: The name of the network interface (e.g., "wlan0").
   """
-  cmd = f"cmd network_stack capture start {iface_name}"
+  cmd = f'cmd network_stack capture start {iface_name}'
 
   # Expect no output or Unknown command if NetworkStack is too old. Throw otherwise.
   adb_output = AdbOutputHandler(ad, cmd).get_output()
-  if adb_output != "success":
+  if adb_output != 'success':
     raise assert_utils.UnexpectedBehaviorError(
-      f"Got unexpected output: {adb_output} for command: {cmd}."
+        f'Got unexpected output: {adb_output} for command: {cmd}.'
     )
 
+
 def stop_capture_packets(
-        ad: android_device.AndroidDevice,
-        iface_name: str
+    ad: android_device.AndroidDevice, iface_name: str
 ) -> None:
   """Stops packet capturing on a specified network interface.
 
@@ -319,19 +336,18 @@ def stop_capture_packets(
     ad: The Android device object.
     iface_name: The name of the network interface (e.g., "wlan0").
   """
-  cmd = f"cmd network_stack capture stop {iface_name}"
+  cmd = f'cmd network_stack capture stop {iface_name}'
 
   # Expect no output or Unknown command if NetworkStack is too old. Throw otherwise.
   adb_output = AdbOutputHandler(ad, cmd).get_output()
-  if adb_output != "success":
+  if adb_output != 'success':
     raise assert_utils.UnexpectedBehaviorError(
-      f"Got unexpected output: {adb_output} for command: {cmd}."
+        f'Got unexpected output: {adb_output} for command: {cmd}.'
     )
 
+
 def get_matched_packet_counts(
-        ad: android_device.AndroidDevice,
-        iface_name: str,
-        packet_in_hex: str
+    ad: android_device.AndroidDevice, iface_name: str, packet_in_hex: str
 ) -> int:
   """Gets the number of captured packets matching a specific hexadecimal pattern.
 
@@ -348,7 +364,10 @@ def get_matched_packet_counts(
   Returns:
     The number of matched packets as an integer.
   """
-  cmd = f"cmd network_stack capture matched-packet-counts {iface_name} {packet_in_hex}"
+  cmd = (
+      'cmd network_stack capture matched-packet-counts'
+      f' {iface_name} {packet_in_hex}'
+  )
 
   # Expect no output or Unknown command if NetworkStack is too old. Throw otherwise.
   adb_output = AdbOutputHandler(ad, cmd).get_output()
@@ -356,9 +375,10 @@ def get_matched_packet_counts(
     return int(adb_output)
   except ValueError as e:
     raise assert_utils.UnexpectedBehaviorError(
-      f"Got unexpected exception: {e} for command: {cmd}."
+        f'Got unexpected exception: {e} for command: {cmd}.'
     )
 
+
 @dataclass
 class ApfCapabilities:
   """APF program support capabilities.
@@ -391,9 +411,9 @@ class ApfCapabilities:
   def __str__(self):
     """Returns a user-friendly string representation of the APF capabilities."""
     return (
-        f"APF Version: {self.apf_version_supported}\n"
-        f"Ram Size: {self.apf_ram_size} bytes\n"
-        f"Packet Format: {self.apf_packet_format}"
+        f'APF Version: {self.apf_version_supported}\n'
+        f'Ram Size: {self.apf_ram_size} bytes\n'
+        f'Packet Format: {self.apf_packet_format}'
     )
 
 
@@ -401,10 +421,10 @@ def get_apf_capabilities(
     ad: android_device.AndroidDevice, iface_name: str
 ) -> ApfCapabilities:
   output = adb_utils.adb_shell(
-      ad, f"cmd network_stack apf {iface_name} capabilities"
+      ad, f'cmd network_stack apf {iface_name} capabilities'
   )
   try:
-    values = [int(value_str) for value_str in output.split(",")]
+    values = [int(value_str) for value_str in output.split(',')]
   except ValueError:
     return ApfCapabilities(0, 0, 0)  # Conversion to integer failed
   return ApfCapabilities(values[0], values[1], values[2])
@@ -416,43 +436,55 @@ def assume_apf_version_support_at_least(
   caps = get_apf_capabilities(ad, iface_name)
   asserts.abort_class_if(
       caps.apf_version_supported < expected_version,
-      f"Supported apf version {caps.apf_version_supported} < expected version"
-      f" {expected_version}",
+      f'Supported apf version {caps.apf_version_supported} < expected version'
+      f' {expected_version}',
   )
 
+
 def at_least_B():
   def decorator(test_function):
     @functools.wraps(test_function)
     def wrapper(self, *args, **kwargs):
       asserts.abort_class_if(
-        (not hasattr(self, 'client')) or (not hasattr(self.client, 'isAtLeastB')),
-        "no valid client attribute"
+          (not hasattr(self, 'client'))
+          or (not hasattr(self.client, 'isAtLeastB')),
+          'no valid client attribute',
       )
 
-      asserts.abort_class_if(not self.client.isAtLeastB(), "client device is not Android B+")
+      asserts.abort_class_if(
+          not self.client.isAtLeastB(), 'client device is not Android B+'
+      )
       return test_function(self, *args, **kwargs)
+
     return wrapper
+
   return decorator
 
+
 def apf_ram_at_least(size):
   def decorator(test_function):
     @functools.wraps(test_function)
     def wrapper(self, *args, **kwargs):
       asserts.abort_class_if(
-        (not hasattr(self, 'clientDevice')) or (not hasattr(self, 'client_iface_name')),
-        "no valid client attribute"
+          (not hasattr(self, 'clientDevice'))
+          or (not hasattr(self, 'client_iface_name')),
+          'no valid client attribute',
       )
 
       caps = get_apf_capabilities(self.clientDevice, self.client_iface_name)
       asserts.skip_if(
-        caps.apf_ram_size < size,
-        f'APF rame size {caps.apf_ram_size} < {size}'
+          caps.apf_ram_size < size,
+          f'APF rame size {caps.apf_ram_size} < {size}',
       )
       return test_function(self, *args, **kwargs)
+
     return wrapper
+
   return decorator
 
+
 class AdbOutputHandler:
+
   def __init__(self, ad, cmd):
     self._ad = ad
     self._cmd = cmd
@@ -462,8 +494,6 @@ class AdbOutputHandler:
       return adb_utils.adb_shell(self._ad, self._cmd)
     except AdbError as e:
       output = str(e.stdout)
-      if "Unknown command" in output:
-        raise UnsupportedOperationException(
-          f"{self._cmd} is not supported."
-        )
-      return output
\ No newline at end of file
+      if 'Unknown command' in output:
+        raise UnsupportedOperationException(f'{self._cmd} is not supported.')
+      return output
diff --git a/staticlibs/testutils/host/python/assert_utils.py b/staticlibs/testutils/host/python/assert_utils.py
index 40094a2946..12cf4f50d7 100644
--- a/staticlibs/testutils/host/python/assert_utils.py
+++ b/staticlibs/testutils/host/python/assert_utils.py
@@ -19,9 +19,11 @@ from typing import Callable
 class UnexpectedBehaviorError(Exception):
   """Raised when there is an unexpected behavior during applying a procedure."""
 
+
 class UnexpectedExceptionError(Exception):
   """Raised when there is an unexpected exception throws during applying a procedure"""
 
+
 def expect_with_retry(
     predicate: Callable[[], bool],
     retry_action: Callable[[], None] = None,
@@ -41,19 +43,20 @@ def expect_with_retry(
       time.sleep(retry_interval_sec)
 
   raise UnexpectedBehaviorError(
-      "Predicate didn't become true after " + str(max_retries) + " retries."
+      "Predicate didn't become true after " + str(max_retries) + ' retries.'
   )
 
+
 def expect_throws(runnable: callable, exception_class) -> None:
   try:
     runnable()
-    raise UnexpectedBehaviorError("Expected an exception, but none was thrown")
+    raise UnexpectedBehaviorError('Expected an exception, but none was thrown')
   except exception_class:
     pass
   except UnexpectedBehaviorError as e:
     raise e
   except Exception as e:
-      raise UnexpectedExceptionError(
-        f"Expected exception of type {exception_class.__name__}, "
-        f"but got {type(e).__name__}: {e}"
-      )
\ No newline at end of file
+    raise UnexpectedExceptionError(
+        f'Expected exception of type {exception_class.__name__}, '
+        f'but got {type(e).__name__}: {e}'
+    )
diff --git a/tests/cts/multidevices/apfv4_test.py b/tests/cts/multidevices/apfv4_test.py
index 2f212fcdc9..6071d40769 100644
--- a/tests/cts/multidevices/apfv4_test.py
+++ b/tests/cts/multidevices/apfv4_test.py
@@ -12,19 +12,20 @@
 #  See the License for the specific language governing permissions and
 #  limitations under the License.
 
+import time
 from absl.testing import parameterized
 from mobly import asserts
 from net_tests_utils.host.python import apf_test_base, apf_utils
 from scapy.layers.l2 import Ether
-import time
 
 # Constants.
-COUNTER_DROPPED_ETHERTYPE_NOT_ALLOWED = "DROPPED_ETHERTYPE_NOT_ALLOWED"
-ETHER_BROADCAST_ADDR = "FFFFFFFFFFFF"
+COUNTER_DROPPED_ETHERTYPE_NOT_ALLOWED = 'DROPPED_ETHERTYPE_NOT_ALLOWED'
+ETHER_BROADCAST_ADDR = 'FFFFFFFFFFFF'
 MIN_PACKET_SIZE = 60
 
 
 class ApfV4Test(apf_test_base.ApfTestBase, parameterized.TestCase):
+
   def setup_class(self):
     super().setup_class()
     # Check apf version preconditions.
@@ -35,7 +36,7 @@ class ApfV4Test(apf_test_base.ApfTestBase, parameterized.TestCase):
       # Enforce APFv4 support for Android 14+ VSR.
       asserts.assert_true(
           caps.apf_version_supported >= 4,
-          "APFv4 became mandatory in Android 14 VSR.",
+          'APFv4 became mandatory in Android 14 VSR.',
       )
     else:
       # Skip tests for APF version < 4 before Android 14 VSR.
@@ -48,18 +49,22 @@ class ApfV4Test(apf_test_base.ApfTestBase, parameterized.TestCase):
   # Tests can use any disallowed packet type. Currently,
   # several ethertypes from the legacy ApfFilter denylist are used.
   @parameterized.parameters(
-      0x88a2,  # ATA over Ethernet
-      0x88a4,  # EtherCAT
-      0x88b8,  # GOOSE (Generic Object Oriented Substation event)
-      0x88cd,  # SERCOS III
-      0x88e3,  # Media Redundancy Protocol (IEC62439-2)
+      0x88A2,  # ATA over Ethernet
+      0x88A4,  # EtherCAT
+      0x88B8,  # GOOSE (Generic Object Oriented Substation event)
+      0x88CD,  # SERCOS III
+      0x88E3,  # Media Redundancy Protocol (IEC62439-2)
   )  # Declare inputs for state_str and expected_result.
   def test_apf_drop_ethertype_not_allowed(self, blocked_ether_type):
-    eth = Ether(src=self.server_mac_address, dst=self.client_mac_address, type=blocked_ether_type)
+    eth = Ether(
+        src=self.server_mac_address,
+        dst=self.client_mac_address,
+        type=blocked_ether_type,
+    )
     packet = bytes(eth).hex()
 
     # Add zero padding up to minimum ethernet frame length
-    packet = packet.ljust(MIN_PACKET_SIZE * 2, "0")
+    packet = packet.ljust(MIN_PACKET_SIZE * 2, '0')
 
     # Pause packet sending between tests to avoid APF disablement due to high throughput.
     time.sleep(3)
diff --git a/tests/cts/multidevices/apfv6_test.py b/tests/cts/multidevices/apfv6_test.py
index e06af65339..6b71c48bd3 100644
--- a/tests/cts/multidevices/apfv6_test.py
+++ b/tests/cts/multidevices/apfv6_test.py
@@ -13,198 +13,218 @@
 #  limitations under the License.
 
 from mobly import asserts
-from scapy.layers.inet import IP, ICMP, IPOption_Router_Alert
+from net_tests_utils.host.python import adb_utils, apf_test_base, apf_utils, assert_utils
+from scapy.contrib.igmpv3 import IGMPv3, IGMPv3gr, IGMPv3mq, IGMPv3mr
+from scapy.layers.inet import ICMP, IP, IPOption_Router_Alert
 from scapy.layers.inet6 import (
-    IPv6,
-    IPv6ExtHdrHopByHop,
-    ICMPv6EchoRequest,
     ICMPv6EchoReply,
+    ICMPv6EchoRequest,
+    ICMPv6MLDMultAddrRec,
     ICMPv6MLQuery2,
     ICMPv6MLReport2,
-    ICMPv6MLDMultAddrRec,
-    ICMPv6NDOptSrcLLAddr,
     ICMPv6NDOptDstLLAddr,
-    ICMPv6ND_NS,
+    ICMPv6NDOptSrcLLAddr,
     ICMPv6ND_NA,
-    RouterAlert
+    ICMPv6ND_NS,
+    IPv6,
+    IPv6ExtHdrHopByHop,
+    RouterAlert,
 )
 from scapy.layers.l2 import ARP, Ether
-from scapy.contrib.igmpv3 import IGMPv3, IGMPv3mq, IGMPv3mr, IGMPv3gr
-from net_tests_utils.host.python import apf_test_base, apf_utils, adb_utils, assert_utils
 
 APFV6_VERSION = 6000
 ARP_OFFLOAD_REPLY_LEN = 60
 
+
 class ApfV6Test(apf_test_base.ApfTestBase):
-    def setup_class(self):
-        super().setup_class()
 
-        # Skip tests for APF version < 6000
-        apf_utils.assume_apf_version_support_at_least(
-            self.clientDevice, self.client_iface_name, APFV6_VERSION
+  def setup_class(self):
+    super().setup_class()
+
+    # Skip tests for APF version < 6000
+    apf_utils.assume_apf_version_support_at_least(
+        self.clientDevice, self.client_iface_name, APFV6_VERSION
+    )
+
+  def teardown_class(self):
+    # force to stop capture on the server device if any test case failed
+    try:
+      apf_utils.stop_capture_packets(self.serverDevice, self.server_iface_name)
+    except assert_utils.UnexpectedBehaviorError:
+      pass
+    super().teardown_class()
+
+  def test_unicast_arp_request_offload(self):
+    eth = Ether(src=self.server_mac_address, dst=self.client_mac_address)
+    arp = ARP(
+        op=1,
+        psrc=self.server_ipv4_addresses[0],
+        pdst=self.client_ipv4_addresses[0],
+        hwsrc=self.server_mac_address,
+    )
+    arp_request = bytes(eth / arp).hex()
+
+    eth = Ether(src=self.client_mac_address, dst=self.server_mac_address)
+    arp = ARP(
+        op=2,
+        psrc=self.client_ipv4_addresses[0],
+        pdst=self.server_ipv4_addresses[0],
+        hwsrc=self.client_mac_address,
+        hwdst=self.server_mac_address,
+    )
+    expected_arp_reply = bytes(eth / arp).hex()
+
+    # Add zero padding up to 60 bytes, since APFv6 ARP offload always sent out 60 bytes reply
+    expected_arp_reply = expected_arp_reply.ljust(
+        ARP_OFFLOAD_REPLY_LEN * 2, '0'
+    )
+
+    self.send_packet_and_expect_reply_received(
+        arp_request, 'DROPPED_ARP_REQUEST_REPLIED', expected_arp_reply
+    )
+
+  def test_non_dad_ipv6_neighbor_solicitation_offload(self):
+    eth = Ether(src=self.server_mac_address, dst=self.client_mac_address)
+    ip = IPv6(
+        src=self.server_ipv6_addresses[0], dst=self.client_ipv6_addresses[0]
+    )
+    icmpv6 = ICMPv6ND_NS(tgt=self.client_ipv6_addresses[0])
+    opt = ICMPv6NDOptSrcLLAddr(lladdr=self.server_mac_address)
+    neighbor_solicitation = bytes(eth / ip / icmpv6 / opt).hex()
+
+    eth = Ether(src=self.client_mac_address, dst=self.server_mac_address)
+    ip = IPv6(
+        src=self.client_ipv6_addresses[0], dst=self.server_ipv6_addresses[0]
+    )
+    icmpv6 = ICMPv6ND_NA(tgt=self.client_ipv6_addresses[0], R=1, S=1, O=1)
+    opt = ICMPv6NDOptDstLLAddr(lladdr=self.client_mac_address)
+    expected_neighbor_advertisement = bytes(eth / ip / icmpv6 / opt).hex()
+    self.send_packet_and_expect_reply_received(
+        neighbor_solicitation,
+        'DROPPED_IPV6_NS_REPLIED_NON_DAD',
+        expected_neighbor_advertisement,
+    )
+
+  @apf_utils.at_least_B()
+  def test_ipv4_icmp_echo_request_offload(self):
+    eth = Ether(src=self.server_mac_address, dst=self.client_mac_address)
+    ip = IP(
+        src=self.server_ipv4_addresses[0], dst=self.client_ipv4_addresses[0]
+    )
+    icmp = ICMP(id=1, seq=123)
+    echo_request = bytes(eth / ip / icmp / b'hello').hex()
+
+    eth = Ether(src=self.client_mac_address, dst=self.server_mac_address)
+    ip = IP(
+        src=self.client_ipv4_addresses[0], dst=self.server_ipv4_addresses[0]
+    )
+    icmp = ICMP(type=0, id=1, seq=123)
+    expected_echo_reply = bytes(eth / ip / icmp / b'hello').hex()
+    self.send_packet_and_expect_reply_received(
+        echo_request, 'DROPPED_IPV4_PING_REQUEST_REPLIED', expected_echo_reply
+    )
+
+  @apf_utils.at_least_B()
+  @apf_utils.apf_ram_at_least(3000)
+  def test_ipv6_icmp_echo_request_offload(self):
+    eth = Ether(src=self.server_mac_address, dst=self.client_mac_address)
+    ip = IPv6(
+        src=self.server_ipv6_addresses[0], dst=self.client_ipv6_addresses[0]
+    )
+    icmp = ICMPv6EchoRequest(id=1, seq=123)
+    echo_request = bytes(eth / ip / icmp / b'hello').hex()
+
+    eth = Ether(src=self.client_mac_address, dst=self.server_mac_address)
+    ip = IPv6(
+        src=self.client_ipv6_addresses[0], dst=self.server_ipv6_addresses[0]
+    )
+    icmp = ICMPv6EchoReply(id=1, seq=123)
+    expected_echo_reply = bytes(eth / ip / icmp / b'hello').hex()
+
+    self.send_packet_and_expect_reply_received(
+        echo_request,
+        'DROPPED_IPV6_ICMP6_ECHO_REQUEST_REPLIED',
+        expected_echo_reply,
+    )
+
+  def is_running_as_root(self):
+    uid = adb_utils.adb_shell(self.clientDevice, 'id -u')
+    return uid == '0'
+
+  @apf_utils.at_least_B()
+  def test_igmpv3_general_query_offload(self):
+    if not self.is_running_as_root():
+      return
+    # use unicast to replace multicast ether dst to prevent flaky due to DTIM skip
+    ether = Ether(src=self.server_mac_address, dst=self.client_mac_address)
+    ip = IP(
+        src=self.server_ipv4_addresses[0],
+        dst='224.0.0.1',
+        options=[IPOption_Router_Alert()],
+    )
+    igmp = IGMPv3(type=0x11) / IGMPv3mq()
+    igmpv3_general_query = bytes(ether / ip / igmp).hex()
+
+    mcast_addrs = ['239.0.0.1', '239.0.0.2', '239.0.0.3']
+
+    for addr in mcast_addrs:
+      adb_utils.adb_shell(
+          self.clientDevice,
+          f'ip addr add {addr}/32 dev {self.client_iface_name} autojoin',
+      )
+
+    ether = Ether(src=self.client_mac_address, dst='01:00:5e:00:00:16')
+    ip = IP(
+        src=self.client_ipv4_addresses[0],
+        dst='224.0.0.22',
+        options=[IPOption_Router_Alert()],
+        id=0,
+        flags='DF',
+    )
+    igmpv3_hdr = IGMPv3(type=0x22)
+    mcast_records = []
+    for addr in mcast_addrs:
+      mcast_records.append(IGMPv3gr(rtype=2, maddr=addr))
+
+    igmp = IGMPv3mr(records=mcast_records)
+    expected_igmpv3_report = bytes(ether / ip / igmpv3_hdr / igmp).hex()
+    try:
+      self.send_packet_and_expect_reply_received(
+          igmpv3_general_query,
+          'DROPPED_IGMP_V3_GENERAL_QUERY_REPLIED',
+          expected_igmpv3_report,
+      )
+    finally:
+      for addr in mcast_addrs:
+        adb_utils.adb_shell(
+            self.clientDevice,
+            f'ip addr del {addr}/32 dev {self.client_iface_name}',
         )
 
-    def teardown_class(self):
-        # force to stop capture on the server device if any test case failed
-        try:
-            apf_utils.stop_capture_packets(self.serverDevice, self.server_iface_name)
-        except assert_utils.UnexpectedBehaviorError:
-            pass
-        super().teardown_class()
+  @apf_utils.at_least_B()
+  @apf_utils.apf_ram_at_least(3000)
+  def test_mldv2_general_query_offload(self):
+    # use unicast to replace multicast ether dst to prevent flaky due to DTIM skip
+    ether = Ether(src=self.server_mac_address, dst=self.client_mac_address)
+    ip = IPv6(src=self.server_ipv6_addresses[0], dst='ff02::1', hlim=1)
+    hopOpts = IPv6ExtHdrHopByHop(options=[RouterAlert(otype=5)])
+    mld = ICMPv6MLQuery2()
+    mldv2_general_query = bytes(ether / ip / hopOpts / mld).hex()
 
-    def test_unicast_arp_request_offload(self):
-        eth = Ether(src=self.server_mac_address, dst=self.client_mac_address)
-        arp = ARP(
-            op=1,
-            psrc=self.server_ipv4_addresses[0],
-            pdst=self.client_ipv4_addresses[0],
-            hwsrc=self.server_mac_address
-        )
-        arp_request = bytes(eth/arp).hex()
+    ether = Ether(src=self.client_mac_address, dst='33:33:00:00:00:16')
+    ip = IPv6(src=self.client_ipv6_addresses[0], dst='ff02::16', hlim=1)
 
-        eth = Ether(src=self.client_mac_address, dst=self.server_mac_address)
-        arp = ARP(
-            op=2,
-            psrc=self.client_ipv4_addresses[0],
-            pdst=self.server_ipv4_addresses[0],
-            hwsrc=self.client_mac_address,
-            hwdst=self.server_mac_address
-        )
-        expected_arp_reply = bytes(eth/arp).hex()
+    mcast_addrs = apf_utils.get_exclude_all_host_ipv6_multicast_addresses(
+        self.clientDevice, self.client_iface_name
+    )
 
-        # Add zero padding up to 60 bytes, since APFv6 ARP offload always sent out 60 bytes reply
-        expected_arp_reply = expected_arp_reply.ljust(ARP_OFFLOAD_REPLY_LEN * 2, "0")
-
-        self.send_packet_and_expect_reply_received(
-            arp_request, "DROPPED_ARP_REQUEST_REPLIED", expected_arp_reply
-        )
-
-    def test_non_dad_ipv6_neighbor_solicitation_offload(self):
-        eth = Ether(src=self.server_mac_address, dst=self.client_mac_address)
-        ip = IPv6(src=self.server_ipv6_addresses[0], dst=self.client_ipv6_addresses[0])
-        icmpv6 = ICMPv6ND_NS(tgt=self.client_ipv6_addresses[0])
-        opt = ICMPv6NDOptSrcLLAddr(lladdr=self.server_mac_address)
-        neighbor_solicitation = bytes(eth/ip/icmpv6/opt).hex()
-
-        eth = Ether(src=self.client_mac_address, dst=self.server_mac_address)
-        ip = IPv6(src=self.client_ipv6_addresses[0], dst=self.server_ipv6_addresses[0])
-        icmpv6 = ICMPv6ND_NA(tgt=self.client_ipv6_addresses[0], R=1, S=1, O=1)
-        opt = ICMPv6NDOptDstLLAddr(lladdr=self.client_mac_address)
-        expected_neighbor_advertisement = bytes(eth/ip/icmpv6/opt).hex()
-        self.send_packet_and_expect_reply_received(
-            neighbor_solicitation,
-            "DROPPED_IPV6_NS_REPLIED_NON_DAD",
-            expected_neighbor_advertisement
-        )
-
-    @apf_utils.at_least_B()
-    def test_ipv4_icmp_echo_request_offload(self):
-        eth = Ether(src=self.server_mac_address, dst=self.client_mac_address)
-        ip = IP(src=self.server_ipv4_addresses[0], dst=self.client_ipv4_addresses[0])
-        icmp = ICMP(id=1, seq=123)
-        echo_request = bytes(eth/ip/icmp/b"hello").hex()
-
-        eth = Ether(src=self.client_mac_address, dst=self.server_mac_address)
-        ip = IP(src=self.client_ipv4_addresses[0], dst=self.server_ipv4_addresses[0])
-        icmp = ICMP(type=0, id=1, seq=123)
-        expected_echo_reply = bytes(eth/ip/icmp/b"hello").hex()
-        self.send_packet_and_expect_reply_received(
-            echo_request, "DROPPED_IPV4_PING_REQUEST_REPLIED", expected_echo_reply
-        )
-
-    @apf_utils.at_least_B()
-    @apf_utils.apf_ram_at_least(3000)
-    def test_ipv6_icmp_echo_request_offload(self):
-        eth = Ether(src=self.server_mac_address, dst=self.client_mac_address)
-        ip = IPv6(src=self.server_ipv6_addresses[0], dst=self.client_ipv6_addresses[0])
-        icmp = ICMPv6EchoRequest(id=1, seq=123)
-        echo_request = bytes(eth/ip/icmp/b"hello").hex()
-
-        eth = Ether(src=self.client_mac_address, dst=self.server_mac_address)
-        ip = IPv6(src=self.client_ipv6_addresses[0], dst=self.server_ipv6_addresses[0])
-        icmp = ICMPv6EchoReply(id=1, seq=123)
-        expected_echo_reply = bytes(eth/ip/icmp/b"hello").hex()
-
-        self.send_packet_and_expect_reply_received(
-            echo_request, "DROPPED_IPV6_ICMP6_ECHO_REQUEST_REPLIED", expected_echo_reply
-        )
-
-    def is_running_as_root(self):
-        uid = adb_utils.adb_shell(self.clientDevice, "id -u")
-        return uid == "0"
-
-    @apf_utils.at_least_B()
-    def test_igmpv3_general_query_offload(self):
-        if not self.is_running_as_root():
-            return
-        # use unicast to replace multicast ether dst to prevent flaky due to DTIM skip
-        ether = Ether(src=self.server_mac_address, dst=self.client_mac_address)
-        ip = IP(
-            src=self.server_ipv4_addresses[0],
-            dst='224.0.0.1',
-            options=[IPOption_Router_Alert()]
-        )
-        igmp = IGMPv3(type=0x11)/IGMPv3mq()
-        igmpv3_general_query = bytes(ether/ip/igmp).hex()
-
-        mcast_addrs = ['239.0.0.1', '239.0.0.2', '239.0.0.3']
-
-        for addr in mcast_addrs:
-            adb_utils.adb_shell(
-                self.clientDevice,
-                f'ip addr add {addr}/32 dev {self.client_iface_name} autojoin'
-            )
-
-        ether = Ether(src=self.client_mac_address, dst='01:00:5e:00:00:16')
-        ip = IP(
-            src=self.client_ipv4_addresses[0],
-            dst='224.0.0.22',
-            options=[IPOption_Router_Alert()],
-            id=0,
-            flags="DF"
-        )
-        igmpv3_hdr = IGMPv3(type=0x22)
-        mcast_records = []
-        for addr in mcast_addrs:
-            mcast_records.append(IGMPv3gr(rtype=2, maddr=addr))
-
-        igmp = IGMPv3mr(records=mcast_records)
-        expected_igmpv3_report = bytes(ether/ip/igmpv3_hdr/igmp).hex()
-        try:
-            self.send_packet_and_expect_reply_received(
-                igmpv3_general_query,
-                "DROPPED_IGMP_V3_GENERAL_QUERY_REPLIED",
-                expected_igmpv3_report
-            )
-        finally:
-            for addr in mcast_addrs:
-                adb_utils.adb_shell(
-                    self.clientDevice,
-                    f'ip addr del {addr}/32 dev {self.client_iface_name}'
-                )
-
-    @apf_utils.at_least_B()
-    @apf_utils.apf_ram_at_least(3000)
-    def test_mldv2_general_query_offload(self):
-        # use unicast to replace multicast ether dst to prevent flaky due to DTIM skip
-        ether = Ether(src=self.server_mac_address, dst=self.client_mac_address)
-        ip = IPv6(src=self.server_ipv6_addresses[0], dst='ff02::1', hlim=1)
-        hopOpts = IPv6ExtHdrHopByHop(options=[RouterAlert(otype=5)])
-        mld = ICMPv6MLQuery2()
-        mldv2_general_query = bytes(ether/ip/hopOpts/mld).hex()
-
-        ether = Ether(src=self.client_mac_address, dst='33:33:00:00:00:16')
-        ip = IPv6(src=self.client_ipv6_addresses[0], dst='ff02::16', hlim=1)
-
-        mcast_addrs = apf_utils.get_exclude_all_host_ipv6_multicast_addresses(
-            self.clientDevice, self.client_iface_name
-        )
-
-        mld_records = []
-        for addr in mcast_addrs:
-            mld_records.append(ICMPv6MLDMultAddrRec(dst=addr, rtype=2))
-        mld = ICMPv6MLReport2(records=mld_records)
-        expected_mldv2_report = bytes(ether/ip/hopOpts/mld).hex()
-        self.send_packet_and_expect_reply_received(
-            mldv2_general_query, "DROPPED_IPV6_MLD_V2_GENERAL_QUERY_REPLIED", expected_mldv2_report
-        )
+    mld_records = []
+    for addr in mcast_addrs:
+      mld_records.append(ICMPv6MLDMultAddrRec(dst=addr, rtype=2))
+    mld = ICMPv6MLReport2(records=mld_records)
+    expected_mldv2_report = bytes(ether / ip / hopOpts / mld).hex()
+    self.send_packet_and_expect_reply_received(
+        mldv2_general_query,
+        'DROPPED_IPV6_MLD_V2_GENERAL_QUERY_REPLIED',
+        expected_mldv2_report,
+    )
diff --git a/tests/cts/multidevices/run_tests.py b/tests/cts/multidevices/run_tests.py
index a0d0bec587..3b4afc8238 100644
--- a/tests/cts/multidevices/run_tests.py
+++ b/tests/cts/multidevices/run_tests.py
@@ -21,7 +21,7 @@ from connectivity_multi_devices_test import ConnectivityMultiDevicesTest
 from mobly import suite_runner
 
 
-if __name__ == "__main__":
+if __name__ == '__main__':
   # For MoblyBinaryHostTest, this entry point will be called twice:
   # 1. List tests.
   #   <mobly-par-file-name> -- --list_tests
@@ -32,8 +32,10 @@ if __name__ == "__main__":
   # While the parameters before "--" is for the infrastructure,
   # ignore them if any. Also, do not alter parameters if there
   # is no "--", in case the binary is invoked manually.
-  if "--" in sys.argv:
-    index = sys.argv.index("--")
+  if '--' in sys.argv:
+    index = sys.argv.index('--')
     sys.argv = sys.argv[:1] + sys.argv[index + 1 :]
   # TODO: make the tests can be executed without manually list classes.
-  suite_runner.run_suite([ConnectivityMultiDevicesTest, ApfV4Test, ApfV6Test], sys.argv)
+  suite_runner.run_suite(
+      [ConnectivityMultiDevicesTest, ApfV4Test, ApfV6Test], sys.argv
+  )

From f1e3848b332b36a3d89e35625035ca554fa47669 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Wed, 28 May 2025 13:04:18 -0700
Subject: [PATCH 309/377] Fix flake in EthernetManagerTest

Depending on how the DAD timers align, there could be 1 or 2
onLinkPropertiesChanged callbacks. Furthermore, depending on how the
dice fall, NO_CALLBACK_TIMEOUT is too short (500ms) to account for this.

This CL changes the expectation from expect<Lost> to
eventuallyExpect<Lost> to skip over any onLinkPropertiesChanged
callbacks that might have been received.

Test: atest EthernetManagerTest#testUpdateConfiguration_forAllowedUids
Flag: EXEMPT mainline
Bug: 420648099
Change-Id: Ifa853accdfca2c00de4d7211badc75ae057d948f
---
 tests/cts/net/src/android/net/cts/EthernetManagerTest.kt | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/tests/cts/net/src/android/net/cts/EthernetManagerTest.kt b/tests/cts/net/src/android/net/cts/EthernetManagerTest.kt
index 9f3781b5c0..bdd7968a4e 100644
--- a/tests/cts/net/src/android/net/cts/EthernetManagerTest.kt
+++ b/tests/cts/net/src/android/net/cts/EthernetManagerTest.kt
@@ -990,7 +990,11 @@ class EthernetManagerTest {
 
         // UpdateConfiguration() currently does a restart on the ethernet interface therefore lost
         // will be expected first before available, as part of the restart.
-        cb.expect<Lost>(network)
+        // Note: this uses eventuallyExpect, because depending on how the DAD timers align, there
+        // may be 1 or 2 onLinkPropertiesChanged() callbacks. It is possible for that second
+        // onLinkPropertiesChanged() to arrive after assertNeverLost() returns.
+        // TODO: consider disabling DAD for these tests.
+        cb.eventuallyExpectLost(network)
         val updatedNetwork = cb.expect<Available>().network
         // With the test process UID allowed, binding to a restricted network should be successful.
         Socket().use { socket -> updatedNetwork.bindSocket(socket) }

From fbbb9def0f3f6477e347c918eadff2ac8b2e90b7 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Wed, 28 May 2025 15:26:14 -0700
Subject: [PATCH 310/377] Clean up eventuallyExpectLost

Not needed anymore.

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I16266685530171ece9cac0dc911c88639b5481bf
---
 .../android/net/cts/EthernetManagerTest.kt    | 23 ++++++++-----------
 1 file changed, 10 insertions(+), 13 deletions(-)

diff --git a/tests/cts/net/src/android/net/cts/EthernetManagerTest.kt b/tests/cts/net/src/android/net/cts/EthernetManagerTest.kt
index 9145b03dbc..b1b237ed1d 100644
--- a/tests/cts/net/src/android/net/cts/EthernetManagerTest.kt
+++ b/tests/cts/net/src/android/net/cts/EthernetManagerTest.kt
@@ -535,9 +535,6 @@ class EthernetManagerTest {
         NetworkRequest.Builder(NetworkRequest(ETH_REQUEST))
             .setNetworkSpecifier(EthernetNetworkSpecifier(ifaceName)).build()
 
-    private fun TestableNetworkCallback.eventuallyExpectLost(n: Network? = null) =
-        eventuallyExpect<Lost> { n?.equals(it.network) ?: true }
-
     private fun TestableNetworkCallback.assertNeverLost(n: Network? = null) =
         assertNoCallback { it is Lost && (n?.equals(it.network) ?: true) }
 
@@ -704,7 +701,7 @@ class EthernetManagerTest {
 
         cb.assertNeverLost()
         releaseRequest(cb)
-        listenerCb.eventuallyExpectLost(network)
+        listenerCb.eventuallyExpect<Lost>() { network.equals(it.network) }
     }
 
     @Test
@@ -722,7 +719,7 @@ class EthernetManagerTest {
         // remove interface before network request has been removed
         cb.assertNeverLost()
         removeInterface(iface)
-        cb.eventuallyExpectLost()
+        cb.eventuallyExpect<Lost>()
     }
 
     @Test
@@ -738,7 +735,7 @@ class EthernetManagerTest {
         removeInterface(iface1)
         cb.assertNeverLost()
         removeInterface(iface2)
-        cb.eventuallyExpectLost()
+        cb.eventuallyExpect<Lost>()
     }
 
     @Test
@@ -754,7 +751,7 @@ class EthernetManagerTest {
 
         // remove iface1 and verify the request brings up iface2
         removeInterface(iface1)
-        cb.eventuallyExpectLost(network)
+        cb.eventuallyExpect<Lost>() { network.equals(it.network) }
         cb.expect<Available>()
     }
 
@@ -797,7 +794,7 @@ class EthernetManagerTest {
 
         cb2.assertNeverLost()
         releaseRequest(cb2)
-        listener.eventuallyExpectLost(network)
+        listener.eventuallyExpect<Lost>() { network.equals(it.network) }
     }
 
     @Test
@@ -814,7 +811,7 @@ class EthernetManagerTest {
         cb.expect<Available>()
 
         iface.setCarrierEnabled(false)
-        cb.eventuallyExpectLost()
+        cb.eventuallyExpect<Lost>()
     }
 
     // TODO: move to MTS
@@ -859,7 +856,7 @@ class EthernetManagerTest {
         cb.assertNeverLost()
 
         disableInterface(iface).expectResult(iface.name)
-        cb.eventuallyExpectLost()
+        cb.eventuallyExpect<Lost>()
 
         enableInterface(iface).expectResult(iface.name)
         cb.expect<Available>()
@@ -970,7 +967,7 @@ class EthernetManagerTest {
         // Request the restricted network as the shell with CONNECTIVITY_USE_RESTRICTED_NETWORKS.
         val cb = runAsShell(CONNECTIVITY_USE_RESTRICTED_NETWORKS) { requestNetwork(request) }
         val network = cb.expect<Available>().network
-        cb.assertNeverLost(network)
+        cb.assertNeverLost()
 
         // The network is restricted therefore binding to it when available will fail.
         Socket().use { socket ->
@@ -989,7 +986,7 @@ class EthernetManagerTest {
         // may be 1 or 2 onLinkPropertiesChanged() callbacks. It is possible for that second
         // onLinkPropertiesChanged() to arrive after assertNeverLost() returns.
         // TODO: consider disabling DAD for these tests.
-        cb.eventuallyExpectLost(network)
+        cb.eventuallyExpect<Lost>()
         val updatedNetwork = cb.expect<Available>().network
         // With the test process UID allowed, binding to a restricted network should be successful.
         Socket().use { socket -> updatedNetwork.bindSocket(socket) }
@@ -1030,7 +1027,7 @@ class EthernetManagerTest {
         cb.expect<Available>()
 
         iface.setCarrierEnabled(false)
-        cb.eventuallyExpectLost()
+        cb.eventuallyExpect<Lost>()
 
         updateConfiguration(iface, STATIC_IP_CONFIGURATION, TEST_CAPS).expectResult(iface.name)
         cb.assertNoCallback()

From 4b3937b7f3f8a7f57e3e2c6a819dc559c49823e9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Thu, 29 May 2025 01:24:47 -0700
Subject: [PATCH 311/377] NetBpfLoad: Add errno to log for map verification
 failures
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We sometimes see issues when trying to load BPF maps, it's helpful to know
what errno was set.

Bug: 414570528
Test: TreeHugger
Flag: EXEMPT mainline
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I8b78ee17ebad076d073d50bfd0f01440fe7187a2
---
 bpf/loader/NetBpfLoad.cpp | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/bpf/loader/NetBpfLoad.cpp b/bpf/loader/NetBpfLoad.cpp
index 8bf10e5617..2389bea177 100644
--- a/bpf/loader/NetBpfLoad.cpp
+++ b/bpf/loader/NetBpfLoad.cpp
@@ -639,10 +639,11 @@ static bool mapMatchesExpectations(const unique_fd& fd, const string& mapName,
         return true;
     }
 
-    ALOGE("bpf map name %s mismatch: desired/found: "
+    ALOGE("bpf map name %s mismatch: desired/found (errno: %d): "
           "type:%d/%d key:%u/%d value:%u/%d entries:%u/%d flags:%u/%d",
-          mapName.c_str(), type, fd_type, mapDef.key_size, fd_key_size, mapDef.value_size,
-          fd_value_size, mapDef.max_entries, fd_max_entries, desired_map_flags, fd_map_flags);
+          mapName.c_str(), errno, type, fd_type, mapDef.key_size, fd_key_size,
+          mapDef.value_size, fd_value_size, mapDef.max_entries, fd_max_entries,
+          desired_map_flags, fd_map_flags);
     return false;
 }
 

From f53f0f0e21973827e8cd8683b7c36ff9bf79859b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Thu, 29 May 2025 02:43:32 -0700
Subject: [PATCH 312/377] BpfSyscallWrappers.h: fix to pass 'attr' by address
 instead of by const reference
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

(shot in the dark)

checking attr.info.info_len in line 265 could probably be optimized out if we pass by const reference, since one could assume it is still sizeof(info).

Bug: 414570528
Flag: EXEMPT mainline
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I1e5ba472042ecce0260f2e3b60a0a88095734f8d
---
 bpf/syscall_wrappers/include/BpfSyscallWrappers.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bpf/syscall_wrappers/include/BpfSyscallWrappers.h b/bpf/syscall_wrappers/include/BpfSyscallWrappers.h
index 1d72b7792c..49de936f8d 100644
--- a/bpf/syscall_wrappers/include/BpfSyscallWrappers.h
+++ b/bpf/syscall_wrappers/include/BpfSyscallWrappers.h
@@ -260,7 +260,7 @@ inline int bpfGetFd ## NAME(const borrowed_fd& fd) { \
         .info_len = sizeof(info), \
         .info = ptr_to_u64(&info), \
     }}; \
-    int rv = bpf(BPF_OBJ_GET_INFO_BY_FD, attr); \
+    int rv = bpf(BPF_OBJ_GET_INFO_BY_FD, &attr); \
     if (rv) return rv; \
     if (attr.info.info_len < offsetof(bpf_ ## TYPE ## _info, FIELD) + sizeof(info.FIELD)) { \
         errno = EOPNOTSUPP; \

From 1f830cd497e6ed78b756c951a3d1280023950d63 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Thu, 29 May 2025 08:06:01 -0700
Subject: [PATCH 313/377] bpf/progs/offload.c: fix kver of full implementations
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The full implementations are targeted for 5.10 kernels (S+), not 5.8.
Let's update the names to reflect that.

Test: TreeHugger
Flag: EXEMPT mainline
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I2694c55183e5634dec9d752286728b4070178440
---
 bpf/progs/offload.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/bpf/progs/offload.c b/bpf/progs/offload.c
index 5f53fe09f9..10e1c454eb 100644
--- a/bpf/progs/offload.c
+++ b/bpf/progs/offload.c
@@ -598,28 +598,28 @@ static inline __always_inline int do_forward4(struct __sk_buff* skb,
     }
 }
 
-// Full featured (required) implementations for 5.8+ kernels (these are S+ by definition)
+// Full featured (required) implementations for 5.10+ kernels (these are S+ by definition)
 
-DEFINE_BPF_PROG_KVER("schedcls/tether_downstream4_rawip$5_8", AID_ROOT, AID_NETWORK_STACK,
-                     sched_cls_tether_downstream4_rawip_5_8, KVER_5_10)
+DEFINE_BPF_PROG_KVER("schedcls/tether_downstream4_rawip$5_10", AID_ROOT, AID_NETWORK_STACK,
+                     sched_cls_tether_downstream4_rawip_5_10, KVER_5_10)
 (struct __sk_buff* skb) {
     return do_forward4(skb, RAWIP, DOWNSTREAM, UPDATETIME, KVER_5_10);
 }
 
-DEFINE_BPF_PROG_KVER("schedcls/tether_upstream4_rawip$5_8", AID_ROOT, AID_NETWORK_STACK,
-                     sched_cls_tether_upstream4_rawip_5_8, KVER_5_10)
+DEFINE_BPF_PROG_KVER("schedcls/tether_upstream4_rawip$5_10", AID_ROOT, AID_NETWORK_STACK,
+                     sched_cls_tether_upstream4_rawip_5_10, KVER_5_10)
 (struct __sk_buff* skb) {
     return do_forward4(skb, RAWIP, UPSTREAM, UPDATETIME, KVER_5_10);
 }
 
-DEFINE_BPF_PROG_KVER("schedcls/tether_downstream4_ether$5_8", AID_ROOT, AID_NETWORK_STACK,
-                     sched_cls_tether_downstream4_ether_5_8, KVER_5_10)
+DEFINE_BPF_PROG_KVER("schedcls/tether_downstream4_ether$5_10", AID_ROOT, AID_NETWORK_STACK,
+                     sched_cls_tether_downstream4_ether_5_10, KVER_5_10)
 (struct __sk_buff* skb) {
     return do_forward4(skb, ETHER, DOWNSTREAM, UPDATETIME, KVER_5_10);
 }
 
-DEFINE_BPF_PROG_KVER("schedcls/tether_upstream4_ether$5_8", AID_ROOT, AID_NETWORK_STACK,
-                     sched_cls_tether_upstream4_ether_5_8, KVER_5_10)
+DEFINE_BPF_PROG_KVER("schedcls/tether_upstream4_ether$5_10", AID_ROOT, AID_NETWORK_STACK,
+                     sched_cls_tether_upstream4_ether_5_10, KVER_5_10)
 (struct __sk_buff* skb) {
     return do_forward4(skb, ETHER, UPSTREAM, UPDATETIME, KVER_5_10);
 }

From bda15bd5c1492ea95e9b8a3aa681e2beb0ee8824 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Thu, 29 May 2025 08:49:03 -0700
Subject: [PATCH 314/377] bpf/progs/offload.c: split 4.14/4.19/5.4 into
 4.14/4.19 & 5.4
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Prep work to allow 5.4+ specific implementation.

Bug: 419747540
Test: TreeHugger
Flag: EXEMPT mainline
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I8aa40b3e2c068e39b34bff3d8c58cc8feccbf139
---
 bpf/progs/offload.c | 47 +++++++++++++++++++++++++++++++++++++++------
 1 file changed, 41 insertions(+), 6 deletions(-)

diff --git a/bpf/progs/offload.c b/bpf/progs/offload.c
index 10e1c454eb..d5d739fa20 100644
--- a/bpf/progs/offload.c
+++ b/bpf/progs/offload.c
@@ -624,13 +624,48 @@ DEFINE_BPF_PROG_KVER("schedcls/tether_upstream4_ether$5_10", AID_ROOT, AID_NETWO
     return do_forward4(skb, ETHER, UPSTREAM, UPDATETIME, KVER_5_10);
 }
 
-// Full featured (optional) implementations for 4.14-S, 4.19-S & 5.4-S kernels
-// (optional, because we need to be able to fallback for 4.14/4.19/5.4 pre-S kernels)
+// Full featured (optional) implementations for 5.4-S kernels
+// (optional, because we need to be able to fallback for 5.4 pre-S kernels)
+
+DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE("schedcls/tether_downstream4_rawip$opt54",
+                                    AID_ROOT, AID_NETWORK_STACK,
+                                    sched_cls_tether_downstream4_rawip_opt54,
+                                    KVER_5_4, KVER_5_10)
+(struct __sk_buff* skb) {
+    return do_forward4(skb, RAWIP, DOWNSTREAM, UPDATETIME, KVER_5_4);
+}
+
+DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE("schedcls/tether_upstream4_rawip$opt54",
+                                    AID_ROOT, AID_NETWORK_STACK,
+                                    sched_cls_tether_upstream4_rawip_opt54,
+                                    KVER_5_4, KVER_5_10)
+(struct __sk_buff* skb) {
+    return do_forward4(skb, RAWIP, UPSTREAM, UPDATETIME, KVER_5_4);
+}
+
+DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE("schedcls/tether_downstream4_ether$opt54",
+                                    AID_ROOT, AID_NETWORK_STACK,
+                                    sched_cls_tether_downstream4_ether_opt54,
+                                    KVER_5_4, KVER_5_10)
+(struct __sk_buff* skb) {
+    return do_forward4(skb, ETHER, DOWNSTREAM, UPDATETIME, KVER_5_4);
+}
+
+DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE("schedcls/tether_upstream4_ether$opt54",
+                                    AID_ROOT, AID_NETWORK_STACK,
+                                    sched_cls_tether_upstream4_ether_opt54,
+                                    KVER_5_4, KVER_5_10)
+(struct __sk_buff* skb) {
+    return do_forward4(skb, ETHER, UPSTREAM, UPDATETIME, KVER_5_4);
+}
+
+// Full featured (optional) implementations for 4.14-S & 4.19-S kernels
+// (optional, because we need to be able to fallback for 4.14/4.19 pre-S kernels)
 
 DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE("schedcls/tether_downstream4_rawip$opt",
                                     AID_ROOT, AID_NETWORK_STACK,
                                     sched_cls_tether_downstream4_rawip_opt,
-                                    KVER_4_14, KVER_5_10)
+                                    KVER_4_14, KVER_5_4)
 (struct __sk_buff* skb) {
     return do_forward4(skb, RAWIP, DOWNSTREAM, UPDATETIME, KVER_4_14);
 }
@@ -638,7 +673,7 @@ DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE("schedcls/tether_downstream4_rawip$opt",
 DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE("schedcls/tether_upstream4_rawip$opt",
                                     AID_ROOT, AID_NETWORK_STACK,
                                     sched_cls_tether_upstream4_rawip_opt,
-                                    KVER_4_14, KVER_5_10)
+                                    KVER_4_14, KVER_5_4)
 (struct __sk_buff* skb) {
     return do_forward4(skb, RAWIP, UPSTREAM, UPDATETIME, KVER_4_14);
 }
@@ -646,7 +681,7 @@ DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE("schedcls/tether_upstream4_rawip$opt",
 DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE("schedcls/tether_downstream4_ether$opt",
                                     AID_ROOT, AID_NETWORK_STACK,
                                     sched_cls_tether_downstream4_ether_opt,
-                                    KVER_4_14, KVER_5_10)
+                                    KVER_4_14, KVER_5_4)
 (struct __sk_buff* skb) {
     return do_forward4(skb, ETHER, DOWNSTREAM, UPDATETIME, KVER_4_14);
 }
@@ -654,7 +689,7 @@ DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE("schedcls/tether_downstream4_ether$opt",
 DEFINE_OPTIONAL_BPF_PROG_KVER_RANGE("schedcls/tether_upstream4_ether$opt",
                                     AID_ROOT, AID_NETWORK_STACK,
                                     sched_cls_tether_upstream4_ether_opt,
-                                    KVER_4_14, KVER_5_10)
+                                    KVER_4_14, KVER_5_4)
 (struct __sk_buff* skb) {
     return do_forward4(skb, ETHER, UPSTREAM, UPDATETIME, KVER_4_14);
 }

From 69a9bbcee00573476fd403232b6f56501ba9e604 Mon Sep 17 00:00:00 2001
From: Alessio Cosenza <acosenza@google.com>
Date: Tue, 27 May 2025 15:59:13 +0000
Subject: [PATCH 315/377] Add support to ctx in runProgram.

Programs of type raw_tp need the input to be passed in the ctx
instead of the data.

Test: with ag/33648187
Change-Id: I79ac0126d91c9eafd847a0c8709a47a0113a9430
---
 .../include/BpfSyscallWrappers.h              | 23 +++++++++++--------
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/bpf/syscall_wrappers/include/BpfSyscallWrappers.h b/bpf/syscall_wrappers/include/BpfSyscallWrappers.h
index 49de936f8d..43c3ac0f43 100644
--- a/bpf/syscall_wrappers/include/BpfSyscallWrappers.h
+++ b/bpf/syscall_wrappers/include/BpfSyscallWrappers.h
@@ -235,15 +235,20 @@ inline int detachSingleProgram(bpf_attach_type type, const borrowed_fd& prog_fd,
 }
 
 // Available in 4.12 and later kernels.
-inline int runProgram(const borrowed_fd& prog_fd, const void* data,
-                      const uint32_t data_size) {
-    return bpf(BPF_PROG_RUN, {
-                                     .test = {
-                                             .prog_fd = static_cast<__u32>(prog_fd.get()),
-                                             .data_size_in = data_size,
-                                             .data_in = ptr_to_u64(data),
-                                     },
-                             });
+inline int runProgram(const borrowed_fd &prog_fd, const void *data,
+                      const uint32_t data_size, const void *ctx = nullptr,
+                      const uint32_t ctx_size = 0) {
+    return bpf(BPF_PROG_RUN,
+               {
+                   .test =
+                       {
+                           .prog_fd = static_cast<__u32>(prog_fd.get()),
+                           .data_size_in = data_size,
+                           .data_in = ptr_to_u64(data),
+                           .ctx_size_in = ctx_size,
+                           .ctx_in = ptr_to_u64(ctx),
+                       },
+               });
 }
 
 // BPF_OBJ_GET_INFO_BY_FD requires 4.14+ kernel

From 954bc98a220c39439b7da7e09afc4749fe28d79a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Thu, 29 May 2025 08:55:01 -0700
Subject: [PATCH 316/377] bpf/progs/offload.c: disable ipv4 offload for non-gso
 >pmtu
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bug: 263884894
Bug: 419747540
Test: TreeHugger
Flag: EXEMPT mainline
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I937bd3e40ba0b8c2e1297e25582cd074d89ebb48
---
 bpf/progs/offload.c | 3 +++
 bpf/progs/offload.h | 1 +
 2 files changed, 4 insertions(+)

diff --git a/bpf/progs/offload.c b/bpf/progs/offload.c
index d5d739fa20..e2b283c6db 100644
--- a/bpf/progs/offload.c
+++ b/bpf/progs/offload.c
@@ -397,6 +397,9 @@ static inline __always_inline int do_forward4_bottom(struct __sk_buff* skb,
     uint64_t packets = 1;
     uint64_t L3_bytes = skb->len - l2_header_size;
     if (L3_bytes > v->pmtu) {
+        if (KVER_IS_AT_LEAST(kver, 5, 4, 0)) {
+            if (skb->gso_segs <= 1) TC_PUNT(ABOVE_IPV4_PMTU);
+        }
         const int tcp4_overhead = sizeof(struct iphdr) + sizeof(struct tcphdr) + 12;
         const int mss = v->pmtu - tcp4_overhead;
         const uint64_t payload = L3_bytes - tcp4_overhead;
diff --git a/bpf/progs/offload.h b/bpf/progs/offload.h
index 1e28f01f7c..4d6d3e41f6 100644
--- a/bpf/progs/offload.h
+++ b/bpf/progs/offload.h
@@ -39,6 +39,7 @@
     ERR(NO_STATS_ENTRY)       \
     ERR(NO_LIMIT_ENTRY)       \
     ERR(BELOW_IPV4_MTU)       \
+    ERR(ABOVE_IPV4_PMTU)      \
     ERR(BELOW_IPV6_MTU)       \
     ERR(LIMIT_REACHED)        \
     ERR(CHANGE_HEAD_FAILED)   \

From e4db9c7316b78b31e780fc663dfca1752878b92e Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Thu, 29 May 2025 11:12:14 -0700
Subject: [PATCH 317/377] Change RequestTracker log tag to
 TetheringRequestTracker

So related logs show up when grep'ing for tethering.

Test: TH
Bug: 10000001
Flag: EXEMPT trivial
Change-Id: I86791be62a068a8a64eca35fd5ce01ecde750a04
---
 .../src/com/android/networkstack/tethering/RequestTracker.java  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Tethering/src/com/android/networkstack/tethering/RequestTracker.java b/Tethering/src/com/android/networkstack/tethering/RequestTracker.java
index c91ff586e4..2608e7aaca 100644
--- a/Tethering/src/com/android/networkstack/tethering/RequestTracker.java
+++ b/Tethering/src/com/android/networkstack/tethering/RequestTracker.java
@@ -43,7 +43,7 @@ import java.util.Map;
  * Note: This class is not thread-safe.
  */
 public class RequestTracker {
-    private static final String TAG = RequestTracker.class.getSimpleName();
+    private static final String TAG = "TetheringRequestTracker";
 
     @NonNull
     private final boolean mUseFuzzyMatching;

From 1af98cb493b62818e396d0894a8c4a0a61a040de Mon Sep 17 00:00:00 2001
From: Sewook Seo <sewookseo@google.com>
Date: Wed, 20 Nov 2024 06:23:27 +0000
Subject: [PATCH 318/377] Destroy sockets with NetworkAgent update event

Destroy platform managed sockets on the removed IP address based on NetworkAgent update.

Bug: 373280981
Bug: 331139818
Flag: android.net.platform.flags.connectivity_service_destroy_socket
Test: atest ConnectivityCoverageTests
Test: device test
Change-Id: I6a1d2d0c25c130c2747d66bee203b0408e2fa0da
---
 .../android/server/ConnectivityService.java   |  79 ++++-
 .../connectivity/IntegerRangeUtils.java       |  61 ++++
 .../server/ConnectivityServiceTest.java       |   3 +-
 .../connectivity/IntegerRangeUtilsTest.java   |  94 ++++++
 .../CSDestroySocketTest.kt                    | 299 +++++++++++++++++-
 .../server/connectivityservice/base/CSTest.kt |  22 ++
 6 files changed, 542 insertions(+), 16 deletions(-)
 create mode 100644 service/src/com/android/server/connectivity/IntegerRangeUtils.java
 create mode 100644 tests/unit/java/com/android/server/connectivity/IntegerRangeUtilsTest.java

diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index 2f28265334..8d2c06e43a 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -156,6 +156,8 @@ import static com.android.net.module.util.PermissionUtils.enforceNetworkStackPer
 import static com.android.net.module.util.PermissionUtils.enforceNetworkStackPermissionOr;
 import static com.android.net.module.util.PermissionUtils.hasAnyPermissionOf;
 import static com.android.server.ConnectivityStatsLog.CONNECTIVITY_STATE_SAMPLE;
+import static com.android.server.NetIdManager.MAX_NET_ID;
+import static com.android.server.NetIdManager.MIN_NET_ID;
 import static com.android.server.connectivity.ConnectivityFlags.CELLULAR_DATA_INACTIVITY_TIMEOUT;
 import static com.android.server.connectivity.ConnectivityFlags.CLOSE_QUIC_CONNECTION;
 import static com.android.server.connectivity.ConnectivityFlags.DELAY_DESTROY_SOCKETS;
@@ -375,6 +377,7 @@ import com.android.server.connectivity.DnsManager;
 import com.android.server.connectivity.DnsManager.PrivateDnsValidationUpdate;
 import com.android.server.connectivity.DscpPolicyTracker;
 import com.android.server.connectivity.FullScore;
+import com.android.server.connectivity.IntegerRangeUtils;
 import com.android.server.connectivity.InterfaceTracker;
 import com.android.server.connectivity.InvalidTagException;
 import com.android.server.connectivity.KeepaliveResourceUtil;
@@ -1841,6 +1844,21 @@ public class ConnectivityService extends IConnectivityManager.Stub
             InetDiagMessage.destroyLiveTcpSocketsByOwnerUids(ownerUids);
         }
 
+        /**
+         * Destroy live tcp sockets for IP addresses with conditions.
+         *
+         * @param address a local address to destroy sockets
+         * @param netIdRange range of net IDs to destroy sockets
+         * @param uidRanges ranges of UIDs to destroy sockets
+         */
+        public void destroyLiveTcpSocketsByLocalAddress(
+                @NonNull InetAddress address,
+                @Nullable Set<Range<Integer>> netIdRange,
+                @Nullable Set<Range<Integer>> uidRanges)
+                throws SocketException, InterruptedIOException, ErrnoException {
+            InetDiagMessage.destroyLiveTcpSocketsByLocalAddress(address, netIdRange, uidRanges);
+        }
+
         /**
          * Schedule the evaluation timeout.
          *
@@ -5763,7 +5781,6 @@ public class ConnectivityService extends IConnectivityManager.Stub
             // for an unnecessarily long time.
             destroyNativeNetwork(nai);
         }
-        updateIpAddressesForNetwork(nai, nai.linkProperties, null);
         if (!nai.isCreated() && !mDeps.isAtLeastT()) {
             // Backwards compatibility: send onNetworkDestroyed even if network was never created.
             // This can never run if the code above runs because shouldDestroyNativeNetwork is
@@ -5874,6 +5891,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
         } catch (RemoteException | ServiceSpecificException e) {
             loge("Exception destroying network(networkDestroy): " + e);
         }
+        updateIpAddressesAndDestroySockets(nai, nai.linkProperties, null);
         try {
             mDnsResolver.destroyNetworkCache(nai.network.getNetId());
         } catch (RemoteException | ServiceSpecificException e) {
@@ -9882,14 +9900,14 @@ public class ConnectivityService extends IConnectivityManager.Stub
             }
             networkAgent.networkMonitor().notifyLinkPropertiesChanged(
                     new LinkProperties(newLp, true /* parcelSensitiveFields */));
-            updateIpAddressesForNetwork(networkAgent, oldLp, newLp);
+            updateIpAddressesAndDestroySockets(networkAgent, oldLp, newLp);
             notifyNetworkCallbacks(networkAgent, CALLBACK_IP_CHANGED);
         }
 
         mKeepaliveTracker.handleCheckKeepalivesStillValid(networkAgent);
     }
 
-    private void updateIpAddressesForNetwork(
+    private void updateIpAddressesAndDestroySockets(
             NetworkAgentInfo nai, LinkProperties oldLp, LinkProperties newLp) {
         ensureRunningOnConnectivityServiceThread();
         if (mIpToNetworksMap == null) {
@@ -9914,7 +9932,12 @@ public class ConnectivityService extends IConnectivityManager.Stub
 
         if (!result.removed.isEmpty()) {
             for (LinkAddress la : result.removed) {
+                if (la.getAddress() instanceof Inet6Address
+                        && la.getAddress().isLinkLocalAddress()) {
+                    continue;
+                }
                 final Set<NetworkAgentInfo> networks = mIpToNetworksMap.get(la.getAddress());
+                destroySocketsForRemovedAddress(la.getAddress(), nai, networks);
                 if (networks != null) {
                     networks.remove(nai);
                     if (networks.isEmpty()) {
@@ -9925,6 +9948,56 @@ public class ConnectivityService extends IConnectivityManager.Stub
         }
     }
 
+    private void destroySocketsForRemovedAddress(
+            InetAddress address,
+            @NonNull NetworkAgentInfo targetNai,
+            @NonNull Set<NetworkAgentInfo> networks) {
+        // Logic to destroy sockets(MIN_NET_ID ~ MAX_NET_ID) on networks managed by this service
+        // when IP addresses are removed. Sockets(0 ~ MIN_NET_ID - 1) are for OEM network or legacy
+        // local network. Those are not tracked by this service, thus will be destroyed at the
+        // RTM_DELADDR event handling.
+        final Set<Range<Integer>> netIdRangeSet;
+        final Set<Range<Integer>> uidRangeSet;
+        if (networks.size() == 1) {
+            // Removed IP address was in single network.
+            netIdRangeSet = Set.of(Range.create(MIN_NET_ID, MAX_NET_ID));
+            uidRangeSet = null;
+        } else if (CollectionUtils.all(networks, nai -> !nai.isVPN())) {
+            // If all networks are not VPNs, other networks with the same IP address can be exempted
+            // from this socket destruction. Since there may be remaining socket's which has Fwmark
+            // matched to previously disconnected VPN's netId, It's intended destroying sockets not
+            // matched to exempt networks rather than sockets matched to the target network.
+            final List<Integer> exemptNetIds = new ArrayList<>();
+            for (NetworkAgentInfo nai : networks) {
+                if (nai.network.netId != targetNai.network.netId) {
+                    exemptNetIds.add(nai.network.netId);
+                }
+            }
+            netIdRangeSet = IntegerRangeUtils.rangeWithoutValues(
+                    Range.create(MIN_NET_ID, MAX_NET_ID), exemptNetIds);
+            uidRangeSet = null;
+        } else if (CollectionUtils.all(networks, NetworkAgentInfo::isVPN)) {
+            // Since the UID ranges of VPN networks cannot overlap with each other, if all networks
+            // with the corresponding address were VPNs, sockets included in the UID range of the
+            // target network are selectively removed.
+            netIdRangeSet = Set.of(Range.create(MIN_NET_ID, MAX_NET_ID));
+            uidRangeSet = targetNai.networkCapabilities.getUids();
+        } else {
+            // If there is at least one VPN network among multiple networks with the same address,
+            // there may be sockets with Fwmark value which does not match the netId (e.g. Socket
+            // connections on non-bypassable VPN or socket connections fallen out of split tunnel
+            // for the bypassable VPN), and it is currently too complicated to distinguish them.
+            // Thus sockets in whole netId range will be destroyed based on local IP address.
+            netIdRangeSet = Set.of(Range.create(MIN_NET_ID, MAX_NET_ID));
+            uidRangeSet = null;
+        }
+        try {
+            mDeps.destroyLiveTcpSocketsByLocalAddress(address, netIdRangeSet, uidRangeSet);
+        } catch (Exception e) {
+            loge("Exception destroy TCP sockets on local address: ", e);
+        }
+    }
+
     private void applyInitialLinkProperties(@NonNull NetworkAgentInfo nai) {
         updateLinkProperties(nai, new LinkProperties(nai.linkProperties), null);
     }
diff --git a/service/src/com/android/server/connectivity/IntegerRangeUtils.java b/service/src/com/android/server/connectivity/IntegerRangeUtils.java
new file mode 100644
index 0000000000..d67db4649d
--- /dev/null
+++ b/service/src/com/android/server/connectivity/IntegerRangeUtils.java
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.server.connectivity;
+
+import android.util.ArraySet;
+import android.util.Range;
+
+import androidx.annotation.NonNull;
+import androidx.annotation.Nullable;
+
+import com.android.net.module.util.CollectionUtils;
+
+import java.util.Collections;
+import java.util.List;
+import java.util.Set;
+
+public final class IntegerRangeUtils {
+    /**
+     * Remove given Integer list from the source Integer range and return a set of ranges.
+     * @param source Integer range from which Integer list will be removed
+     * @param exempt Integer list to be removed from the source.
+     * @return a set of Integer ranges which doesn't have exempted Integer list.
+     */
+    public static Set<Range<Integer>> rangeWithoutValues(
+            @NonNull Range<Integer> source, @Nullable List<Integer> exempt) {
+        final Set<Range<Integer>> rangeSet = new ArraySet<>();
+        final List<Integer> exemptInRange = exempt != null
+                ? CollectionUtils.filter(exempt, source::contains) : null;
+        if (exemptInRange == null || exemptInRange.isEmpty()) {
+            rangeSet.add(source);
+            return rangeSet;
+        }
+        Collections.sort(exemptInRange);
+        int start = source.getLower();
+        for (int i = 0; i < exemptInRange.size(); i++) {
+            int end = exemptInRange.get(i);
+            if (end > start) {
+                rangeSet.add(Range.create(start, end - 1));
+            }
+            start = end + 1;
+        }
+        if (start <= source.getUpper()) {
+            rangeSet.add(Range.create(start, source.getUpper()));
+        }
+        return rangeSet;
+    }
+}
diff --git a/tests/unit/java/com/android/server/ConnectivityServiceTest.java b/tests/unit/java/com/android/server/ConnectivityServiceTest.java
index a8b95b7418..896399019f 100644
--- a/tests/unit/java/com/android/server/ConnectivityServiceTest.java
+++ b/tests/unit/java/com/android/server/ConnectivityServiceTest.java
@@ -214,12 +214,12 @@ import static org.junit.Assume.assumeFalse;
 import static org.junit.Assume.assumeTrue;
 import static org.mockito.AdditionalMatchers.aryEq;
 import static org.mockito.ArgumentMatchers.anyBoolean;
+import static org.mockito.ArgumentMatchers.anyInt;
 import static org.mockito.ArgumentMatchers.anyLong;
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.ArgumentMatchers.argThat;
 import static org.mockito.ArgumentMatchers.eq;
 import static org.mockito.ArgumentMatchers.isNull;
-import static org.mockito.ArgumentMatchers.anyInt;
 import static org.mockito.Mockito.any;
 import static org.mockito.Mockito.atLeastOnce;
 import static org.mockito.Mockito.clearInvocations;
@@ -405,7 +405,6 @@ import com.android.server.ConnectivityService.ConnectivityDiagnosticsCallbackInf
 import com.android.server.ConnectivityService.NetworkRequestInfo;
 import com.android.server.ConnectivityServiceTest.ConnectivityServiceDependencies.DestroySocketsWrapper;
 import com.android.server.ConnectivityServiceTest.ConnectivityServiceDependencies.ReportedInterfaces;
-import com.android.server.L2capNetworkProvider;
 import com.android.server.connectivity.ApplicationSelfCertifiedNetworkCapabilities;
 import com.android.server.connectivity.AutomaticOnOffKeepaliveTracker;
 import com.android.server.connectivity.CarrierPrivilegeAuthenticator;
diff --git a/tests/unit/java/com/android/server/connectivity/IntegerRangeUtilsTest.java b/tests/unit/java/com/android/server/connectivity/IntegerRangeUtilsTest.java
new file mode 100644
index 0000000000..b290459446
--- /dev/null
+++ b/tests/unit/java/com/android/server/connectivity/IntegerRangeUtilsTest.java
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.server.connectivity;
+
+import static org.junit.Assert.assertEquals;
+
+import android.os.Build;
+import android.util.Range;
+
+import com.android.testutils.DevSdkIgnoreRule;
+import com.android.testutils.DevSdkIgnoreRunner;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import java.util.List;
+import java.util.Set;
+
+/**
+ * Tests for IntegerRangeUtils.
+ */
+@RunWith(DevSdkIgnoreRunner.class)
+@DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.R)
+public class IntegerRangeUtilsTest {
+    @Test
+    @DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.R)
+    public void testRangeWithoutValues() {
+        final Range<Integer> source1 = Range.create(100, 200);
+        // Basic separation after excluding exempt Integer list.
+        final List<Integer> exempt1 = List.of(110, 170);
+        final Set<Range<Integer>> expected1 = Set.of(
+                Range.create(100, 109),
+                Range.create(111, 169),
+                Range.create(171, 200));
+        // Check continuous exempt list.
+        final List<Integer> exempt2 = List.of(110, 111, 112, 114);
+        final Set<Range<Integer>> expected2 = Set.of(
+                Range.create(100, 109),
+                Range.create(113, 113),
+                Range.create(115, 200));
+        // Check handling exempted Integer on the edge of range.
+        final List<Integer> exempt3 = List.of(100, 199, 200);
+        final Set<Range<Integer>> expected3 = Set.of(
+                Range.create(101, 198)
+        );
+        final List<Integer> exempt4 = List.of(100, 101, 102, 200);
+        final Set<Range<Integer>> expected4 = Set.of(
+                Range.create(103, 199)
+        );
+        // Check handling exempted Integer list out of the source range.
+        final List<Integer> exempt5 = List.of(99, 201);
+        final Set<Range<Integer>> expected5 = Set.of(
+                Range.create(100, 200)
+        );
+        final List<Integer> exempt6 = List.of(99, 150, 200, 201);
+        final Set<Range<Integer>> expected6 = Set.of(
+                Range.create(100, 149),
+                Range.create(151, 199)
+        );
+        // Check handling unordered exempted Integer list.
+        final List<Integer> exempt7 = List.of(200, 99, 201, 150, 117);
+        final Set<Range<Integer>> expected7 = Set.of(
+                Range.create(100, 116),
+                Range.create(118, 149),
+                Range.create(151, 199)
+        );
+        assertEquals(expected1, IntegerRangeUtils.rangeWithoutValues(source1, exempt1));
+        assertEquals(expected2, IntegerRangeUtils.rangeWithoutValues(source1, exempt2));
+        assertEquals(expected3, IntegerRangeUtils.rangeWithoutValues(source1, exempt3));
+        assertEquals(expected4, IntegerRangeUtils.rangeWithoutValues(source1, exempt4));
+        assertEquals(expected5, IntegerRangeUtils.rangeWithoutValues(source1, exempt5));
+        assertEquals(expected6, IntegerRangeUtils.rangeWithoutValues(source1, exempt6));
+        assertEquals(expected7, IntegerRangeUtils.rangeWithoutValues(source1, exempt7));
+        // Check the case that source range is included in exempted list.
+        final Range<Integer> source2 = Range.create(100, 101);
+        final List<Integer> exempt8 = List.of(99, 100, 101);
+        final Set<Range<Integer>> expected8 = Set.of();
+        assertEquals(expected8, IntegerRangeUtils.rangeWithoutValues(source2, exempt8));
+    }
+}
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSDestroySocketTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSDestroySocketTest.kt
index ab666d2c33..4b37d86852 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSDestroySocketTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSDestroySocketTest.kt
@@ -26,14 +26,25 @@ import android.net.ConnectivityManager.FIREWALL_RULE_ALLOW
 import android.net.ConnectivityManager.FIREWALL_RULE_DENY
 import android.net.LinkAddress
 import android.net.LinkProperties
+import android.net.NetworkCapabilities
 import android.net.NetworkCapabilities.NET_CAPABILITY_INTERNET
+import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_SUSPENDED
+import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_VCN_MANAGED
+import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_VPN
 import android.net.NetworkCapabilities.TRANSPORT_BLUETOOTH
 import android.net.NetworkCapabilities.TRANSPORT_CELLULAR
 import android.net.NetworkCapabilities.TRANSPORT_ETHERNET
+import android.net.NetworkCapabilities.TRANSPORT_TEST
+import android.net.NetworkCapabilities.TRANSPORT_VPN
 import android.net.NetworkCapabilities.TRANSPORT_WIFI
 import android.net.NetworkRequest
+import android.net.VpnManager
+import android.net.VpnTransportInfo
 import android.os.Build
+import android.util.Range
 import com.android.net.module.util.BaseNetdUnsolicitedEventListener
+import com.android.server.NetIdManager.MAX_NET_ID
+import com.android.server.NetIdManager.MIN_NET_ID
 import com.android.server.connectivity.ConnectivityFlags.DELAY_DESTROY_SOCKETS
 import com.android.testutils.DevSdkIgnoreRule
 import com.android.testutils.DevSdkIgnoreRunner
@@ -58,6 +69,9 @@ import org.mockito.Mockito.verify
 private const val TIMESTAMP = 1234L
 private const val TEST_UID = 1234
 private const val TEST_UID2 = 5678
+private val TEST_UID_RANGE1 = Range(10000, 20000)
+private val TEST_UID_RANGE2 = Range(21000, 30000)
+private val TEST_UID_RANGE3 = Range(31000, 40000)
 private const val TEST_CELL_IFACE = "test_rmnet"
 
 private fun cellNc() = makeNc(TRANSPORT_CELLULAR)
@@ -66,13 +80,36 @@ private fun makeNc(transportType: Int) = nc(transportType, NET_CAPABILITY_INTERN
 
 private fun cellLp() = makeLp(TEST_CELL_IFACE)
 
+private fun vpnNc(uidRanges: Set<Range<Int>>) = NetworkCapabilities.Builder()
+    .addTransportType(TRANSPORT_VPN)
+    .setTransportInfo(
+        VpnTransportInfo(
+            VpnManager.TYPE_VPN_PLATFORM,
+            null /* sessionId */,
+            false /* bypassable */,
+            false /* longLivedTcpConnectionsExpensive */
+        )
+    )
+    .removeCapability(NET_CAPABILITY_NOT_VPN)
+    .addCapability(NET_CAPABILITY_INTERNET)
+    .addCapability(NET_CAPABILITY_NOT_SUSPENDED)
+    .addCapability(NET_CAPABILITY_NOT_VCN_MANAGED)
+    .setUids(uidRanges)
+    .build()
+
 private fun makeLp(interfaceName: String) = LinkProperties().also{
     it.interfaceName = interfaceName
 }
 
-private fun makeRequest(transportType: Int) = NetworkRequest.Builder()
+private fun makeRequest(nc: NetworkCapabilities) = NetworkRequest.Builder()
     .clearCapabilities()
-    .addTransportType(transportType)
+    .setCapabilities(nc)
+    .build()
+
+private fun makeVpnRequest(uidRanges: Set<Range<Int>>) = NetworkRequest.Builder()
+    .clearCapabilities()
+    .addTransportType(TRANSPORT_VPN)
+    .setUids(uidRanges)
     .build()
 
 @RunWith(DevSdkIgnoreRunner::class)
@@ -362,15 +399,15 @@ class CSDestroySocketTest : CSTest() {
     private fun prepareNetworkAgent(
         interfaceName: String,
         addresses: List<LinkAddress>,
-        transportType: Int
+        nc: NetworkCapabilities
     ): Pair<CSAgentWrapper, TestableNetworkCallback> {
         val callback = TestableNetworkCallback()
-        cm.registerNetworkCallback(makeRequest(transportType), callback)
+        cm.registerNetworkCallback(makeRequest(nc), callback)
         val linkProperties = makeLp(interfaceName)
-        for (address in addresses) {
-            linkProperties.addLinkAddress(address)
+        for (linkAddress in addresses) {
+            linkProperties.addLinkAddress(linkAddress)
         }
-        val agent = Agent(nc = makeNc(transportType), lp = linkProperties)
+        val agent = Agent(nc = nc, lp = linkProperties)
         agent.connect()
         return agent to callback
     }
@@ -389,18 +426,18 @@ class CSDestroySocketTest : CSTest() {
         val (cellAgent, cellCallback) = prepareNetworkAgent(
             "rmnet1",
             arrayListOf(addressV6_1.toLinkAddress(), addressV4_1.toLinkAddress()),
-            TRANSPORT_CELLULAR
+            makeNc(transportType = TRANSPORT_CELLULAR)
         )
 
         val (wlanAgent, wlanCallback) = prepareNetworkAgent(
             "wlan1",
             arrayListOf(addressV6_2.toLinkAddress(), addressV4_1.toLinkAddress()),
-            TRANSPORT_WIFI
+            makeNc(transportType = TRANSPORT_WIFI)
         )
         val (ethAgent, ethCallback) = prepareNetworkAgent(
             "eth2",
             arrayListOf(addressV6_2.toLinkAddress(), addressV4_2.toLinkAddress()),
-            TRANSPORT_ETHERNET
+            makeNc(transportType = TRANSPORT_ETHERNET)
         )
         val ipToNetworksMap = assertNotNull(service.mIpToNetworksMap)
         fun InetAddress.getNetworks() = ipToNetworksMap[this]!!.map{ it.network }.toSet()
@@ -445,7 +482,7 @@ class CSDestroySocketTest : CSTest() {
         val (agent4, callback4) = prepareNetworkAgent(
             "bt1",
             arrayListOf(addressV6LinkLocal.toLinkAddress(), addressV4_2.toLinkAddress()),
-            TRANSPORT_BLUETOOTH
+            makeNc(transportType = TRANSPORT_BLUETOOTH)
         )
         assertEquals(3, ipToNetworksMap.size)
         assertEquals(setOf(cellAgent.network), addressV6_1.getNetworks())
@@ -465,4 +502,244 @@ class CSDestroySocketTest : CSTest() {
         // Verify mIpToNetworksMap is empty.
         assertTrue(ipToNetworksMap.isEmpty())
     }
+
+    @Test
+    fun testDestroySocketForRemovedIpAddressFromSingleNetwork() {
+        val inOrder = inOrder(destroySocketsWrapper)
+        val addressV6_1 = InetAddress.getByName("2100::1234")
+        val addressV6_2 = InetAddress.getByName("2100:0207::4321:1234")
+        // add a test network.
+        val (agent1, callback1) = prepareNetworkAgent(
+            "wlan2",
+            arrayListOf(addressV6_1.toLinkAddress()),
+            makeNc(transportType = TRANSPORT_WIFI)
+        )
+
+        // IP address changed
+        val linkProperties2 = makeLp("wlan2")
+        linkProperties2.addLinkAddress(LinkAddress(addressV6_2, 64))
+        agent1.sendLinkProperties(linkProperties2)
+        callback1.eventuallyExpect<LinkPropertiesChanged> {
+            it.network == agent1.network && !it.lp.addresses.contains(addressV6_1)
+        }
+        // verify destroy sockets on the removed IP address
+        inOrder.verify(destroySocketsWrapper).destroyLiveTcpSocketsByLocalAddress(
+            addressV6_1,
+            setOf(Range.create(MIN_NET_ID, MAX_NET_ID)),
+            null
+        )
+
+        // network disconnect
+        agent1.disconnect()
+        agent1.eventuallyExpect<OnNetworkDestroyed>()
+        // verify destroy sockets on the removed IP address
+        inOrder.verify(destroySocketsWrapper).destroyLiveTcpSocketsByLocalAddress(
+            addressV6_2,
+            setOf(Range.create(MIN_NET_ID, MAX_NET_ID)),
+            null
+        )
+        inOrder.verifyNoMoreInteractions()
+    }
+
+    @Test
+    fun testDestroySocketForRemovedIpAddressFromMultipleNonVpnNetworks() {
+        val inOrder = inOrder(destroySocketsWrapper)
+        val addressV6_1 = InetAddress.getByName("2100::1234")
+        val addressV6_2 = InetAddress.getByName("2100:0207::4321:1234")
+        val addressV6LinkLocal = InetAddress.getByName("FE80::1234")
+        val addressV4_1 = InetAddress.getByName("203.0.113.10")
+
+        // add 4 test networks(non VPN). 3 have a same IP address, and 1 network has different one.
+        val (cellAgent, cellCallback) = prepareNetworkAgent(
+            "rmnet1",
+            arrayListOf(addressV6_1.toLinkAddress(), addressV4_1.toLinkAddress()),
+            makeNc(transportType = TRANSPORT_CELLULAR)
+        )
+
+        val (wlanAgent, wlanCallback) = prepareNetworkAgent(
+            "wlan0",
+            arrayListOf(),
+            makeNc(transportType = TRANSPORT_WIFI)
+        )
+
+        val (testAgent, testCallback) = prepareNetworkAgent(
+            "test2",
+            arrayListOf(addressV6_2.toLinkAddress()),
+            makeNc(transportType = TRANSPORT_TEST)
+        )
+
+        val (ethAgent, ethCallback) = prepareNetworkAgent(
+            "eth1",
+            arrayListOf(addressV6_1.toLinkAddress()),
+            makeNc(transportType = TRANSPORT_ETHERNET)
+        )
+
+        // Add IP addresses on network#2
+        val linkProperties = makeLp("wlan0")
+        linkProperties.addLinkAddress(addressV6LinkLocal.toLinkAddress())
+        linkProperties.addLinkAddress(addressV6_1.toLinkAddress())
+        wlanAgent.sendLinkProperties(linkProperties)
+
+        // Remove IP addresses network#1
+        val linkProperties1 = makeLp("rmnet1")
+        cellAgent.sendLinkProperties(linkProperties1)
+        cellCallback.eventuallyExpect<LinkPropertiesChanged> {
+            it.network == cellAgent.network && it.lp.addresses.size == 0
+        }
+
+        // verify destroy sockets on the removed IP address and exempt netId lists.
+        inOrder.verify(destroySocketsWrapper).destroyLiveTcpSocketsByLocalAddress(
+            addressV6_1,
+            setOf(
+                Range.create(MIN_NET_ID, wlanAgent.network.netId - 1),
+                Range.create(wlanAgent.network.netId + 1, ethAgent.network.netId - 1),
+                Range.create(ethAgent.network.netId + 1, MAX_NET_ID)
+            ),
+            null
+        )
+        // verify destroy sockets on the removed IP address
+        inOrder.verify(destroySocketsWrapper).destroyLiveTcpSocketsByLocalAddress(
+            addressV4_1,
+            setOf(Range.create(MIN_NET_ID, MAX_NET_ID)),
+            null
+        )
+
+        // Remove IP addresses from network#2
+        val linkProperties2 = makeLp("wlan3")
+        wlanAgent.sendLinkProperties(linkProperties2)
+        wlanCallback.eventuallyExpect<LinkPropertiesChanged> {
+            it.network == wlanAgent.network && it.lp.interfaceName == "wlan3"
+        }
+        // verify destroy sockets on the removed IP address and exempt netId lists.
+        inOrder.verify(destroySocketsWrapper).destroyLiveTcpSocketsByLocalAddress(
+            addressV6_1,
+            setOf(
+                Range.create(MIN_NET_ID, ethAgent.network.netId - 1),
+                Range.create(ethAgent.network.netId + 1, MAX_NET_ID)
+            ),
+            null
+        )
+        // verify not to destroy sockets on the link local address at NetworkAgent update.
+        inOrder.verify(destroySocketsWrapper, never()).destroyLiveTcpSocketsByLocalAddress(
+            addressV6LinkLocal,
+            setOf(Range.create(MIN_NET_ID, MAX_NET_ID)),
+            null
+        )
+
+        // disconnect all test networks
+        cellAgent.disconnect()
+        wlanAgent.disconnect()
+        testAgent.disconnect()
+        ethAgent.disconnect()
+        ethAgent.eventuallyExpect<OnNetworkDestroyed>()
+
+        // verify destroy sockets on the removed IP address
+        inOrder.verify(destroySocketsWrapper).destroyLiveTcpSocketsByLocalAddress(
+            addressV6_2,
+            setOf(Range.create(MIN_NET_ID, MAX_NET_ID)),
+            null
+        )
+        inOrder.verify(destroySocketsWrapper).destroyLiveTcpSocketsByLocalAddress(
+            addressV6_1,
+            setOf(Range.create(MIN_NET_ID, MAX_NET_ID)),
+            null
+        )
+    }
+
+    @Test
+    fun testDestroySocketForRemovedIpAddressFromMultipleVpnNetworks() {
+        val inOrder = inOrder(destroySocketsWrapper)
+        val addressV6_1 = InetAddress.getByName("2100::1234")
+        val addressV6_2 = InetAddress.getByName("2100:0207::4321:1234")
+        val addressV6_3 = InetAddress.getByName("2234:0207::1234:4321")
+        val addressV6LinkLocal = InetAddress.getByName("FE80::1234")
+        val addressV4_1 = InetAddress.getByName("203.0.113.10")
+        // add 3 VPN test networks and 1 non-VPN network.
+
+        val (vpnAgent1, vpnCallback1) = prepareNetworkAgent(
+            "ipsec1",
+            arrayListOf(addressV6_1.toLinkAddress(), addressV4_1.toLinkAddress()),
+            vpnNc(setOf(TEST_UID_RANGE1))
+        )
+
+        val (vpnAgent2, vpnCallback2) = prepareNetworkAgent(
+            "ipsec2",
+            arrayListOf(addressV6LinkLocal.toLinkAddress(), addressV6_1.toLinkAddress()),
+            vpnNc(setOf(TEST_UID_RANGE2))
+        )
+        val (vpnAgent3, vpnCallback3) = prepareNetworkAgent(
+            "ipsec3",
+            arrayListOf(addressV6_1.toLinkAddress()),
+            vpnNc(setOf(TEST_UID_RANGE3))
+        )
+        val (testAgent, testCallback) = prepareNetworkAgent(
+            "test4",
+            arrayListOf(addressV6_2.toLinkAddress(), addressV4_1.toLinkAddress()),
+            makeNc(TRANSPORT_TEST)
+        )
+        // Remove IP addresses network#1
+        val linkProperties1 = makeLp("ipsec21")
+        vpnAgent1.sendLinkProperties(linkProperties1)
+        vpnCallback1.eventuallyExpect<LinkPropertiesChanged> {
+            it.network == vpnAgent1.network && it.lp.interfaceName == "ipsec21"
+        }
+        // verify destroy sockets on the removed IP address(TEST_IPV6_ADDRESS1) and VPN's uid range.
+        inOrder.verify(destroySocketsWrapper).destroyLiveTcpSocketsByLocalAddress(
+            addressV6_1,
+            setOf(Range.create(MIN_NET_ID, MAX_NET_ID)),
+            vpnAgent1.nc.uids
+        )
+        // verify destroy sockets on the removed IP address(TEST_IPV4_ADDRESS1). network#1 and
+        // network#4 use TEST_IPV4_ADDRESS1, however network#4 is not VPN network, so we destroy
+        // sockets only based on the removed IP address.
+        inOrder.verify(destroySocketsWrapper).destroyLiveTcpSocketsByLocalAddress(
+            addressV4_1,
+            setOf(Range.create(MIN_NET_ID, MAX_NET_ID)),
+            null
+        )
+
+        // Change IP addresses network#2
+        val linkProperties2 = makeLp("ipsec2")
+        linkProperties2.addLinkAddress(LinkAddress(addressV6_3, 64))
+        vpnAgent2.sendLinkProperties(linkProperties2)
+        vpnCallback2.eventuallyExpect<LinkPropertiesChanged> { it.network == vpnAgent2.network &&
+                it.lp.interfaceName == "ipsec2" && it.lp.addresses.contains(addressV6_3)
+        }
+        // verify destroy sockets on the removed IP address(TEST_IPV6_ADDRESS1) and VPN's uid range.
+        inOrder.verify(destroySocketsWrapper).destroyLiveTcpSocketsByLocalAddress(
+            addressV6_1,
+            setOf(Range.create(MIN_NET_ID, MAX_NET_ID)),
+            vpnAgent2.nc.uids
+        )
+        // verify not to destroy sockets on the link local address at NetworkAgent update.
+        inOrder.verify(destroySocketsWrapper, never()).destroyLiveTcpSocketsByLocalAddress(
+            addressV6LinkLocal,
+            setOf(Range.create(MIN_NET_ID, MAX_NET_ID)),
+            null
+        )
+
+        // disconnect all test networks
+        vpnAgent1.disconnect()
+        vpnAgent2.disconnect()
+        vpnAgent3.disconnect()
+        testAgent.disconnect()
+        testAgent.eventuallyExpect<OnNetworkDestroyed>()
+
+        // verify destroy sockets on the removed IP address.
+        inOrder.verify(destroySocketsWrapper).destroyLiveTcpSocketsByLocalAddress(
+            addressV6_3,
+            setOf(Range.create(MIN_NET_ID, MAX_NET_ID)),
+            null
+        )
+        inOrder.verify(destroySocketsWrapper).destroyLiveTcpSocketsByLocalAddress(
+            addressV6_2,
+            setOf(Range.create(MIN_NET_ID, MAX_NET_ID)),
+            null
+        )
+        inOrder.verify(destroySocketsWrapper).destroyLiveTcpSocketsByLocalAddress(
+            addressV4_1,
+            setOf(Range.create(MIN_NET_ID, MAX_NET_ID)),
+            null
+        )
+    }
 }
diff --git a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
index 0f3e70c00b..ce2869669f 100644
--- a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
@@ -61,6 +61,7 @@ import android.permission.PermissionManager.PermissionResult
 import android.telephony.SubscriptionManager
 import android.telephony.TelephonyManager
 import android.testing.TestableContext
+import android.util.Range
 import android.util.SparseArray
 import androidx.test.platform.app.InstrumentationRegistry
 import com.android.internal.app.IBatteryStats
@@ -84,6 +85,7 @@ import com.android.server.connectivity.QuicConnectionCloser
 import com.android.server.connectivity.SatelliteAccessController
 import com.android.testutils.visibleOnHandlerThread
 import com.android.testutils.waitForIdle
+import java.net.InetAddress
 import java.util.concurrent.Executors
 import java.util.concurrent.LinkedBlockingQueue
 import java.util.concurrent.TimeUnit
@@ -287,8 +289,14 @@ open class CSTest {
     }
 
     // Class to be mocked and used to verify destroy sockets methods call
+    // TODO: Move to use TestableCallback-style object with a TrackRecord inside to check.
     open inner class DestroySocketsWrapper {
         open fun destroyLiveTcpSocketsByOwnerUids(ownerUids: Set<Int>) {}
+        open fun destroyLiveTcpSocketsByLocalAddress(
+            address: InetAddress,
+            netIdRange: Set<Range<Int>>?,
+            uidRanges: Set<Range<Int>>?
+        ) {}
     }
 
     inner class CSDeps : ConnectivityService.Dependencies() {
@@ -429,6 +437,20 @@ open class CSTest {
         ): QuicConnectionCloser = quicConnectionCloser
 
         override fun flagConnectivityServiceDestroySocket() = true
+
+        override fun destroyLiveTcpSocketsByLocalAddress(
+            address: InetAddress,
+            netIdRange: Set<Range<Int>>?,
+            uidRanges: Set<Range<Int>>?
+        ) {
+            // Call mocked destroyLiveTcpSocketsByLocalAddress so that test can verify this method
+            // call
+            destroySocketsWrapper.destroyLiveTcpSocketsByLocalAddress(
+                address,
+                netIdRange,
+                uidRanges
+            )
+        }
     }
 
     inner class PermDeps : PermissionMonitor.Dependencies() {

From fe1f5cbf32750bd2bd7f4a782816f3d3a2314dfd Mon Sep 17 00:00:00 2001
From: Sewook Seo <sewookseo@google.com>
Date: Thu, 21 Nov 2024 01:11:04 +0000
Subject: [PATCH 319/377] Destroy sockets with nlmsg RTM_DELADDR

Destroy sockets that matched to netId less than MIN_NET_ID for the non
link local address in RTM_DELADDR.
Destroy sockets on link local address with the corresponding interface
ID.

Bug: 373280981
Bug: 331139818
Flag: android.net.platform.flags.connectivity_service_destroy_socket
Test: atest ConnectivityCoverageTests
Test: device test
Change-Id: I4d8127fc693f8b32f815c5cddbae0b64deeb23e5
---
 .../android/server/ConnectivityService.java   |  93 ++++++++++++++-
 .../CSDestroySocketTest.kt                    | 106 ++++++++++++++----
 .../server/connectivityservice/base/CSTest.kt |  30 ++++-
 3 files changed, 208 insertions(+), 21 deletions(-)

diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index 8d2c06e43a..98c8368168 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -313,6 +313,7 @@ import android.stats.connectivity.RequestType;
 import android.stats.connectivity.ValidatedState;
 import android.sysprop.NetworkProperties;
 import android.system.ErrnoException;
+import android.system.OsConstants;
 import android.telephony.SubscriptionManager;
 import android.telephony.TelephonyManager;
 import android.text.TextUtils;
@@ -358,8 +359,14 @@ import com.android.net.module.util.LocationPermissionChecker;
 import com.android.net.module.util.PerUidCounter;
 import com.android.net.module.util.PermissionUtils;
 import com.android.net.module.util.RoutingCoordinatorService;
+import com.android.net.module.util.SharedLog;
 import com.android.net.module.util.TcUtils;
+import com.android.net.module.util.ip.NetlinkMonitor;
 import com.android.net.module.util.netlink.InetDiagMessage;
+import com.android.net.module.util.netlink.NetlinkConstants;
+import com.android.net.module.util.netlink.NetlinkMessage;
+import com.android.net.module.util.netlink.RtNetlinkAddressMessage;
+import com.android.net.module.util.netlink.StructIfaddrMsg;
 import com.android.networkstack.apishim.BroadcastOptionsShimImpl;
 import com.android.networkstack.apishim.ConstantsShim;
 import com.android.networkstack.apishim.common.BroadcastOptionsShim;
@@ -1138,6 +1145,8 @@ public class ConnectivityService extends IConnectivityManager.Stub
 
     // A map from IP address to networks. Only the handler thread is allowed to access this field.
     @Nullable @VisibleForTesting final Map<InetAddress, Set<NetworkAgentInfo>> mIpToNetworksMap;
+    // NetlinkMonitor for ConnectivityService
+    @Nullable private final AddressUpdateMonitor mAddressUpdateMonitor;
 
     /**
      * Implements support for the legacy "one network per network type" model.
@@ -1484,6 +1493,28 @@ public class ConnectivityService extends IConnectivityManager.Stub
         }
     }
 
+    /**
+     * Simple NetlinkMonitor. Listen for address changed events from kernel.
+     * All methods except the constructor must be called on the handler thread.
+     */
+    public static class AddressUpdateMonitor extends NetlinkMonitor {
+        private final Consumer<NetlinkMessage> mNetlinkMessageConsumer;
+
+        AddressUpdateMonitor(Handler h, SharedLog log, String tag,
+                Consumer<NetlinkMessage> netlinkMessageConsumer) {
+            super(h, log, tag, OsConstants.NETLINK_ROUTE,
+                    (NetlinkConstants.RTMGRP_IPV4_IFADDR
+                            | NetlinkConstants.RTMGRP_IPV6_IFADDR));
+            mNetlinkMessageConsumer = netlinkMessageConsumer;
+        }
+
+        @Override
+        protected void processNetlinkMessage(
+                @NonNull NetlinkMessage nlMsg, long whenMs) {
+            mNetlinkMessageConsumer.accept(nlMsg);
+        }
+    }
+
     /**
      * Dependencies of ConnectivityService, for injection in tests.
      */
@@ -1859,6 +1890,18 @@ public class ConnectivityService extends IConnectivityManager.Stub
             InetDiagMessage.destroyLiveTcpSocketsByLocalAddress(address, netIdRange, uidRanges);
         }
 
+        /**
+         * Destroy live tcp sockets for IP addresses with conditions.
+         *
+         * @param address a local address to destroy sockets
+         * @param interfaceId interface ID
+         */
+        public void destroyLiveTcpSocketsByLocalAddress(
+                @NonNull InetAddress address, int interfaceId)
+                throws SocketException, InterruptedIOException, ErrnoException {
+            InetDiagMessage.destroyLiveTcpSocketsByLocalAddress(address, interfaceId);
+        }
+
         /**
          * Schedule the evaluation timeout.
          *
@@ -1888,6 +1931,15 @@ public class ConnectivityService extends IConnectivityManager.Stub
         public boolean flagConnectivityServiceDestroySocket() {
             return Flags.connectivityServiceDestroySocket();
         }
+
+        /**
+         * Create a AddressUpdateMonitor instance.
+         */
+        public AddressUpdateMonitor makeAddressUpdateMonitor(
+                @NonNull Handler h, @NonNull SharedLog log, @NonNull String tag,
+                @NonNull Consumer<NetlinkMessage> consumer) {
+            return new AddressUpdateMonitor(h, log, tag, consumer);
+        }
     }
 
     public ConnectivityService(Context context) {
@@ -2024,8 +2076,12 @@ public class ConnectivityService extends IConnectivityManager.Stub
 
         if (mDeps.flagConnectivityServiceDestroySocket()) {
             mIpToNetworksMap = new HashMap<>();
+            mAddressUpdateMonitor = mDeps.makeAddressUpdateMonitor(
+                    mHandler, new SharedLog(20, TAG), TAG,
+                    this::processNetlinkAddressUpdateMessage);
         } else {
             mIpToNetworksMap = null;
+            mAddressUpdateMonitor = null;
         }
         // To ensure uid state is synchronized with Network Policy, register for
         // NetworkPolicyManagerService events must happen prior to NetworkPolicyManagerService
@@ -4231,6 +4287,9 @@ public class ConnectivityService extends IConnectivityManager.Stub
             mBroadcastReceiveHelper.callOnUserAddedForExistingUsers();
             permissionMonitorInitializeDone.open();
         });
+        if (mAddressUpdateMonitor != null) {
+            mHandler.post(() -> mAddressUpdateMonitor.start());
+        }
         mProxyTracker.loadGlobalProxy();
         registerDnsResolverUnsolicitedEventListener();
 
@@ -9993,7 +10052,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
         }
         try {
             mDeps.destroyLiveTcpSocketsByLocalAddress(address, netIdRangeSet, uidRangeSet);
-        } catch (Exception e) {
+        } catch (SocketException | InterruptedIOException | ErrnoException e) {
             loge("Exception destroy TCP sockets on local address: ", e);
         }
     }
@@ -15478,4 +15537,36 @@ public class ConnectivityService extends IConnectivityManager.Stub
         mQuicConnectionCloser.unregisterQuicConnectionClosePayload(pfd);
     }
 
+    // Currently this only handles message type RTM_DELADDR to destroy sockets for the deleted
+    // address, we could make this a dispatcher method if we have more use cases in the future.
+    private void processNetlinkAddressUpdateMessage(NetlinkMessage nlMsg) {
+        if (!(nlMsg instanceof RtNetlinkAddressMessage msg)) {
+            return;
+        }
+        if (msg.getHeader().nlmsg_type != NetlinkConstants.RTM_DELADDR) {
+            return;
+        }
+
+        final StructIfaddrMsg ifaddrMsg = msg.getIfaddrHeader();
+        final InetAddress removedAddress = msg.getIpAddress();
+        if (removedAddress instanceof Inet6Address && removedAddress.isLinkLocalAddress()) {
+            try {
+                mDeps.destroyLiveTcpSocketsByLocalAddress(removedAddress, ifaddrMsg.index);
+            } catch (SocketException | InterruptedIOException | ErrnoException e) {
+                loge("Exception destroying TCP sockets on local address with interfaceId: ", e);
+            }
+        } else {
+            // Range of netId for networks that ConnectivityService isn't aware of. OEM & legacy
+            // local networks are included in this scope.
+            try {
+                mDeps.destroyLiveTcpSocketsByLocalAddress(
+                        removedAddress,
+                        Set.of(Range.create(0, MIN_NET_ID - 1)), null /* uidRanges */
+                );
+            } catch (SocketException | InterruptedIOException | ErrnoException e) {
+                loge("Exception destroy TCP sockets on local address: ", e);
+            }
+        }
+
+    }
 }
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSDestroySocketTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSDestroySocketTest.kt
index 4b37d86852..ee8c521055 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSDestroySocketTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSDestroySocketTest.kt
@@ -43,6 +43,10 @@ import android.net.VpnTransportInfo
 import android.os.Build
 import android.util.Range
 import com.android.net.module.util.BaseNetdUnsolicitedEventListener
+import com.android.net.module.util.netlink.NetlinkConstants
+import com.android.net.module.util.netlink.RtNetlinkAddressMessage
+import com.android.net.module.util.netlink.StructIfaddrMsg
+import com.android.net.module.util.netlink.StructNlMsgHdr
 import com.android.server.NetIdManager.MAX_NET_ID
 import com.android.server.NetIdManager.MIN_NET_ID
 import com.android.server.connectivity.ConnectivityFlags.DELAY_DESTROY_SOCKETS
@@ -61,9 +65,12 @@ import org.junit.Test
 import org.junit.runner.RunWith
 import org.mockito.ArgumentCaptor
 import org.mockito.Mockito.any
+import org.mockito.Mockito.anyInt
 import org.mockito.Mockito.doReturn
 import org.mockito.Mockito.inOrder
 import org.mockito.Mockito.never
+import org.mockito.Mockito.timeout
+import org.mockito.Mockito.times
 import org.mockito.Mockito.verify
 
 private const val TIMESTAMP = 1234L
@@ -505,7 +512,6 @@ class CSDestroySocketTest : CSTest() {
 
     @Test
     fun testDestroySocketForRemovedIpAddressFromSingleNetwork() {
-        val inOrder = inOrder(destroySocketsWrapper)
         val addressV6_1 = InetAddress.getByName("2100::1234")
         val addressV6_2 = InetAddress.getByName("2100:0207::4321:1234")
         // add a test network.
@@ -523,7 +529,7 @@ class CSDestroySocketTest : CSTest() {
             it.network == agent1.network && !it.lp.addresses.contains(addressV6_1)
         }
         // verify destroy sockets on the removed IP address
-        inOrder.verify(destroySocketsWrapper).destroyLiveTcpSocketsByLocalAddress(
+        verify(destroySocketsWrapper).destroyLiveTcpSocketsByLocalAddress(
             addressV6_1,
             setOf(Range.create(MIN_NET_ID, MAX_NET_ID)),
             null
@@ -533,17 +539,16 @@ class CSDestroySocketTest : CSTest() {
         agent1.disconnect()
         agent1.eventuallyExpect<OnNetworkDestroyed>()
         // verify destroy sockets on the removed IP address
-        inOrder.verify(destroySocketsWrapper).destroyLiveTcpSocketsByLocalAddress(
+        verify(destroySocketsWrapper).destroyLiveTcpSocketsByLocalAddress(
             addressV6_2,
             setOf(Range.create(MIN_NET_ID, MAX_NET_ID)),
             null
         )
-        inOrder.verifyNoMoreInteractions()
+        verify(destroySocketsWrapper, never()).destroyLiveTcpSocketsByLocalAddress(any(), anyInt())
     }
 
     @Test
     fun testDestroySocketForRemovedIpAddressFromMultipleNonVpnNetworks() {
-        val inOrder = inOrder(destroySocketsWrapper)
         val addressV6_1 = InetAddress.getByName("2100::1234")
         val addressV6_2 = InetAddress.getByName("2100:0207::4321:1234")
         val addressV6LinkLocal = InetAddress.getByName("FE80::1234")
@@ -588,7 +593,7 @@ class CSDestroySocketTest : CSTest() {
         }
 
         // verify destroy sockets on the removed IP address and exempt netId lists.
-        inOrder.verify(destroySocketsWrapper).destroyLiveTcpSocketsByLocalAddress(
+        verify(destroySocketsWrapper).destroyLiveTcpSocketsByLocalAddress(
             addressV6_1,
             setOf(
                 Range.create(MIN_NET_ID, wlanAgent.network.netId - 1),
@@ -598,7 +603,7 @@ class CSDestroySocketTest : CSTest() {
             null
         )
         // verify destroy sockets on the removed IP address
-        inOrder.verify(destroySocketsWrapper).destroyLiveTcpSocketsByLocalAddress(
+        verify(destroySocketsWrapper).destroyLiveTcpSocketsByLocalAddress(
             addressV4_1,
             setOf(Range.create(MIN_NET_ID, MAX_NET_ID)),
             null
@@ -611,7 +616,7 @@ class CSDestroySocketTest : CSTest() {
             it.network == wlanAgent.network && it.lp.interfaceName == "wlan3"
         }
         // verify destroy sockets on the removed IP address and exempt netId lists.
-        inOrder.verify(destroySocketsWrapper).destroyLiveTcpSocketsByLocalAddress(
+        verify(destroySocketsWrapper).destroyLiveTcpSocketsByLocalAddress(
             addressV6_1,
             setOf(
                 Range.create(MIN_NET_ID, ethAgent.network.netId - 1),
@@ -620,7 +625,7 @@ class CSDestroySocketTest : CSTest() {
             null
         )
         // verify not to destroy sockets on the link local address at NetworkAgent update.
-        inOrder.verify(destroySocketsWrapper, never()).destroyLiveTcpSocketsByLocalAddress(
+        verify(destroySocketsWrapper, never()).destroyLiveTcpSocketsByLocalAddress(
             addressV6LinkLocal,
             setOf(Range.create(MIN_NET_ID, MAX_NET_ID)),
             null
@@ -634,21 +639,21 @@ class CSDestroySocketTest : CSTest() {
         ethAgent.eventuallyExpect<OnNetworkDestroyed>()
 
         // verify destroy sockets on the removed IP address
-        inOrder.verify(destroySocketsWrapper).destroyLiveTcpSocketsByLocalAddress(
+        verify(destroySocketsWrapper).destroyLiveTcpSocketsByLocalAddress(
             addressV6_2,
             setOf(Range.create(MIN_NET_ID, MAX_NET_ID)),
             null
         )
-        inOrder.verify(destroySocketsWrapper).destroyLiveTcpSocketsByLocalAddress(
+        verify(destroySocketsWrapper).destroyLiveTcpSocketsByLocalAddress(
             addressV6_1,
             setOf(Range.create(MIN_NET_ID, MAX_NET_ID)),
             null
         )
+        verify(destroySocketsWrapper, never()).destroyLiveTcpSocketsByLocalAddress(any(), anyInt())
     }
 
     @Test
     fun testDestroySocketForRemovedIpAddressFromMultipleVpnNetworks() {
-        val inOrder = inOrder(destroySocketsWrapper)
         val addressV6_1 = InetAddress.getByName("2100::1234")
         val addressV6_2 = InetAddress.getByName("2100:0207::4321:1234")
         val addressV6_3 = InetAddress.getByName("2234:0207::1234:4321")
@@ -684,7 +689,7 @@ class CSDestroySocketTest : CSTest() {
             it.network == vpnAgent1.network && it.lp.interfaceName == "ipsec21"
         }
         // verify destroy sockets on the removed IP address(TEST_IPV6_ADDRESS1) and VPN's uid range.
-        inOrder.verify(destroySocketsWrapper).destroyLiveTcpSocketsByLocalAddress(
+        verify(destroySocketsWrapper).destroyLiveTcpSocketsByLocalAddress(
             addressV6_1,
             setOf(Range.create(MIN_NET_ID, MAX_NET_ID)),
             vpnAgent1.nc.uids
@@ -692,7 +697,7 @@ class CSDestroySocketTest : CSTest() {
         // verify destroy sockets on the removed IP address(TEST_IPV4_ADDRESS1). network#1 and
         // network#4 use TEST_IPV4_ADDRESS1, however network#4 is not VPN network, so we destroy
         // sockets only based on the removed IP address.
-        inOrder.verify(destroySocketsWrapper).destroyLiveTcpSocketsByLocalAddress(
+        verify(destroySocketsWrapper).destroyLiveTcpSocketsByLocalAddress(
             addressV4_1,
             setOf(Range.create(MIN_NET_ID, MAX_NET_ID)),
             null
@@ -706,13 +711,13 @@ class CSDestroySocketTest : CSTest() {
                 it.lp.interfaceName == "ipsec2" && it.lp.addresses.contains(addressV6_3)
         }
         // verify destroy sockets on the removed IP address(TEST_IPV6_ADDRESS1) and VPN's uid range.
-        inOrder.verify(destroySocketsWrapper).destroyLiveTcpSocketsByLocalAddress(
+        verify(destroySocketsWrapper).destroyLiveTcpSocketsByLocalAddress(
             addressV6_1,
             setOf(Range.create(MIN_NET_ID, MAX_NET_ID)),
             vpnAgent2.nc.uids
         )
         // verify not to destroy sockets on the link local address at NetworkAgent update.
-        inOrder.verify(destroySocketsWrapper, never()).destroyLiveTcpSocketsByLocalAddress(
+        verify(destroySocketsWrapper, never()).destroyLiveTcpSocketsByLocalAddress(
             addressV6LinkLocal,
             setOf(Range.create(MIN_NET_ID, MAX_NET_ID)),
             null
@@ -726,20 +731,83 @@ class CSDestroySocketTest : CSTest() {
         testAgent.eventuallyExpect<OnNetworkDestroyed>()
 
         // verify destroy sockets on the removed IP address.
-        inOrder.verify(destroySocketsWrapper).destroyLiveTcpSocketsByLocalAddress(
+        verify(destroySocketsWrapper).destroyLiveTcpSocketsByLocalAddress(
             addressV6_3,
             setOf(Range.create(MIN_NET_ID, MAX_NET_ID)),
             null
         )
-        inOrder.verify(destroySocketsWrapper).destroyLiveTcpSocketsByLocalAddress(
+        verify(destroySocketsWrapper).destroyLiveTcpSocketsByLocalAddress(
             addressV6_2,
             setOf(Range.create(MIN_NET_ID, MAX_NET_ID)),
             null
         )
-        inOrder.verify(destroySocketsWrapper).destroyLiveTcpSocketsByLocalAddress(
+        verify(destroySocketsWrapper, times(2)).destroyLiveTcpSocketsByLocalAddress(
             addressV4_1,
             setOf(Range.create(MIN_NET_ID, MAX_NET_ID)),
             null
         )
+        verify(destroySocketsWrapper, never()).destroyLiveTcpSocketsByLocalAddress(any(), anyInt())
+    }
+
+    @Test
+    fun testDestroySocketWithNetlinkMessageForLinkLocalAddress() {
+        val addressV6LinkLocal = InetAddress.getByName("FE80::1234")
+        val testInterfaceId = 10
+        val nlMsgLinkLocalAddressRemoved = RtNetlinkAddressMessage(
+            StructNlMsgHdr(
+                30 /* payload length */,
+                NetlinkConstants.RTM_DELADDR,
+                0 /* flages */,
+                0 /* seq */
+            ),
+            StructIfaddrMsg(
+                10 /* family */,
+                64 /* prefix length */,
+                0 /* flags */,
+                0 /* scope */,
+                testInterfaceId /* interfaceId */
+            ),
+            addressV6LinkLocal,
+            null,
+            0 /* flags */
+        )
+        csHandler.post{deps.netlinkMessageUpdate?.accept(nlMsgLinkLocalAddressRemoved)}
+
+        // verify destroy a socket on link local address with corresponding interface ID.
+        verify(destroySocketsWrapper, timeout(100)).destroyLiveTcpSocketsByLocalAddress(
+            addressV6LinkLocal,
+            testInterfaceId
+        )
+    }
+
+    @Test
+    fun testDestroySocketWithNetlinkMessageForOemNetwork() {
+        val addressV4 = InetAddress.getByName("203.0.113.10")
+        val nlMsgAddressRemoved = RtNetlinkAddressMessage(
+            StructNlMsgHdr(
+                30 /* payload length */,
+                NetlinkConstants.RTM_DELADDR,
+                0 /* flags */,
+                0 /* seq */
+            ),
+            StructIfaddrMsg(
+                10 /* family */,
+                64 /* prefix length */,
+                0 /* flags */,
+                0 /* scope */,
+                5 /* interfaceId */
+            ),
+            addressV4,
+            null,
+            0 /* flags */
+        )
+        csHandler.post{deps.netlinkMessageUpdate?.accept(nlMsgAddressRemoved)}
+
+        // verify destroy non platform socket(netId < MIN_NET_ID) with the RTM_DELADDR message
+        verify(destroySocketsWrapper, timeout(100)).destroyLiveTcpSocketsByLocalAddress(
+            addressV4,
+            setOf(Range.create(0, MIN_NET_ID - 1)),
+            null /* uidRanges */
+        )
     }
 }
diff --git a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
index ce2869669f..6fa420638d 100644
--- a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
@@ -68,6 +68,8 @@ import com.android.internal.app.IBatteryStats
 import com.android.internal.util.test.BroadcastInterceptingContext
 import com.android.modules.utils.build.SdkLevel
 import com.android.net.module.util.ArrayTrackRecord
+import com.android.net.module.util.SharedLog
+import com.android.net.module.util.netlink.NetlinkMessage
 import com.android.networkstack.apishim.common.UnsupportedApiLevelException
 import com.android.server.connectivity.AutomaticOnOffKeepaliveTracker
 import com.android.server.connectivity.CarrierPrivilegeAuthenticator
@@ -90,6 +92,7 @@ import java.util.concurrent.Executors
 import java.util.concurrent.LinkedBlockingQueue
 import java.util.concurrent.TimeUnit
 import java.util.function.BiConsumer
+import java.util.function.Consumer
 import kotlin.annotation.AnnotationRetention.RUNTIME
 import kotlin.annotation.AnnotationTarget.FUNCTION
 import kotlin.test.assertNotNull
@@ -297,6 +300,10 @@ open class CSTest {
             netIdRange: Set<Range<Int>>?,
             uidRanges: Set<Range<Int>>?
         ) {}
+        open fun destroyLiveTcpSocketsByLocalAddress(
+            address: InetAddress?,
+            interfaceId: Int
+        ) {}
     }
 
     inner class CSDeps : ConnectivityService.Dependencies() {
@@ -323,7 +330,6 @@ open class CSTest {
                 listener: BiConsumer<Int, Int>,
                 handler: Handler
         ) = if (SdkLevel.isAtLeastT()) mock<CarrierPrivilegeAuthenticator>() else null
-
         var satelliteNetworkFallbackUidUpdate = BiConsumer<Set<Int>, Set<Int>> {_, _ -> }
         override fun makeSatelliteAccessController(
             context: Context,
@@ -451,6 +457,28 @@ open class CSTest {
                 uidRanges
             )
         }
+
+        override fun destroyLiveTcpSocketsByLocalAddress(
+            address: InetAddress,
+            interfaceId: Int
+        ) {
+            // Call mocked destroyLiveTcpSocketsByLocalAddress so that test can verify this method
+            // call
+            destroySocketsWrapper.destroyLiveTcpSocketsByLocalAddress(
+                address,
+                interfaceId
+            )
+        }
+        var netlinkMessageUpdate = Consumer<NetlinkMessage> {_ -> }
+        override fun makeAddressUpdateMonitor(
+            h: Handler,
+            log: SharedLog,
+            tag: String,
+            consumer: Consumer<NetlinkMessage>
+        ): ConnectivityService.AddressUpdateMonitor {
+            netlinkMessageUpdate = consumer
+            return ConnectivityService.AddressUpdateMonitor(h, log, tag, consumer)
+        }
     }
 
     inner class PermDeps : PermissionMonitor.Dependencies() {

From 34ef7dbd1b3709c5db5aad0582bc01775b3b3f54 Mon Sep 17 00:00:00 2001
From: Sewook Seo <sewookseo@google.com>
Date: Thu, 21 Nov 2024 04:51:27 +0000
Subject: [PATCH 320/377] Destroy sockets lacking permission at CS.

Move destroying socket logic for lacking permission to CS from netd

Bug: 373280981
Bug: 331139818
Flag: android.net.platform.flags.connectivity_service_destroy_socket
Test: atest ConnectivityCoverageTests
Test: device test

Change-Id: Id933d51d6175958a1b78443360858db577319622
---
 .../android/server/ConnectivityService.java   | 50 ++++++++++++
 .../CSDestroySocketTest.kt                    | 80 ++++++++++++++++---
 .../base/CSAgentWrapper.kt                    |  1 +
 .../server/connectivityservice/base/CSTest.kt | 15 ++++
 4 files changed, 135 insertions(+), 11 deletions(-)

diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index 98c8368168..ee58c70b9e 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -1902,6 +1902,18 @@ public class ConnectivityService extends IConnectivityManager.Stub
             InetDiagMessage.destroyLiveTcpSocketsByLocalAddress(address, interfaceId);
         }
 
+        /**
+         * Call {@link InetDiagMessage#destroyLiveTcpSocketsLackingPermission(int, int)}
+         *
+         * @param netId network ID
+         * @param permission network permission
+         */
+        public void destroyLiveTcpSocketsLackingPermission(
+                int netId, int permission)
+                throws SocketException, InterruptedIOException, ErrnoException {
+            InetDiagMessage.destroyLiveTcpSocketsLackingPermission(netId, permission);
+        }
+
         /**
          * Schedule the evaluation timeout.
          *
@@ -5820,8 +5832,14 @@ public class ConnectivityService extends IConnectivityManager.Stub
 
         // Delayed teardown.
         if (nai.isCreated() && !nai.isDestroyed()) {
+            destroyLiveTcpSocketsLackingPermission(
+                    nai, getNetworkPermission(nai.networkCapabilities), INetd.PERMISSION_SYSTEM);
             try {
                 mNetd.networkSetPermissionForNetwork(nai.network.netId, INetd.PERMISSION_SYSTEM);
+                // Call again in case sockets were opened after the first time : see
+                // updateNetworkPermissions
+                destroyLiveTcpSocketsLackingPermission(nai,
+                        getNetworkPermission(nai.networkCapabilities), INetd.PERMISSION_SYSTEM);
             } catch (RemoteException e) {
                 Log.d(TAG, "Error marking network restricted during teardown: ", e);
             }
@@ -10615,8 +10633,14 @@ public class ConnectivityService extends IConnectivityManager.Stub
         final int oldPermission = getNetworkPermission(nai.networkCapabilities);
         final int newPermission = getNetworkPermission(newNc);
         if (oldPermission != newPermission && nai.isCreated() && !nai.isVPN()) {
+            destroyLiveTcpSocketsLackingPermission(nai, oldPermission, newPermission);
             try {
                 mNetd.networkSetPermissionForNetwork(nai.network.getNetId(), newPermission);
+                // Destroy sockets again in case any were opened after
+                // destroySocketsLackingPermission is called above and before the permissions is
+                // changed. These sockets won't be able to send any RST packets because they are now
+                // no longer routed, but at least the apps will get errors.
+                destroyLiveTcpSocketsLackingPermission(nai, oldPermission, newPermission);
             } catch (RemoteException | ServiceSpecificException e) {
                 loge("Exception in networkSetPermissionForNetwork: " + e);
             }
@@ -15567,6 +15591,32 @@ public class ConnectivityService extends IConnectivityManager.Stub
                 loge("Exception destroy TCP sockets on local address: ", e);
             }
         }
+    }
 
+    private void destroyLiveTcpSocketsLackingPermission(
+            NetworkAgentInfo nai, int oldPermission, int newPermission) {
+        if (!mDeps.flagConnectivityServiceDestroySocket()) {
+            return;
+        }
+        // Virtual network doesn't have permission set.
+        if (!isPermissionMoreRestrictive(oldPermission, newPermission) || nai.isVPN()) {
+            return;
+        }
+        try {
+            mDeps.destroyLiveTcpSocketsLackingPermission(
+                    nai.network.netId, newPermission);
+        } catch (SocketException | InterruptedIOException | ErrnoException e) {
+            loge("Exception destroy TCP sockets lacking permission: " + e);
+        }
+    }
+
+    private boolean isPermissionMoreRestrictive(int oldPermission, int newPermission) {
+        return switch (newPermission) {
+            case INetd.PERMISSION_NONE -> false;
+            case INetd.PERMISSION_NETWORK -> oldPermission == INetd.PERMISSION_NONE;
+            case INetd.PERMISSION_SYSTEM -> oldPermission == INetd.PERMISSION_NONE
+                    || oldPermission == INetd.PERMISSION_NETWORK;
+            default -> throw new IllegalArgumentException("Invalid permission");
+        };
     }
 }
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSDestroySocketTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSDestroySocketTest.kt
index ee8c521055..aeeced6579 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSDestroySocketTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSDestroySocketTest.kt
@@ -24,6 +24,7 @@ import android.net.ConnectivityManager.BLOCKED_REASON_NONE
 import android.net.ConnectivityManager.FIREWALL_CHAIN_BACKGROUND
 import android.net.ConnectivityManager.FIREWALL_RULE_ALLOW
 import android.net.ConnectivityManager.FIREWALL_RULE_DENY
+import android.net.INetd
 import android.net.LinkAddress
 import android.net.LinkProperties
 import android.net.NetworkCapabilities
@@ -54,7 +55,9 @@ import com.android.testutils.DevSdkIgnoreRule
 import com.android.testutils.DevSdkIgnoreRunner
 import com.android.testutils.TestableNetworkAgent.Event.OnNetworkDestroyed
 import com.android.testutils.TestableNetworkCallback
+import com.android.testutils.TestableNetworkCallback.Event.CapabilitiesChanged
 import com.android.testutils.TestableNetworkCallback.Event.LinkPropertiesChanged
+import com.android.testutils.TestableNetworkCallback.Event.Lost
 import java.net.Inet6Address
 import java.net.InetAddress
 import junit.framework.Assert.assertFalse
@@ -66,6 +69,7 @@ import org.junit.runner.RunWith
 import org.mockito.ArgumentCaptor
 import org.mockito.Mockito.any
 import org.mockito.Mockito.anyInt
+import org.mockito.Mockito.doNothing
 import org.mockito.Mockito.doReturn
 import org.mockito.Mockito.inOrder
 import org.mockito.Mockito.never
@@ -512,8 +516,8 @@ class CSDestroySocketTest : CSTest() {
 
     @Test
     fun testDestroySocketForRemovedIpAddressFromSingleNetwork() {
-        val addressV6_1 = InetAddress.getByName("2100::1234")
-        val addressV6_2 = InetAddress.getByName("2100:0207::4321:1234")
+        val addressV6_1 = InetAddress.getByName("2001:DB8:0100::1111")
+        val addressV6_2 = InetAddress.getByName("2001:DB8:0200::2222")
         // add a test network.
         val (agent1, callback1) = prepareNetworkAgent(
             "wlan2",
@@ -523,7 +527,7 @@ class CSDestroySocketTest : CSTest() {
 
         // IP address changed
         val linkProperties2 = makeLp("wlan2")
-        linkProperties2.addLinkAddress(LinkAddress(addressV6_2, 64))
+        linkProperties2.addLinkAddress(addressV6_2.toLinkAddress())
         agent1.sendLinkProperties(linkProperties2)
         callback1.eventuallyExpect<LinkPropertiesChanged> {
             it.network == agent1.network && !it.lp.addresses.contains(addressV6_1)
@@ -549,10 +553,10 @@ class CSDestroySocketTest : CSTest() {
 
     @Test
     fun testDestroySocketForRemovedIpAddressFromMultipleNonVpnNetworks() {
-        val addressV6_1 = InetAddress.getByName("2100::1234")
-        val addressV6_2 = InetAddress.getByName("2100:0207::4321:1234")
+        val addressV6_1 = InetAddress.getByName("2001:DB8:0100::1111")
+        val addressV6_2 = InetAddress.getByName("2001:DB8:0200::2222")
         val addressV6LinkLocal = InetAddress.getByName("FE80::1234")
-        val addressV4_1 = InetAddress.getByName("203.0.113.10")
+        val addressV4_1 = InetAddress.getByName("192.0.2.10")
 
         // add 4 test networks(non VPN). 3 have a same IP address, and 1 network has different one.
         val (cellAgent, cellCallback) = prepareNetworkAgent(
@@ -654,11 +658,11 @@ class CSDestroySocketTest : CSTest() {
 
     @Test
     fun testDestroySocketForRemovedIpAddressFromMultipleVpnNetworks() {
-        val addressV6_1 = InetAddress.getByName("2100::1234")
-        val addressV6_2 = InetAddress.getByName("2100:0207::4321:1234")
-        val addressV6_3 = InetAddress.getByName("2234:0207::1234:4321")
+        val addressV6_1 = InetAddress.getByName("2001:DB8:0100::1111")
+        val addressV6_2 = InetAddress.getByName("2001:DB8:0200::2222")
+        val addressV6_3 = InetAddress.getByName("2001:DB8:0333::3333")
         val addressV6LinkLocal = InetAddress.getByName("FE80::1234")
-        val addressV4_1 = InetAddress.getByName("203.0.113.10")
+        val addressV4_1 = InetAddress.getByName("192.0.2.10")
         // add 3 VPN test networks and 1 non-VPN network.
 
         val (vpnAgent1, vpnCallback1) = prepareNetworkAgent(
@@ -705,7 +709,7 @@ class CSDestroySocketTest : CSTest() {
 
         // Change IP addresses network#2
         val linkProperties2 = makeLp("ipsec2")
-        linkProperties2.addLinkAddress(LinkAddress(addressV6_3, 64))
+        linkProperties2.addLinkAddress(addressV6_3.toLinkAddress())
         vpnAgent2.sendLinkProperties(linkProperties2)
         vpnCallback2.eventuallyExpect<LinkPropertiesChanged> { it.network == vpnAgent2.network &&
                 it.lp.interfaceName == "ipsec2" && it.lp.addresses.contains(addressV6_3)
@@ -810,4 +814,58 @@ class CSDestroySocketTest : CSTest() {
             null /* uidRanges */
         )
     }
+
+    @Test
+    fun testDestroySocketsLackingPermissionForPermissionUpdate() {
+        val inOrder = inOrder(destroySocketsWrapper)
+        val addressV6_1 = InetAddress.getByName("2001:DB8:0100::1111")
+        val addressV4_1 = InetAddress.getByName("192.0.2.10")
+
+        doNothing().`when`(netd).networkSetPermissionForNetwork(anyInt(), anyInt())
+
+        val ncRestricted =
+            cellNc().removeCapability(NetworkCapabilities.NET_CAPABILITY_NOT_RESTRICTED)
+        val ncNotRestricted =
+            cellNc().addCapability(NetworkCapabilities.NET_CAPABILITY_NOT_RESTRICTED)
+
+        val (agent, callback) = prepareNetworkAgent(
+            "rmnet1",
+            arrayListOf(addressV6_1.toLinkAddress(), addressV4_1.toLinkAddress()),
+            ncRestricted
+        )
+
+        agent.sendNetworkCapabilities(ncNotRestricted)
+        callback.eventuallyExpect<CapabilitiesChanged> {
+            it.network == agent.network &&
+                    it.caps.hasCapability(NetworkCapabilities.NET_CAPABILITY_NOT_RESTRICTED)
+        }
+        inOrder.verify(destroySocketsWrapper, never())
+            .destroyLiveTcpSocketsLackingPermission(anyInt(), anyInt())
+        agent.sendNetworkCapabilities(ncRestricted)
+        callback.eventuallyExpect<Lost>()
+        inOrder.verify(destroySocketsWrapper, times(2))
+            .destroyLiveTcpSocketsLackingPermission(
+                agent.network.netId,
+                INetd.PERMISSION_SYSTEM
+            )
+    }
+
+    @Test
+    fun testDestroySocketsLackingPermissionForDelayedTeardown() {
+        val addressV6_1 = InetAddress.getByName("2001:DB8:0100::1111")
+        doNothing().`when`(netd).networkSetPermissionForNetwork(anyInt(), anyInt())
+        val (agent, callback) = prepareNetworkAgent(
+            "rmnet1",
+            arrayListOf(addressV6_1.toLinkAddress()),
+            makeNc(TRANSPORT_CELLULAR)
+        )
+        agent.sendTeardownDelayMs(1)
+        agent.disconnect()
+        agent.eventuallyExpect<OnNetworkDestroyed>()
+
+        verify(destroySocketsWrapper, times(2)).destroyLiveTcpSocketsLackingPermission(
+            agent.network.netId,
+            INetd.PERMISSION_SYSTEM
+        )
+    }
 }
diff --git a/tests/unit/java/com/android/server/connectivityservice/base/CSAgentWrapper.kt b/tests/unit/java/com/android/server/connectivityservice/base/CSAgentWrapper.kt
index 990ef47392..a285dd1103 100644
--- a/tests/unit/java/com/android/server/connectivityservice/base/CSAgentWrapper.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/base/CSAgentWrapper.kt
@@ -320,6 +320,7 @@ class CSAgentWrapper(
     fun sendLocalNetworkConfig(lnc: LocalNetworkConfig) = agent.sendLocalNetworkConfig(lnc)
     fun sendNetworkCapabilities(nc: NetworkCapabilities) = agent.sendNetworkCapabilities(nc)
     fun sendLinkProperties(lp: LinkProperties) = agent.sendLinkProperties(lp)
+    fun sendTeardownDelayMs(delayMs: Int) = agent.setTeardownDelayMillis(delayMs)
 
     fun connectWithCaptivePortal(redirectUrl: String) {
         setCaptivePortal(redirectUrl)
diff --git a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
index 6fa420638d..a8f0b58f2b 100644
--- a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
@@ -304,6 +304,10 @@ open class CSTest {
             address: InetAddress?,
             interfaceId: Int
         ) {}
+        open fun destroyLiveTcpSocketsLackingPermission(
+            netId: Int,
+            permission: Int
+        ) {}
     }
 
     inner class CSDeps : ConnectivityService.Dependencies() {
@@ -469,6 +473,17 @@ open class CSTest {
                 interfaceId
             )
         }
+
+        override fun destroyLiveTcpSocketsLackingPermission(
+            netId: Int,
+            permission: Int
+        ) {
+            destroySocketsWrapper.destroyLiveTcpSocketsLackingPermission(
+                netId,
+                permission
+            )
+        }
+
         var netlinkMessageUpdate = Consumer<NetlinkMessage> {_ -> }
         override fun makeAddressUpdateMonitor(
             h: Handler,

From eb1cc9441cab86939eff987438ab0317f20ddcfa Mon Sep 17 00:00:00 2001
From: Xiao Ma <xiaom@google.com>
Date: Fri, 30 May 2025 16:48:11 +0900
Subject: [PATCH 321/377] DHCPv6 addr reg: add ADDR_REG_INFORM and
 ADDR_REG_REPLY message types.

Flag: EXEMPT guarded by an legacy experiment flag
Bug: 293393743
Test: TH
Change-Id: If2b30265c45e3a57c867fd7ba1df5f4245a37b35
---
 .../device/com/android/net/module/util/dhcp6/Dhcp6Packet.java   | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java
index 7d20c6c157..3990dd3fcc 100644
--- a/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java
+++ b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java
@@ -65,6 +65,8 @@ public class Dhcp6Packet {
     public static final byte DHCP6_MESSAGE_TYPE_INFORMATION_REQUEST = 11;
     public static final byte DHCP6_MESSAGE_TYPE_RELAY_FORW = 12;
     public static final byte DHCP6_MESSAGE_TYPE_RELAY_REPL = 13;
+    public static final byte DHCP6_MESSAGE_TYPE_ADDR_REG_INFORM = 36;
+    public static final byte DHCP6_MESSAGE_TYPE_ADDR_REG_REPLY = 37;
 
     /**
      * DHCPv6 Optional Type: Client Identifier.

From 9fecf5dee1ce4fc0b9d92d90b06b06cf32519434 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Do=C4=9Fancan=20Emek?= <dogancanemek@google.com>
Date: Fri, 30 May 2025 11:36:49 +0000
Subject: [PATCH 322/377] Add alint hook to Connectivity repo

Onboarding repo to go/alint, which will run ayeaye analyzers locally.

Bug: 419241911
Test: Locally
Flag: NONE, repo change
Change-Id: I78b938222ac73f00438692045e4c062cb5356029
---
 PREUPLOAD.cfg | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/PREUPLOAD.cfg b/PREUPLOAD.cfg
index 97a78cf4be..68cbdc7d02 100644
--- a/PREUPLOAD.cfg
+++ b/PREUPLOAD.cfg
@@ -15,3 +15,6 @@ ktlint_hook = ${REPO_ROOT}/prebuilts/ktlint/ktlint.py --disabled-rules comment-w
 hidden_api_txt_checksorted_hook = ${REPO_ROOT}/tools/platform-compat/hiddenapi/checksorted_sha.sh ${PREUPLOAD_COMMIT} ${REPO_ROOT}
 
 python_hook = ${REPO_ROOT}/packages/modules/Connectivity/preupload_hook_script.py ${PREUPLOAD_FILES}
+
+# go/alint for details
+alint_hook = ${REPO_ROOT}/vendor/google/tools/alint

From 649b3ad0d3263d94ada34ac6ab81980db42d88e2 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Thu, 29 May 2025 12:25:10 -0700
Subject: [PATCH 323/377] s/isValidEthernetInterface/shouldTrackInterface/

In preparation for tracking USB NCM interfaces independent of whether
they were included as part of the regex.

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I3d1f08aac20d613db9e845044b11b9484ddba2ed
---
 .../com/android/server/ethernet/EthernetTracker.java | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/service-t/src/com/android/server/ethernet/EthernetTracker.java b/service-t/src/com/android/server/ethernet/EthernetTracker.java
index e985b059d7..ca5a8edb85 100644
--- a/service-t/src/com/android/server/ethernet/EthernetTracker.java
+++ b/service-t/src/com/android/server/ethernet/EthernetTracker.java
@@ -122,7 +122,7 @@ public class EthernetTracker {
 
     /**
      * Interface names we track. This is a product-dependent regular expression.
-     * Use isValidEthernetInterface to check if a interface name is a valid ethernet interface (this
+     * Use shouldTrackInterface to check if a interface name is a valid ethernet interface (this
      * includes test interfaces if setIncludeTestInterfaces is set to true).
      */
     private final String mIfaceMatch;
@@ -222,7 +222,7 @@ public class EthernetTracker {
 
             // check if the received message applies to an ethernet interface.
             final String ifname = msg.getInterfaceName();
-            if (!isValidEthernetInterface(ifname)) return;
+            if (!shouldTrackInterface(ifname)) return;
 
             switch (msg.getHeader().nlmsg_type) {
                 case NetlinkConstants.RTM_NEWLINK:
@@ -447,7 +447,7 @@ public class EthernetTracker {
         }
 
         // There is a possible race with setIncludeTestInterfaces() which can affect
-        // isValidEthernetInterface (it returns true for test interfaces if setIncludeTestInterfaces
+        // shouldTrackInterface (it returns true for test interfaces if setIncludeTestInterfaces
         // is set to true).
         // setIncludeTestInterfaces() is only used in tests, and since getEthernetInterfaceList()
         // does not run on the handler thread, the behavior around setIncludeTestInterfaces() is
@@ -456,7 +456,7 @@ public class EthernetTracker {
         // In production code, this has no effect.
         while (ifaces.hasMoreElements()) {
             NetworkInterface iface = ifaces.nextElement();
-            if (isValidEthernetInterface(iface.getName())) interfaceList.add(iface.getName());
+            if (shouldTrackInterface(iface.getName())) interfaceList.add(iface.getName());
         }
         return interfaceList;
     }
@@ -500,7 +500,7 @@ public class EthernetTracker {
                 removeTestData();
                 // remove all test interfaces
                 for (String iface : getAllInterfaces()) {
-                    if (isValidEthernetInterface(iface)) continue;
+                    if (shouldTrackInterface(iface)) continue;
                     stopTrackingInterface(iface);
                 }
             }
@@ -806,7 +806,7 @@ public class EthernetTracker {
         return ret;
     }
 
-    private boolean isValidEthernetInterface(String iface) {
+    private boolean shouldTrackInterface(String iface) {
         return iface.matches(mIfaceMatch) || isValidTestInterface(iface);
     }
 

From 57331f1682f301fe5566603802b8e399a485536a Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Thu, 29 May 2025 12:44:36 -0700
Subject: [PATCH 324/377] Populate EthernetPort object in netlink handler

Figuring out whether an interface is a USB NCM interface requires
calling the ethtool API. In order to ensure the interface does not
change underneath us, it must use the ifindex rather than the interface
name.

This change starts populating EthernetPort, a tuple containing interface
name, MacAddress, and index, using the information received from
rtnetlink.

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I3c90bf844304f710ebf0a629d66ebcb487e144e7
---
 .../android/server/ethernet/EthernetTracker.java  | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/service-t/src/com/android/server/ethernet/EthernetTracker.java b/service-t/src/com/android/server/ethernet/EthernetTracker.java
index ca5a8edb85..912c79de9a 100644
--- a/service-t/src/com/android/server/ethernet/EthernetTracker.java
+++ b/service-t/src/com/android/server/ethernet/EthernetTracker.java
@@ -39,6 +39,7 @@ import android.net.IpConfiguration;
 import android.net.IpConfiguration.IpAssignment;
 import android.net.IpConfiguration.ProxySettings;
 import android.net.LinkAddress;
+import android.net.MacAddress;
 import android.net.NetworkCapabilities;
 import android.net.StaticIpConfiguration;
 import android.os.ConditionVariable;
@@ -220,18 +221,24 @@ public class EthernetTracker {
             // ignore messages for the loopback interface
             if ((ifinfomsg.flags & OsConstants.IFF_LOOPBACK) != 0) return;
 
-            // check if the received message applies to an ethernet interface.
+            // rtnl_fill_ifinfo sets IFLA_ADDRESS when there is one. This should always be true for
+            // all ethernet interfaces.
+            final MacAddress mac = msg.getHardwareAddress();
+            if (mac == null) return;
+
             final String ifname = msg.getInterfaceName();
-            if (!shouldTrackInterface(ifname)) return;
+            final EthernetPort port = new EthernetPort(ifname, mac, ifinfomsg.index);
+            // check if the received message applies to an ethernet interface.
+            if (!shouldTrackInterface(port.getInterfaceName())) return;
 
             switch (msg.getHeader().nlmsg_type) {
                 case NetlinkConstants.RTM_NEWLINK:
                     final boolean linkUp = (ifinfomsg.flags & NetlinkConstants.IFF_LOWER_UP) != 0;
-                    onNewLink(ifname, linkUp);
+                    onNewLink(port.getInterfaceName(), linkUp);
                     break;
 
                 case NetlinkConstants.RTM_DELLINK:
-                    onDelLink(ifname);
+                    onDelLink(port.getInterfaceName());
                     break;
 
                 default:

From 4deae2ff49f92d9dbca0a6f2652a8b0d17d921fe Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Thu, 29 May 2025 12:50:19 -0700
Subject: [PATCH 325/377] Pass EthernetPort to onNewLink / onDelLink

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I093c0bb49c31af5722c9907eec05b33a32086bc8
---
 .../server/ethernet/EthernetTracker.java        | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/service-t/src/com/android/server/ethernet/EthernetTracker.java b/service-t/src/com/android/server/ethernet/EthernetTracker.java
index 912c79de9a..37408b6e59 100644
--- a/service-t/src/com/android/server/ethernet/EthernetTracker.java
+++ b/service-t/src/com/android/server/ethernet/EthernetTracker.java
@@ -199,18 +199,19 @@ public class EthernetTracker {
                     OsConstants.NETLINK_ROUTE, NetlinkConstants.RTMGRP_LINK);
         }
 
-        private void onNewLink(String ifname, boolean linkUp) {
+        private void onNewLink(EthernetPort port, boolean linkUp) {
+            final String ifname = port.getInterfaceName();
             if (!mFactory.hasInterface(ifname) && !ifname.equals(mTetheringInterface)) {
-                Log.i(TAG, "onInterfaceAdded, iface: " + ifname);
+                Log.i(TAG, "onInterfaceAdded: " + port);
                 maybeTrackInterface(ifname);
             }
-            Log.i(TAG, "interfaceLinkStateChanged, iface: " + ifname + ", up: " + linkUp);
+            Log.i(TAG, "interfaceLinkStateChanged: " + port + ", up: " + linkUp);
             updateInterfaceState(ifname, linkUp);
         }
 
-        private void onDelLink(String ifname) {
-            Log.i(TAG, "onInterfaceRemoved, iface: " + ifname);
-            stopTrackingInterface(ifname);
+        private void onDelLink(EthernetPort port) {
+            Log.i(TAG, "onInterfaceRemoved: " + port);
+            stopTrackingInterface(port.getInterfaceName());
         }
 
         private void processRtNetlinkLinkMessage(RtNetlinkLinkMessage msg) {
@@ -234,11 +235,11 @@ public class EthernetTracker {
             switch (msg.getHeader().nlmsg_type) {
                 case NetlinkConstants.RTM_NEWLINK:
                     final boolean linkUp = (ifinfomsg.flags & NetlinkConstants.IFF_LOWER_UP) != 0;
-                    onNewLink(port.getInterfaceName(), linkUp);
+                    onNewLink(port, linkUp);
                     break;
 
                 case NetlinkConstants.RTM_DELLINK:
-                    onDelLink(port.getInterfaceName());
+                    onDelLink(port);
                     break;
 
                 default:

From 818f183fc4c887c014f9ecd049538558df40ff0e Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Thu, 29 May 2025 13:03:59 -0700
Subject: [PATCH 326/377] Move setInterfaceUpState out of try / catch block

setInterfaceUpState does not need to be in the try / catch block as it
doesn't let any exceptions escape. Also move the call to after checking
whether the returned config is null. In practice, this should never
happen; but if it did, we wouldn't end up doing anything anyways, so
bringing up the interface is pointless.

This also annotates config as final and returns early out of the catch
block (because the second log statement is technically incorrect).

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: Ic9233784594ead6779caf6267afad7b518a873ea
---
 .../android/server/ethernet/EthernetTracker.java    | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/service-t/src/com/android/server/ethernet/EthernetTracker.java b/service-t/src/com/android/server/ethernet/EthernetTracker.java
index 37408b6e59..f3a0af3f81 100644
--- a/service-t/src/com/android/server/ethernet/EthernetTracker.java
+++ b/service-t/src/com/android/server/ethernet/EthernetTracker.java
@@ -639,25 +639,24 @@ public class EthernetTracker {
     }
 
     private void addInterface(String iface) {
-        InterfaceConfigurationParcel config = null;
+        final InterfaceConfigurationParcel config;
         // Bring up the interface so we get link status indications.
         try {
             // Read the flags before attempting to bring up the interface. If the interface is
             // already running an UP event is created after adding the interface.
             config = NetdUtils.getInterfaceConfigParcel(mNetd, iface);
-            // Only bring the interface up when ethernet is enabled, otherwise set interface down.
-            setInterfaceUpState(iface, mIsEthernetEnabled);
         } catch (IllegalStateException e) {
-            // Either the system is crashing or the interface has disappeared. Just ignore the
-            // error; we haven't modified any state because we only do that if our calls succeed.
-            Log.e(TAG, "Error upping interface " + iface, e);
+            Log.e(TAG, "Failed to addInterface(" + iface + "). getInterfaceConfigParcel failed", e);
+            return;
         }
-
         if (config == null) {
             Log.e(TAG, "Null interface config parcelable for " + iface + ". Bailing out.");
             return;
         }
 
+        // Only bring the interface up when ethernet is enabled, otherwise set interface down.
+        setInterfaceUpState(iface, mIsEthernetEnabled);
+
         final String hwAddress = config.hwAddr;
 
         if (getInterfaceMode(iface) == INTERFACE_MODE_SERVER) {

From 6fecb23808766de94aa5f75322b102722b793c6e Mon Sep 17 00:00:00 2001
From: Chris Desir <cdesir@google.com>
Date: Fri, 30 May 2025 12:26:11 -0700
Subject: [PATCH 327/377] Fix NullPointerException in
 waitForRouterAdvertisement

The failure is caused by a RA packet read race condition. The test
receives a callback that local-only tethering has started and
immediately begins listening for an RA. However, the system's RA daemon
may not have finished initializing.

The test's packet reader times out waiting for an RA and returns a null
packet. The waitForRouterAdvertisement then uses the null packet
checking for RA, causing NPE. Change modifies waitForRouterAdvertisement
to check if a packet is null before processing it.

Flag: EXEMPT bugfix
Bug: 418010532
Test: atest android.net.EthernetTetheringTest#testLocalOnlyTethering
Change-Id: Ic534c53766958ae48a82687a9bd6d09297f074f2
---
 .../integration/base/android/net/EthernetTetheringTestBase.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Tethering/tests/integration/base/android/net/EthernetTetheringTestBase.java b/Tethering/tests/integration/base/android/net/EthernetTetheringTestBase.java
index 1323f28ff7..a4e426577a 100644
--- a/Tethering/tests/integration/base/android/net/EthernetTetheringTestBase.java
+++ b/Tethering/tests/integration/base/android/net/EthernetTetheringTestBase.java
@@ -296,7 +296,7 @@ public abstract class EthernetTetheringTestBase {
         final long deadline = SystemClock.uptimeMillis() + timeoutMs;
         do {
             byte[] pkt = reader.popPacket(timeoutMs);
-            if (isExpectedIcmpPacket(pkt, true /* hasEth */, false /* isIpv4 */,
+            if (pkt != null && isExpectedIcmpPacket(pkt, true /* hasEth */, false /* isIpv4 */,
                     ICMPV6_ROUTER_ADVERTISEMENT)) {
                 return;
             }

From 1185d242a61ef32795e509057fadfdf913c668d0 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Thu, 29 May 2025 12:57:00 -0700
Subject: [PATCH 328/377] Make EthernetPort#toString more legible

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I6abf322a57412edf97b20d6b96ca5747938fd1ea
---
 service-t/src/com/android/server/ethernet/EthernetPort.java   | 4 ++--
 .../java/com/android/server/ethernet/EthernetPortTest.java    | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/service-t/src/com/android/server/ethernet/EthernetPort.java b/service-t/src/com/android/server/ethernet/EthernetPort.java
index eb7a0bd885..b9d9961dd7 100644
--- a/service-t/src/com/android/server/ethernet/EthernetPort.java
+++ b/service-t/src/com/android/server/ethernet/EthernetPort.java
@@ -70,8 +70,8 @@ public class EthernetPort {
 
     @Override
     public String toString() {
-        return "Interface name: " + mInterfaceName + ", MAC address: " + mMacAddress
-                + ", Interface index: " + mInterfaceIndex;
+        return "EthernetPort(" + mInterfaceName + ", ifindex=" + mInterfaceIndex
+                + ", MAC=" + mMacAddress + ")";
     }
 
     @Override
diff --git a/tests/unit/java/com/android/server/ethernet/EthernetPortTest.java b/tests/unit/java/com/android/server/ethernet/EthernetPortTest.java
index 0aa133405f..594b4c13b5 100644
--- a/tests/unit/java/com/android/server/ethernet/EthernetPortTest.java
+++ b/tests/unit/java/com/android/server/ethernet/EthernetPortTest.java
@@ -115,7 +115,7 @@ public class EthernetPortTest {
     public void testToString() {
         EthernetPort port = new EthernetPort(
                 mTestInterfaceName, mTestMacAddress, mTestInterfaceIndex);
-        String expect = "Interface name: eth0, MAC address: 0a:1b:2c:3d:4e:5f, Interface index: 1";
+        String expect = "EthernetPort(eth0, ifindex=1, MAC=0a:1b:2c:3d:4e:5f)";
         assertEquals(expect, port.toString());
     }
 }

From bb589cf33cd5bed8b619b9747479773cba474b29 Mon Sep 17 00:00:00 2001
From: Junyu Lai <junyulai@google.com>
Date: Wed, 28 May 2025 17:03:02 +0800
Subject: [PATCH 329/377] Report satellite coarse usage

Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.metrics.SatelliteCoarseUsageMetricsCollectorTest \
      --update-device
Test: atest ConnectivityCoverageTests --test-filter 'CSTest*' --update-device
Test: atest ConnectivityCoverageTests --test-filter 'ConnectivityService*' --update-device
Test: Manual:
  1. Change code to use TRANSPORT_CELLULAR
  2. m statsd_testdrive && statsd_testdrive -e 1102
  3. Turn off mobile data.
Flag: EXEMPT controlled with kill switch
Bug: 419123367
Change-Id: I264efa6802612809fdbff22901f31447f370bbe5
---
 service/Android.bp                            |   1 +
 .../SatelliteCoarseUsageMetricsCollector.java | 320 ++++++++++++++++++
 .../android/server/ConnectivityService.java   |  24 ++
 ...atelliteCoarseUsageMetricsCollectorTest.kt | 156 +++++++++
 .../server/ConnectivityServiceTest.java       |   8 +
 .../server/connectivityservice/base/CSTest.kt |   6 +
 6 files changed, 515 insertions(+)
 create mode 100644 service/src/com/android/metrics/SatelliteCoarseUsageMetricsCollector.java
 create mode 100644 tests/unit/java/com/android/metrics/SatelliteCoarseUsageMetricsCollectorTest.kt

diff --git a/service/Android.bp b/service/Android.bp
index e71a6c176f..fb74238caf 100644
--- a/service/Android.bp
+++ b/service/Android.bp
@@ -164,6 +164,7 @@ java_library {
         "framework-bluetooth.stubs.module_lib",
         "framework-configinfrastructure.stubs.module_lib",
         "framework-connectivity-pre-jarjar",
+        "framework-connectivity-t-pre-jarjar",
         // The framework-connectivity-t library is only available on T+ platforms
         // so any calls to it must be protected with a check to ensure that it is
         // available. The linter will detect any unprotected calls through an API
diff --git a/service/src/com/android/metrics/SatelliteCoarseUsageMetricsCollector.java b/service/src/com/android/metrics/SatelliteCoarseUsageMetricsCollector.java
new file mode 100644
index 0000000000..2da07b9995
--- /dev/null
+++ b/service/src/com/android/metrics/SatelliteCoarseUsageMetricsCollector.java
@@ -0,0 +1,320 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.metrics;
+
+import static android.net.NetworkCapabilities.NET_CAPABILITY_INTERNET;
+import static android.net.NetworkCapabilities.TRANSPORT_SATELLITE;
+import static android.net.NetworkTemplate.MATCH_MOBILE;
+
+import static com.android.net.module.util.FrameworkConnectivityStatsLog.CORE_NETWORKING_CRITICAL_BYTES_EVENT_OCCURRED;
+import static com.android.net.module.util.FrameworkConnectivityStatsLog.CORE_NETWORKING_CRITICAL_BYTES_EVENT_OCCURRED__EVENT_TYPE__CRITICAL_BYTES_EVENT_TYPE_SATELLITE_COARSE_RX_USAGE;
+import static com.android.net.module.util.FrameworkConnectivityStatsLog.CORE_NETWORKING_CRITICAL_BYTES_EVENT_OCCURRED__EVENT_TYPE__CRITICAL_BYTES_EVENT_TYPE_SATELLITE_COARSE_TX_USAGE;
+
+import static java.util.concurrent.TimeUnit.HOURS;
+
+import android.annotation.NonNull;
+import android.annotation.Nullable;
+import android.app.usage.NetworkStats;
+import android.app.usage.NetworkStatsManager;
+import android.content.Context;
+import android.net.ConnectivityManager;
+import android.net.Network;
+import android.net.NetworkRequest;
+import android.net.NetworkTemplate;
+import android.os.Handler;
+import android.os.Process;
+import android.os.SystemClock;
+import android.util.Log;
+
+import androidx.annotation.VisibleForTesting;
+
+import com.android.internal.util.IndentingPrintWriter;
+import com.android.modules.utils.BackgroundThread;
+import com.android.modules.utils.build.SdkLevel;
+import com.android.net.module.util.FrameworkConnectivityStatsLog;
+
+import javax.annotation.CheckReturnValue;
+
+/**
+ * Monitors satellite network connections to collect overall usage during active
+ * satellite sessions. It uses NetworkStatsManager to query snapshots upon
+ * connection and disconnection, then logs the difference.
+ *
+ * This class does not provide thread safety and should be only accessed on the same thread.
+ */
+public class SatelliteCoarseUsageMetricsCollector {
+    private static final String TAG = SatelliteCoarseUsageMetricsCollector.class.getSimpleName();
+    private static final NetworkTemplate SATELLITE_TEMPLATE;
+
+    static {
+        // To prevent NetworkTemplate#Builder not found error when
+        // initializing CSTest on S-based image.
+        if (SdkLevel.isAtLeastU()) {
+            SATELLITE_TEMPLATE = new NetworkTemplate.Builder(MATCH_MOBILE)
+                    .setTransportTypes(new int[]{TRANSPORT_SATELLITE}).build();
+        } else {
+            SATELLITE_TEMPLATE = null;
+        }
+    }
+    /**
+     * The max bucket duration used when storing usage in NetworkStatsService.
+     * See NetworkStatsService#DefaultNetworkStatsSettings#getUidConfig.
+     */
+    private static final long MAX_NETSTATS_BUCKET_DURATION_MS = HOURS.toMillis(2);
+
+    private ConnectivityManager mCm;
+    private NetworkStatsManager mNsm;
+    private final Context mContext;
+    private final Handler mHandler;
+    private final SatelliteNetworkCallback mNetworkCallback = new SatelliteNetworkCallback();
+
+    // Null when no satellite network is connected.
+    @Nullable
+    private MyStatsEntry mSatelliteBaseline = null;
+
+    private final MyStatsEntry mReportedUsage = new MyStatsEntry();
+    private final Dependencies mDeps;
+
+    // The start timestamp used to query the snapshots of data usage.
+    final long mStartTime;
+
+    /**
+     * Constructs a helper to monitor satellite network usage.
+     *
+     * @param context The context.
+     */
+    public SatelliteCoarseUsageMetricsCollector(@NonNull Context context) {
+        this(context, new Dependencies());
+    }
+
+    /**
+     * Constructs a helper to monitor satellite network usage.
+     *
+     * @param context The context.
+     */
+    public SatelliteCoarseUsageMetricsCollector(@NonNull Context context,
+            @NonNull Dependencies deps) {
+        mContext = context;
+        mDeps = deps;
+        mHandler = mDeps.getBackgroundThreadHandler();
+        mStartTime = getStartTimestamp();
+    }
+
+    /**
+     * Helper class for test injection.
+     */
+    @VisibleForTesting
+    public static class Dependencies {
+        /**
+         * Reports the given network usage entry to system metrics.
+         */
+        public void reportUsage(MyStatsEntry entry) {
+            FrameworkConnectivityStatsLog.write_non_chained(CORE_NETWORKING_CRITICAL_BYTES_EVENT_OCCURRED,
+                    Process.SYSTEM_UID,
+                    TAG,
+                    CORE_NETWORKING_CRITICAL_BYTES_EVENT_OCCURRED__EVENT_TYPE__CRITICAL_BYTES_EVENT_TYPE_SATELLITE_COARSE_RX_USAGE,
+                    entry.rxBytes);
+            FrameworkConnectivityStatsLog.write_non_chained(CORE_NETWORKING_CRITICAL_BYTES_EVENT_OCCURRED,
+                    Process.SYSTEM_UID,
+                    TAG,
+                    CORE_NETWORKING_CRITICAL_BYTES_EVENT_OCCURRED__EVENT_TYPE__CRITICAL_BYTES_EVENT_TYPE_SATELLITE_COARSE_TX_USAGE,
+                    entry.txBytes);
+        }
+
+        /**
+         * Queries the network stats summary for a given network template.
+         */
+        @NonNull
+        public MyStatsEntry getSummary(@NonNull NetworkStatsManager nsm, long startTime) {
+            final MyStatsEntry ret = new MyStatsEntry();
+            final NetworkStats stats = nsm.querySummary(SATELLITE_TEMPLATE,
+                    startTime, Long.MAX_VALUE);
+            // This null check simplifies testing by avoiding the need to mock
+            // the complex NetworkStats object. In production, this object
+            // is not expected to be null. See ConnectivityServiceIntegrationTest
+            // for context.
+            if (stats == null) {
+                return ret;
+            }
+            final NetworkStats.Bucket recycle = new NetworkStats.Bucket();
+            while (stats.hasNextBucket()) {
+                stats.getNextBucket(recycle);
+                ret.add(new MyStatsEntry(recycle));
+            }
+            return ret;
+        }
+
+        /** Get the background thread handler */
+        @NonNull
+        public Handler getBackgroundThreadHandler() {
+            return BackgroundThread.getHandler();
+        }
+    }
+
+    @VisibleForTesting
+    public static class MyStatsEntry {
+        public long rxBytes;
+        public long txBytes;
+
+        public MyStatsEntry() {
+            this.rxBytes = 0;
+            this.txBytes = 0;
+        }
+
+        public MyStatsEntry(@NonNull NetworkStats.Bucket bucket) {
+            this.rxBytes = bucket.getRxBytes();
+            this.txBytes = bucket.getTxBytes();
+        }
+
+        public MyStatsEntry(long rxBytes, long txBytes) {
+            this.rxBytes = rxBytes;
+            this.txBytes = txBytes;
+        }
+
+        /**
+         * Adds the stats from another {@link MyStatsEntry} to this entry.
+         *
+         * This method modifies the current object.
+         */
+        public void add(@NonNull MyStatsEntry other) {
+            this.rxBytes += other.rxBytes;
+            this.txBytes += other.txBytes;
+        }
+
+        /**
+         * Subtracts the stats from another {@link MyStatsEntry} to this entry.
+         *
+         * This method modifies the current object.
+         */
+        public void subtract(@NonNull MyStatsEntry other) {
+            this.rxBytes -= other.rxBytes;
+            this.txBytes -= other.txBytes;
+        }
+
+        /**
+         * Adds the stats from another {@link MyStatsEntry} from this entry.
+         *
+         * This method does not modify the current object but returns a new one.
+         */
+        @CheckReturnValue
+        @NonNull
+        public MyStatsEntry plus(@NonNull MyStatsEntry other) {
+            return new MyStatsEntry(rxBytes + other.rxBytes, txBytes + other.txBytes);
+        }
+
+        /**
+         * Subtracts the stats from another {@link MyStatsEntry} from this entry.
+         *
+         * This method does not modify the current object but returns a new one.
+         */
+        @CheckReturnValue
+        @NonNull
+        public MyStatsEntry minus(@NonNull MyStatsEntry other) {
+            return new MyStatsEntry(rxBytes - other.rxBytes, txBytes - other.txBytes);
+        }
+
+        @Override
+        public String toString() {
+            return "{rxBytes=" + rxBytes + ", txBytes=" + txBytes + "}";
+        }
+    }
+
+    private class SatelliteNetworkCallback extends ConnectivityManager.NetworkCallback {
+        /**
+         * Called when a satellite network is lost. Collects and reports the satellite coarse usage
+         * difference.
+         *
+         * Note that multiple satellite networks could occur, for example, when
+         * transitioning from one subscription to another. The amount of usage might
+         * be slightly inaccurate in such cases.
+         *
+         * @param network The Network object that was just lost.
+         */
+        @Override
+        public void onLost(Network network) {
+            final MyStatsEntry snapshot = mDeps.getSummary(mNsm, mStartTime);
+            // Report diff with metrics.
+            final MyStatsEntry diff = snapshot.minus(mSatelliteBaseline);
+            mDeps.reportUsage(diff);
+            mReportedUsage.add(diff);
+            mSatelliteBaseline = snapshot;
+            Log.d(TAG, "onLost: Last satellite network " + network + ", Reported usage: " + diff);
+        }
+    }
+
+    // Calculate the start timestamp used for querying data usage snapshots.
+    // This timestamp needs to be early enough to ensure the query window
+    // starts at or before the beginning of the usage bucket in which the
+    // device boot event occurred. This is achieved by setting the start time
+    // to one bucket duration prior to the calculated bootTimeMillis.
+    //
+    // It is acceptable if this timestamp is not perfectly aligned with exact
+    // bucket boundaries or results in covering some redundant data from before
+    // the boot event. Any such duplicated or irrelevant data will be effectively
+    // subtracted out when calculating usage from the differences of two snapshots,
+    // provided both snapshots are queried using this same consistent start timestamp.
+    private long getStartTimestamp() {
+        final long elapsedMillisSinceBoot = SystemClock.elapsedRealtime();
+        final long currentTimeMillis = System.currentTimeMillis();
+        final long bootTimeMillis = currentTimeMillis - elapsedMillisSinceBoot;
+        return bootTimeMillis - MAX_NETSTATS_BUCKET_DURATION_MS;
+    }
+
+    /**
+     * Starts monitoring for satellite network connections.
+     */
+    public void startMonitoring() {
+        if (!SdkLevel.isAtLeastU()) {
+            throw new UnsupportedOperationException(TAG + " is not supported below U");
+        }
+        mHandler.post(() -> handleStartMonitoring());
+    }
+
+    private void handleStartMonitoring() {
+        // Note that in the constructor it is too early to get the managers.
+        mCm = mContext.getSystemService(ConnectivityManager.class);
+        mNsm = mContext.getSystemService(NetworkStatsManager.class);
+        // Note: This might create heavy workload on NetworkStatsService if queried with high
+        // frequency, as the calling UID is system. Each query made with this manager
+        // updates usage stored in files before returning the newest result.
+        // This behavior is not rate-limited because the calling uid is the system UID.
+        mNsm.setPollOnOpen(true);
+        // Get the first baseline.
+        mSatelliteBaseline = mDeps.getSummary(mNsm, mStartTime);
+
+        final NetworkRequest satelliteRequest = new NetworkRequest.Builder()
+                .clearCapabilities()
+                .addCapability(NET_CAPABILITY_INTERNET)
+                .addTransportType(TRANSPORT_SATELLITE)
+                .build();
+        // The callback uses the shared background thread. Potential delays of
+        // dozens of seconds are acceptable because this class measures coarse
+        // usage after a connection is lost, so the metric's accuracy is not
+        // that sensitive to the timing.
+        // A dedicated thread would be needed if it turns out inaccurate.
+        mCm.registerNetworkCallback(satelliteRequest, mNetworkCallback, mHandler);
+    }
+
+    /** Dump info to dumpsys */
+    public void dump(@NonNull IndentingPrintWriter pw) {
+        pw.println(TAG + ":");
+        pw.increaseIndent();
+        pw.println("Reported usage " + mReportedUsage);
+        pw.decreaseIndent();
+        pw.println();
+    }
+}
diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index dc1e89ce75..2a9d0140a1 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -344,6 +344,7 @@ import com.android.metrics.NetworkList;
 import com.android.metrics.NetworkRequestCount;
 import com.android.metrics.RequestCountForType;
 import com.android.metrics.SatelliteAccessInfo;
+import com.android.metrics.SatelliteCoarseUsageMetricsCollector;
 import com.android.modules.utils.BasicShellCommandHandler;
 import com.android.modules.utils.build.SdkLevel;
 import com.android.net.module.util.BaseNetdUnsolicitedEventListener;
@@ -1066,6 +1067,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
     private final NetworkNotificationManager mNotifier;
     private final LingerMonitor mLingerMonitor;
     private final SatelliteAccessController mSatelliteAccessController;
+    private final SatelliteCoarseUsageMetricsCollector mSatelliteCoarseUsageMetricsCollector;
 
     private final L2capNetworkProvider mL2capNetworkProvider;
 
@@ -1707,6 +1709,15 @@ public class ConnectivityService extends IConnectivityManager.Stub
                     connectivityServiceInternalHandler);
         }
 
+        /**
+         * @see SatelliteCoarseUsageMetricsCollector
+         */
+        @Nullable
+        public SatelliteCoarseUsageMetricsCollector makeSatelliteCoarseUsageMetricsCollector(
+                @NonNull final Context context) {
+            return new SatelliteCoarseUsageMetricsCollector(context);
+        }
+
         /** Creates an L2capNetworkProvider */
         public L2capNetworkProvider makeL2capNetworkProvider(Context context) {
             return new L2capNetworkProvider(context);
@@ -2090,6 +2101,12 @@ public class ConnectivityService extends IConnectivityManager.Stub
         }
         mConstrainedDataSatelliteMetrics = (mSatelliteAccessController != null)
                 && mDeps.isFeatureNotChickenedOut(mContext, CONSTRAINED_DATA_SATELLITE_METRICS);
+        if (mConstrainedDataSatelliteMetrics) {
+            mSatelliteCoarseUsageMetricsCollector =
+                    mDeps.makeSatelliteCoarseUsageMetricsCollector(mContext);
+        } else {
+            mSatelliteCoarseUsageMetricsCollector = null;
+        }
 
         if (mDeps.flagConnectivityServiceDestroySocket()) {
             mIpToNetworksMap = new HashMap<>();
@@ -4363,6 +4380,10 @@ public class ConnectivityService extends IConnectivityManager.Stub
         // forever, this replaces a synchronous call to PermissionMonitor#initialize, which
         // could have blocked forever too.
         permissionMonitorInitializeDone.block();
+
+        if (mConstrainedDataSatelliteMetrics) {
+            mSatelliteCoarseUsageMetricsCollector.startMonitoring();
+        }
     }
 
     /**
@@ -4689,6 +4710,9 @@ public class ConnectivityService extends IConnectivityManager.Stub
         if (mSatelliteAccessController != null) {
             mSatelliteAccessController.dump(pw);
         }
+        if (mConstrainedDataSatelliteMetrics) {
+            mSatelliteCoarseUsageMetricsCollector.dump(pw);
+        }
 
         pw.println();
         pw.println("Legacy network activity:");
diff --git a/tests/unit/java/com/android/metrics/SatelliteCoarseUsageMetricsCollectorTest.kt b/tests/unit/java/com/android/metrics/SatelliteCoarseUsageMetricsCollectorTest.kt
new file mode 100644
index 0000000000..989fceeeb3
--- /dev/null
+++ b/tests/unit/java/com/android/metrics/SatelliteCoarseUsageMetricsCollectorTest.kt
@@ -0,0 +1,156 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.metrics
+
+import android.app.usage.NetworkStatsManager
+import android.content.Context
+import android.net.ConnectivityManager
+import android.net.Network
+import android.os.Build
+import android.os.Handler
+import android.os.Looper
+import com.android.metrics.SatelliteCoarseUsageMetricsCollector.MyStatsEntry
+import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
+import com.android.testutils.DevSdkIgnoreRunner
+import com.android.testutils.waitForIdle
+import kotlin.test.assertEquals
+import org.junit.Assert.assertNotNull
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.mockito.ArgumentCaptor
+import org.mockito.ArgumentMatchers.any
+import org.mockito.ArgumentMatchers.anyLong
+import org.mockito.Mockito.clearInvocations
+import org.mockito.Mockito.doReturn
+import org.mockito.Mockito.mock
+import org.mockito.Mockito.never
+import org.mockito.Mockito.verify
+
+/**
+ * Unit tests for [SatelliteCoarseUsageMetricsCollector].
+ * These tests mock Android system services and the custom Dependencies class
+ * to verify the behavior of the collector during satellite network events,
+ * using MockK for mocking and argument capturing.
+ */
+@RunWith(DevSdkIgnoreRunner::class)
+@IgnoreUpTo(Build.VERSION_CODES.TIRAMISU)
+class SatelliteCoarseUsageMetricsCollectorTest {
+    companion object {
+        const val THREAD_BLOCK_TIMEOUT_MS = 1000L
+    }
+
+    private val mockCm = mock(ConnectivityManager::class.java)
+    private val mockNsm = mock(NetworkStatsManager::class.java)
+    private val mockCtx = mock(Context::class.java).also {
+        doReturn(mockCm).`when`(it).getSystemService(ConnectivityManager::class.java)
+        doReturn(mockNsm).`when`(it).getSystemService(NetworkStatsManager::class.java)
+    }
+    private val handler = Handler(Looper.getMainLooper())
+    private val mockDeps = mock(SatelliteCoarseUsageMetricsCollector.Dependencies::class.java)
+            .also {
+                doReturn(handler).`when`(it).backgroundThreadHandler
+            }
+    private val collector = SatelliteCoarseUsageMetricsCollector(mockCtx, mockDeps)
+
+    // Return the network callback for listening network changes.
+    private fun startMonitoring(): ConnectivityManager.NetworkCallback {
+        val cbCaptor = ArgumentCaptor.forClass(ConnectivityManager.NetworkCallback::class.java)
+        collector.startMonitoring()
+        handler.waitForIdle(THREAD_BLOCK_TIMEOUT_MS)
+        verify(mockCm).registerNetworkCallback(any(), cbCaptor.capture(), any())
+        return cbCaptor.value.also {
+            assertNotNull(it)
+        }
+    }
+
+    private fun mockGetSummary(rxBytes: Long, txBytes: Long) {
+        val statsEntry = MyStatsEntry(rxBytes, txBytes)
+        doReturn(statsEntry).`when`(mockDeps).getSummary(any(), anyLong())
+    }
+
+    private fun assertReportedUsage(rxBytes: Long, txBytes: Long) {
+        val reportedUsageCaptor = ArgumentCaptor.forClass(MyStatsEntry::class.java)
+        verify(mockDeps).reportUsage(reportedUsageCaptor.capture())
+
+        val reportedUsage = reportedUsageCaptor.value
+        assertEquals(rxBytes, reportedUsage.rxBytes)
+        assertEquals(txBytes, reportedUsage.txBytes)
+    }
+
+    @Test
+    fun testSingleNetwork() {
+        val mockNet = mock(Network::class.java)
+        mockGetSummary(100, 50)
+        val cb = startMonitoring()
+        mockGetSummary(300, 150)
+        cb.onLost(mockNet)
+        assertReportedUsage(200, 100)
+    }
+
+    // Test multiple satellite networks. This could happen when telephony creates
+    // satellite networks with different types of services (e.g., MMS, internet).
+    @Test
+    fun testMultipleNetworks() {
+        // Mock multiple networks, ensuring they are identified as distinct.
+        val mockNet1 = Network(1)
+        val mockNet2 = Network(2)
+
+        // Simulate baseline.
+        mockGetSummary(100, 50)
+        val cb = startMonitoring()
+
+        // Simulate onAvailable events, verify nothing happens.
+        cb.onAvailable(mockNet1)
+        cb.onAvailable(mockNet2)
+        verify(mockDeps, never()).reportUsage(any())
+
+        // Simulate first network lost (not the last), simulate no change at all,
+        // verify reportUsage is invoked with zero bytes.
+        cb.onLost(mockNet1)
+        assertReportedUsage(0L, 0L)
+
+        // Simulate second network lost (the last one).
+        clearInvocations(mockDeps)
+        mockGetSummary(300, 150)
+        cb.onLost(mockNet2)
+        assertReportedUsage(200L, 100L)
+    }
+
+    @Test
+    fun testMyStatsEntryPlusSubtract() {
+        val entry1 = MyStatsEntry(10, 20)
+        val entry2 = MyStatsEntry(5, 10)
+        val result = entry1.plus(entry2)
+        assertEquals(15L, result.rxBytes)
+        assertEquals(30L, result.txBytes)
+        entry1.subtract(entry2)
+        assertEquals(5L, entry1.rxBytes)
+        assertEquals(10L, entry1.txBytes)
+    }
+
+    @Test
+    fun testMyStatsEntryMinusAdd() {
+        val entry1 = MyStatsEntry(100, 200)
+        val entry2 = MyStatsEntry(10, 20)
+        val result = entry1.minus(entry2)
+        assertEquals(90L, result.rxBytes)
+        assertEquals(180L, result.txBytes)
+        entry1.add(entry2)
+        assertEquals(110L, entry1.rxBytes)
+        assertEquals(220L, entry1.txBytes)
+    }
+}
diff --git a/tests/unit/java/com/android/server/ConnectivityServiceTest.java b/tests/unit/java/com/android/server/ConnectivityServiceTest.java
index 648d2b0cfd..7cb7219411 100644
--- a/tests/unit/java/com/android/server/ConnectivityServiceTest.java
+++ b/tests/unit/java/com/android/server/ConnectivityServiceTest.java
@@ -391,6 +391,7 @@ import com.android.internal.net.VpnConfig;
 import com.android.internal.util.WakeupMessage;
 import com.android.internal.util.test.BroadcastInterceptingContext;
 import com.android.internal.util.test.FakeSettingsProvider;
+import com.android.metrics.SatelliteCoarseUsageMetricsCollector;
 import com.android.modules.utils.build.SdkLevel;
 import com.android.net.module.util.ArrayTrackRecord;
 import com.android.net.module.util.BaseNetdUnsolicitedEventListener;
@@ -650,6 +651,7 @@ public class ConnectivityServiceTest {
     @Mock SubscriptionManager mSubscriptionManager;
     @Mock KeepaliveTracker.Dependencies mMockKeepaliveTrackerDependencies;
     @Mock SatelliteAccessController mSatelliteAccessController;
+    @Mock SatelliteCoarseUsageMetricsCollector mSatelliteCoarseUsageMetricsCollector;
 
     // BatteryStatsManager is final and cannot be mocked with regular mockito, so just mock the
     // underlying binder calls.
@@ -2093,6 +2095,12 @@ public class ConnectivityServiceTest {
             return mSatelliteAccessController;
         }
 
+        @Override
+        public SatelliteCoarseUsageMetricsCollector makeSatelliteCoarseUsageMetricsCollector(
+                @NonNull final Context context) {
+            return mSatelliteCoarseUsageMetricsCollector;
+        }
+
         @Override
         public boolean intentFilterEquals(final PendingIntent a, final PendingIntent b) {
             return runAsShell(GET_INTENT_SENDER_INTENT, () -> a.intentFilterEquals(b));
diff --git a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
index d98553a277..916f04d93d 100644
--- a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
@@ -66,6 +66,7 @@ import android.util.SparseArray
 import androidx.test.platform.app.InstrumentationRegistry
 import com.android.internal.app.IBatteryStats
 import com.android.internal.util.test.BroadcastInterceptingContext
+import com.android.metrics.SatelliteCoarseUsageMetricsCollector
 import com.android.modules.utils.build.SdkLevel
 import com.android.net.module.util.ArrayTrackRecord
 import com.android.net.module.util.SharedLog
@@ -233,6 +234,7 @@ open class CSTest {
 
     val multicastRoutingCoordinatorService = mock<MulticastRoutingCoordinatorService>()
     val satelliteAccessController = mock<SatelliteAccessController>()
+    val satelliteCoarseUsageMetricsCollector = mock<SatelliteCoarseUsageMetricsCollector>()
     val quicConnectionCloser = mock<QuicConnectionCloser>()
     val destroySocketsWrapper = mock<DestroySocketsWrapper>()
     val dnsResolver = mock<IDnsResolver>()
@@ -345,6 +347,10 @@ open class CSTest {
             return satelliteAccessController
         }
 
+        override fun makeSatelliteCoarseUsageMetricsCollector(
+                context: Context
+        ) = satelliteCoarseUsageMetricsCollector
+
         private inner class AOOKTDeps(c: Context) : AutomaticOnOffKeepaliveTracker.Dependencies(c) {
             override fun isTetheringFeatureNotChickenedOut(name: String): Boolean {
                 return isFeatureEnabled(context, name)

From 48c3c2bf10bb7bd918610f333e610d3463ca96e1 Mon Sep 17 00:00:00 2001
From: Junyu Lai <junyulai@google.com>
Date: Thu, 29 May 2025 22:37:03 +0800
Subject: [PATCH 330/377] Update start timestamp for querying data usage

The previous implementation used a fixed start timestamp for
querying network usage statistics, initialized based on the
device's boot time. This caused the query window to grow
indefinitely as the device uptime increased, leading to
inefficient queries that fetched and processed a large
ever-expanding amount of historical data.

This change refactors the logic to use a rolling start
timestamp. The `mStartTime` is now updated after each
usage report is generated (in `onLost`). By resetting
the start time to a more recent point (current time
minus one bucket duration), we ensure that subsequent
queries for usage snapshots are performed over a small,
manageable time window.

This optimization prevents fetching excessive data
from the NetworkStatsManager, improving the efficiency
of the metrics collector. Dependencies for time and
duration have also been abstracted for better testability.

Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.metrics.SatelliteCoarseUsageMetricsCollectorTest \
  --update-device
Flag: EXEMPT controlled with kill switch
Bug: 419123367
Change-Id: I49d3b044f0a038093060f5541ea263d2d0d253a2
---
 .../SatelliteCoarseUsageMetricsCollector.java | 36 +++++++++++-----
 ...atelliteCoarseUsageMetricsCollectorTest.kt | 43 +++++++++++++++----
 2 files changed, 60 insertions(+), 19 deletions(-)

diff --git a/service/src/com/android/metrics/SatelliteCoarseUsageMetricsCollector.java b/service/src/com/android/metrics/SatelliteCoarseUsageMetricsCollector.java
index 2da07b9995..79f2f1dc74 100644
--- a/service/src/com/android/metrics/SatelliteCoarseUsageMetricsCollector.java
+++ b/service/src/com/android/metrics/SatelliteCoarseUsageMetricsCollector.java
@@ -37,7 +37,6 @@ import android.net.NetworkRequest;
 import android.net.NetworkTemplate;
 import android.os.Handler;
 import android.os.Process;
-import android.os.SystemClock;
 import android.util.Log;
 
 import androidx.annotation.VisibleForTesting;
@@ -90,7 +89,8 @@ public class SatelliteCoarseUsageMetricsCollector {
     private final Dependencies mDeps;
 
     // The start timestamp used to query the snapshots of data usage.
-    final long mStartTime;
+    // This must only be accessed on the handler thread.
+    long mStartTime;
 
     /**
      * Constructs a helper to monitor satellite network usage.
@@ -111,7 +111,6 @@ public class SatelliteCoarseUsageMetricsCollector {
         mContext = context;
         mDeps = deps;
         mHandler = mDeps.getBackgroundThreadHandler();
-        mStartTime = getStartTimestamp();
     }
 
     /**
@@ -163,6 +162,16 @@ public class SatelliteCoarseUsageMetricsCollector {
         public Handler getBackgroundThreadHandler() {
             return BackgroundThread.getHandler();
         }
+
+        /** Get current time */
+        public long getCurrentTimeMillis() {
+            return System.currentTimeMillis();
+        }
+
+        /** Get max netstats bucket duration */
+        public long getMaxBucketDuration() {
+            return MAX_NETSTATS_BUCKET_DURATION_MS;
+        }
     }
 
     @VisibleForTesting
@@ -246,12 +255,18 @@ public class SatelliteCoarseUsageMetricsCollector {
          */
         @Override
         public void onLost(Network network) {
+            // The start time must be matched with the baseline, in order to calculate
+            // the difference.
             final MyStatsEntry snapshot = mDeps.getSummary(mNsm, mStartTime);
             // Report diff with metrics.
             final MyStatsEntry diff = snapshot.minus(mSatelliteBaseline);
             mDeps.reportUsage(diff);
             mReportedUsage.add(diff);
-            mSatelliteBaseline = snapshot;
+
+            // Fetch another snapshot as a baseline, with a more recent start timestamp.
+            // This is to prevent from fetching too much data.
+            updateStartTimestamp();
+            mSatelliteBaseline = mDeps.getSummary(mNsm, mStartTime);
             Log.d(TAG, "onLost: Last satellite network " + network + ", Reported usage: " + diff);
         }
     }
@@ -259,19 +274,17 @@ public class SatelliteCoarseUsageMetricsCollector {
     // Calculate the start timestamp used for querying data usage snapshots.
     // This timestamp needs to be early enough to ensure the query window
     // starts at or before the beginning of the usage bucket in which the
-    // device boot event occurred. This is achieved by setting the start time
+    // first event occurred. This is achieved by setting the start time
     // to one bucket duration prior to the calculated bootTimeMillis.
     //
     // It is acceptable if this timestamp is not perfectly aligned with exact
     // bucket boundaries or results in covering some redundant data from before
-    // the boot event. Any such duplicated or irrelevant data will be effectively
+    // the event. Any such duplicated or irrelevant data will be effectively
     // subtracted out when calculating usage from the differences of two snapshots,
     // provided both snapshots are queried using this same consistent start timestamp.
-    private long getStartTimestamp() {
-        final long elapsedMillisSinceBoot = SystemClock.elapsedRealtime();
-        final long currentTimeMillis = System.currentTimeMillis();
-        final long bootTimeMillis = currentTimeMillis - elapsedMillisSinceBoot;
-        return bootTimeMillis - MAX_NETSTATS_BUCKET_DURATION_MS;
+    // This must only be called on the handler thread.
+    private void updateStartTimestamp() {
+        mStartTime = mDeps.getCurrentTimeMillis() - mDeps.getMaxBucketDuration();
     }
 
     /**
@@ -294,6 +307,7 @@ public class SatelliteCoarseUsageMetricsCollector {
         // This behavior is not rate-limited because the calling uid is the system UID.
         mNsm.setPollOnOpen(true);
         // Get the first baseline.
+        updateStartTimestamp();
         mSatelliteBaseline = mDeps.getSummary(mNsm, mStartTime);
 
         final NetworkRequest satelliteRequest = new NetworkRequest.Builder()
diff --git a/tests/unit/java/com/android/metrics/SatelliteCoarseUsageMetricsCollectorTest.kt b/tests/unit/java/com/android/metrics/SatelliteCoarseUsageMetricsCollectorTest.kt
index 989fceeeb3..5bde5e4bbc 100644
--- a/tests/unit/java/com/android/metrics/SatelliteCoarseUsageMetricsCollectorTest.kt
+++ b/tests/unit/java/com/android/metrics/SatelliteCoarseUsageMetricsCollectorTest.kt
@@ -34,8 +34,10 @@ import org.junit.runner.RunWith
 import org.mockito.ArgumentCaptor
 import org.mockito.ArgumentMatchers.any
 import org.mockito.ArgumentMatchers.anyLong
-import org.mockito.Mockito.clearInvocations
+import org.mockito.ArgumentMatchers.eq
+import org.mockito.InOrder
 import org.mockito.Mockito.doReturn
+import org.mockito.Mockito.inOrder
 import org.mockito.Mockito.mock
 import org.mockito.Mockito.never
 import org.mockito.Mockito.verify
@@ -51,6 +53,7 @@ import org.mockito.Mockito.verify
 class SatelliteCoarseUsageMetricsCollectorTest {
     companion object {
         const val THREAD_BLOCK_TIMEOUT_MS = 1000L
+        const val TEST_BUCKET_DURATION_MS = 10L
     }
 
     private val mockCm = mock(ConnectivityManager::class.java)
@@ -63,6 +66,7 @@ class SatelliteCoarseUsageMetricsCollectorTest {
     private val mockDeps = mock(SatelliteCoarseUsageMetricsCollector.Dependencies::class.java)
             .also {
                 doReturn(handler).`when`(it).backgroundThreadHandler
+                doReturn(TEST_BUCKET_DURATION_MS).`when`(it).maxBucketDuration
             }
     private val collector = SatelliteCoarseUsageMetricsCollector(mockCtx, mockDeps)
 
@@ -82,23 +86,37 @@ class SatelliteCoarseUsageMetricsCollectorTest {
         doReturn(statsEntry).`when`(mockDeps).getSummary(any(), anyLong())
     }
 
-    private fun assertReportedUsage(rxBytes: Long, txBytes: Long) {
+    private fun assertReportedUsage(inOrder: InOrder, rxBytes: Long, txBytes: Long) {
         val reportedUsageCaptor = ArgumentCaptor.forClass(MyStatsEntry::class.java)
-        verify(mockDeps).reportUsage(reportedUsageCaptor.capture())
+        inOrder.verify(mockDeps).reportUsage(reportedUsageCaptor.capture())
 
         val reportedUsage = reportedUsageCaptor.value
         assertEquals(rxBytes, reportedUsage.rxBytes)
         assertEquals(txBytes, reportedUsage.txBytes)
     }
 
+    private fun mockTime(time: Long) {
+        doReturn(time).`when`(mockDeps).currentTimeMillis
+    }
+
     @Test
     fun testSingleNetwork() {
         val mockNet = mock(Network::class.java)
+        val inOrder = inOrder(mockDeps)
+        mockTime(1000)
         mockGetSummary(100, 50)
         val cb = startMonitoring()
+        inOrder.verify(mockDeps).getSummary(any(), eq(1000 - TEST_BUCKET_DURATION_MS))
+
+        // Advance time, Simulate losing the network. This triggers two getSummary calls:
+        // 1. The first call uses the original start time to calculate the usage difference.
+        // 2. The second call creates a new baseline with an updated start time.
+        mockTime(2000)
         mockGetSummary(300, 150)
         cb.onLost(mockNet)
-        assertReportedUsage(200, 100)
+        inOrder.verify(mockDeps).getSummary(any(), eq(1000 - TEST_BUCKET_DURATION_MS))
+        assertReportedUsage(inOrder, 200, 100)
+        inOrder.verify(mockDeps).getSummary(any(), eq(2000 - TEST_BUCKET_DURATION_MS))
     }
 
     // Test multiple satellite networks. This could happen when telephony creates
@@ -108,26 +126,35 @@ class SatelliteCoarseUsageMetricsCollectorTest {
         // Mock multiple networks, ensuring they are identified as distinct.
         val mockNet1 = Network(1)
         val mockNet2 = Network(2)
+        val inOrder = inOrder(mockDeps)
 
         // Simulate baseline.
+        mockTime(1000)
         mockGetSummary(100, 50)
         val cb = startMonitoring()
+        inOrder.verify(mockDeps).getSummary(any(), eq(1000 - TEST_BUCKET_DURATION_MS))
 
         // Simulate onAvailable events, verify nothing happens.
+        mockTime(2000)
         cb.onAvailable(mockNet1)
         cb.onAvailable(mockNet2)
-        verify(mockDeps, never()).reportUsage(any())
+        inOrder.verify(mockDeps, never()).reportUsage(any())
 
         // Simulate first network lost (not the last), simulate no change at all,
         // verify reportUsage is invoked with zero bytes.
+        mockTime(3000)
         cb.onLost(mockNet1)
-        assertReportedUsage(0L, 0L)
+        inOrder.verify(mockDeps).getSummary(any(), eq(1000 - TEST_BUCKET_DURATION_MS))
+        assertReportedUsage(inOrder, 0L, 0L)
+        inOrder.verify(mockDeps).getSummary(any(), eq(3000 - TEST_BUCKET_DURATION_MS))
 
         // Simulate second network lost (the last one).
-        clearInvocations(mockDeps)
+        mockTime(4000)
         mockGetSummary(300, 150)
         cb.onLost(mockNet2)
-        assertReportedUsage(200L, 100L)
+        inOrder.verify(mockDeps).getSummary(any(), eq(3000 - TEST_BUCKET_DURATION_MS))
+        assertReportedUsage(inOrder, 200L, 100L)
+        inOrder.verify(mockDeps).getSummary(any(), eq(4000 - TEST_BUCKET_DURATION_MS))
     }
 
     @Test

From 84c89b149888b9c4821df23de3f9c242faac2e24 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Sun, 1 Jun 2025 00:47:03 -0700
Subject: [PATCH 331/377] bpf/progs/offload.c: split ipv6 offload for 5.4+
 kernels
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

(no-op prep work for gso support)

Test: TreeHugger
Flag: EXEMPT mainline
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Iff7736b0497f93a2f0df53315e5cb5b990c94eb0
---
 bpf/progs/offload.c | 45 ++++++++++++++++++++++++++++++++++++---------
 1 file changed, 36 insertions(+), 9 deletions(-)

diff --git a/bpf/progs/offload.c b/bpf/progs/offload.c
index e2b283c6db..1c64eb679c 100644
--- a/bpf/progs/offload.c
+++ b/bpf/progs/offload.c
@@ -246,14 +246,28 @@ static inline __always_inline int do_forward6(struct __sk_buff* skb,
     return bpf_redirect(v->oif, 0 /* this is effectively BPF_F_EGRESS */);
 }
 
-DEFINE_BPF_PROG("schedcls/tether_downstream6_ether", AID_ROOT, AID_NETWORK_STACK,
-                sched_cls_tether_downstream6_ether)
+// implementation for 5.4+ (can use skb->gso_{segs,size})
+DEFINE_BPF_PROG_KVER("schedcls/tether_downstream6_ether$5_4", AID_ROOT, AID_NETWORK_STACK,
+                     sched_cls_tether_downstream6_ether_5_4, KVER_5_4)
+(struct __sk_buff* skb) {
+    return do_forward6(skb, ETHER, DOWNSTREAM, KVER_5_4);
+}
+
+DEFINE_BPF_PROG_KVER("schedcls/tether_upstream6_ether$5_4", AID_ROOT, AID_NETWORK_STACK,
+                     sched_cls_tether_upstream6_ether_5_4, KVER_5_4)
+(struct __sk_buff* skb) {
+    return do_forward6(skb, ETHER, UPSTREAM, KVER_5_4);
+}
+
+// implementation for 4.9/4.14/4.19
+DEFINE_BPF_PROG_KVER_RANGE("schedcls/tether_downstream6_ether", AID_ROOT, AID_NETWORK_STACK,
+                           sched_cls_tether_downstream6_ether, KVER_NONE, KVER_5_4)
 (struct __sk_buff* skb) {
     return do_forward6(skb, ETHER, DOWNSTREAM, KVER_NONE);
 }
 
-DEFINE_BPF_PROG("schedcls/tether_upstream6_ether", AID_ROOT, AID_NETWORK_STACK,
-                sched_cls_tether_upstream6_ether)
+DEFINE_BPF_PROG_KVER_RANGE("schedcls/tether_upstream6_ether", AID_ROOT, AID_NETWORK_STACK,
+                           sched_cls_tether_upstream6_ether, KVER_NONE, KVER_5_4)
 (struct __sk_buff* skb) {
     return do_forward6(skb, ETHER, UPSTREAM, KVER_NONE);
 }
@@ -271,15 +285,28 @@ DEFINE_BPF_PROG("schedcls/tether_upstream6_ether", AID_ROOT, AID_NETWORK_STACK,
 // and there is a test in kernel/tests/net/test/bpf_test.py testSkbChangeHead()
 // and in system/netd/tests/binder_test.cpp NetdBinderTest TetherOffloadForwarding.
 //
-// Hence, these mandatory (must load successfully) implementations for 4.14+ kernels:
-DEFINE_BPF_PROG_KVER("schedcls/tether_downstream6_rawip$4_14", AID_ROOT, AID_NETWORK_STACK,
-                     sched_cls_tether_downstream6_rawip_4_14, KVER_4_14)
+// Hence, these mandatory (must load successfully) implementations for 5.4+ kernels:
+DEFINE_BPF_PROG_KVER("schedcls/tether_downstream6_rawip$5_4", AID_ROOT, AID_NETWORK_STACK,
+                     sched_cls_tether_downstream6_rawip_5_4, KVER_5_4)
+(struct __sk_buff* skb) {
+    return do_forward6(skb, RAWIP, DOWNSTREAM, KVER_5_4);
+}
+
+DEFINE_BPF_PROG_KVER("schedcls/tether_upstream6_rawip$5_4", AID_ROOT, AID_NETWORK_STACK,
+                     sched_cls_tether_upstream6_rawip_5_4, KVER_5_4)
+(struct __sk_buff* skb) {
+    return do_forward6(skb, RAWIP, UPSTREAM, KVER_5_4);
+}
+
+// and for 4.14/4.19 kernels
+DEFINE_BPF_PROG_KVER_RANGE("schedcls/tether_downstream6_rawip$4_14", AID_ROOT, AID_NETWORK_STACK,
+                           sched_cls_tether_downstream6_rawip_4_14, KVER_4_14, KVER_5_4)
 (struct __sk_buff* skb) {
     return do_forward6(skb, RAWIP, DOWNSTREAM, KVER_4_14);
 }
 
-DEFINE_BPF_PROG_KVER("schedcls/tether_upstream6_rawip$4_14", AID_ROOT, AID_NETWORK_STACK,
-                     sched_cls_tether_upstream6_rawip_4_14, KVER_4_14)
+DEFINE_BPF_PROG_KVER_RANGE("schedcls/tether_upstream6_rawip$4_14", AID_ROOT, AID_NETWORK_STACK,
+                           sched_cls_tether_upstream6_rawip_4_14, KVER_4_14, KVER_5_4)
 (struct __sk_buff* skb) {
     return do_forward6(skb, RAWIP, UPSTREAM, KVER_4_14);
 }

From 80a2a14a9190a004a60d3cb1101a87fad387ee5f Mon Sep 17 00:00:00 2001
From: Jimi Chen <jimictw@google.com>
Date: Mon, 2 Jun 2025 05:07:18 +0000
Subject: [PATCH 332/377] Skip APF multidevice CTS if device support automotive
 feature

Flag: EXEMPT mainline
Bug: 407637806
Test: TH
Change-Id: I1dff6c2507455451951314ba0298cecb62d4bb17
---
 staticlibs/testutils/host/python/apf_test_base.py            | 5 +++++
 .../multidevices/snippet/ConnectivityMultiDevicesSnippet.kt  | 4 ++++
 2 files changed, 9 insertions(+)

diff --git a/staticlibs/testutils/host/python/apf_test_base.py b/staticlibs/testutils/host/python/apf_test_base.py
index f77dd42603..b0fe28fdf3 100644
--- a/staticlibs/testutils/host/python/apf_test_base.py
+++ b/staticlibs/testutils/host/python/apf_test_base.py
@@ -39,6 +39,11 @@ class ApfTestBase(multi_devices_test_base.MultiDevicesTestBase):
         'NetworkStack is too old to support send raw packet, skip test.',
     )
 
+    asserts.abort_class_if(
+        self.client.hasAutomotiveFeature(),
+        'APF GMS-VSR requirements do not apply to automotive devices, skip'
+        ' test.',
+    )
     # Fetch device properties and storing them locally for later use.
     # TODO: refactor to separate instances to store client and server device
     self.server_iface_name, client_network = (
diff --git a/tests/cts/multidevices/snippet/ConnectivityMultiDevicesSnippet.kt b/tests/cts/multidevices/snippet/ConnectivityMultiDevicesSnippet.kt
index 3f3a6d34f0..feea1247fd 100644
--- a/tests/cts/multidevices/snippet/ConnectivityMultiDevicesSnippet.kt
+++ b/tests/cts/multidevices/snippet/ConnectivityMultiDevicesSnippet.kt
@@ -18,6 +18,7 @@ package com.google.snippet.connectivity
 
 import android.Manifest.permission.NETWORK_SETTINGS
 import android.Manifest.permission.OVERRIDE_WIFI_CONFIG
+import android.content.pm.PackageManager.FEATURE_AUTOMOTIVE
 import android.content.pm.PackageManager.FEATURE_TELEPHONY
 import android.content.pm.PackageManager.FEATURE_WIFI
 import android.net.ConnectivityManager
@@ -81,6 +82,9 @@ class ConnectivityMultiDevicesSnippet : Snippet {
     @Rpc(description = "Check whether the device has telephony feature.")
     fun hasTelephonyFeature() = pm.hasSystemFeature(FEATURE_TELEPHONY)
 
+    @Rpc(description = "Check whether the device has automotive feature.")
+    fun hasAutomotiveFeature() = pm.hasSystemFeature(FEATURE_AUTOMOTIVE)
+
     @Rpc(description = "Check whether the device supporters AP + STA concurrency.")
     fun isStaApConcurrencySupported() = wifiManager.isStaApConcurrencySupported()
 

From 5d79fdffd3cd0533e3cd236beb58f2c2f1fc37a4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Mon, 2 Jun 2025 01:13:06 -0700
Subject: [PATCH 333/377] bpf/progs/offload.c: disable ipv6 offload for non-gso
 >pmtu
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bug: 263884894
Bug: 419747540
Test: TreeHugger
Flag: EXEMPT mainline
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Idecc355084220ea5c53924c720c806adab153b5d
---
 bpf/progs/offload.c | 3 +++
 bpf/progs/offload.h | 1 +
 2 files changed, 4 insertions(+)

diff --git a/bpf/progs/offload.c b/bpf/progs/offload.c
index 1c64eb679c..3937ba634d 100644
--- a/bpf/progs/offload.c
+++ b/bpf/progs/offload.c
@@ -178,6 +178,9 @@ static inline __always_inline int do_forward6(struct __sk_buff* skb,
     uint64_t packets = 1;
     uint64_t L3_bytes = skb->len - l2_header_size;
     if (L3_bytes > v->pmtu) {
+        if (KVER_IS_AT_LEAST(kver, 5, 4, 0)) {
+            if (skb->gso_segs <= 1) TC_PUNT(ABOVE_IPV6_PMTU);
+        }
         const int tcp6_overhead = sizeof(struct ipv6hdr) + sizeof(struct tcphdr) + 12;
         const int mss = v->pmtu - tcp6_overhead;
         const uint64_t payload = L3_bytes - tcp6_overhead;
diff --git a/bpf/progs/offload.h b/bpf/progs/offload.h
index 4d6d3e41f6..870983ec7d 100644
--- a/bpf/progs/offload.h
+++ b/bpf/progs/offload.h
@@ -41,6 +41,7 @@
     ERR(BELOW_IPV4_MTU)       \
     ERR(ABOVE_IPV4_PMTU)      \
     ERR(BELOW_IPV6_MTU)       \
+    ERR(ABOVE_IPV6_PMTU)      \
     ERR(LIMIT_REACHED)        \
     ERR(CHANGE_HEAD_FAILED)   \
     ERR(TOO_SHORT)            \

From 26dd775837028d95e9f9772645f522c4a1fef5f9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Fri, 30 May 2025 12:33:16 -0700
Subject: [PATCH 334/377] bpf/progs/offload.c: improve ipv4 overhead calc &
 pmtu checks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bug: 263884894
Bug: 419747540
Test: TreeHugger
Flag: EXEMPT mainline
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I5978b487d1bd70eea0d49691244a2bc41e9ead11
---
 bpf/progs/offload.c | 26 ++++++++++++++------------
 bpf/progs/offload.h |  1 +
 2 files changed, 15 insertions(+), 12 deletions(-)

diff --git a/bpf/progs/offload.c b/bpf/progs/offload.c
index 3937ba634d..b226ef1855 100644
--- a/bpf/progs/offload.c
+++ b/bpf/progs/offload.c
@@ -417,24 +417,26 @@ static inline __always_inline int do_forward4_bottom(struct __sk_buff* skb,
     // Required IPv4 minimum mtu is 68, below that not clear what we should do, abort...
     if (v->pmtu < 68) TC_PUNT(BELOW_IPV4_MTU);
 
-    // Approximate handling of TCP/IPv4 overhead for incoming LRO/GRO packets: default
-    // outbound path mtu of 1500 is not necessarily correct, but worst case we simply
-    // undercount, which is still better then not accounting for this overhead at all.
-    // Note: this really shouldn't be device/path mtu at all, but rather should be
-    // derived from this particular connection's mss (ie. from gro segment size).
-    // This would require a much newer kernel with newer ebpf accessors.
-    // (This is also blindly assuming 12 bytes of tcp timestamp option in tcp header)
+    // Handling of IPv4 overhead for incoming LRO/GRO packets
     uint64_t packets = 1;
     uint64_t L3_bytes = skb->len - l2_header_size;
     if (L3_bytes > v->pmtu) {
+        // we know it is IPv4 without IP options, and either TCP or UDP
+        const int hdr_sz = sizeof(struct iphdr) + (is_tcp ? tcph->doff * 4 : sizeof(struct udphdr));
+        const uint64_t payload = L3_bytes - hdr_sz;
         if (KVER_IS_AT_LEAST(kver, 5, 4, 0)) {
             if (skb->gso_segs <= 1) TC_PUNT(ABOVE_IPV4_PMTU);
+            // ?udp gso frags: gso_size is variable (thus 0), could this fail to trigger?
+            if (hdr_sz + skb->gso_size > v->pmtu) TC_PUNT(ABOVE_IPV4_PMTU_GSO);
+            packets = skb->gso_segs;
+        } else {
+            // pmtu may be larger then hdr_sz + gso_size, thus we may undercount nr of packets,
+            // which is still better then not accounting for this overhead at all.
+            // We cannot punt over-pmtu gso packets without simply disabling offload entirely...
+            const int mss = v->pmtu - hdr_sz;
+            packets = (payload + mss - 1) / mss;
         }
-        const int tcp4_overhead = sizeof(struct iphdr) + sizeof(struct tcphdr) + 12;
-        const int mss = v->pmtu - tcp4_overhead;
-        const uint64_t payload = L3_bytes - tcp4_overhead;
-        packets = (payload + mss - 1) / mss;
-        L3_bytes = tcp4_overhead * packets + payload;
+        L3_bytes = hdr_sz * packets + payload;
     }
 
     // Are we past the limit?  If so, then abort...
diff --git a/bpf/progs/offload.h b/bpf/progs/offload.h
index 870983ec7d..d36a5552b9 100644
--- a/bpf/progs/offload.h
+++ b/bpf/progs/offload.h
@@ -40,6 +40,7 @@
     ERR(NO_LIMIT_ENTRY)       \
     ERR(BELOW_IPV4_MTU)       \
     ERR(ABOVE_IPV4_PMTU)      \
+    ERR(ABOVE_IPV4_PMTU_GSO)  \
     ERR(BELOW_IPV6_MTU)       \
     ERR(ABOVE_IPV6_PMTU)      \
     ERR(LIMIT_REACHED)        \

From 3035bfd2960ccea661045b6dd8edcceddb76b35a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Mon, 2 Jun 2025 07:14:45 -0700
Subject: [PATCH 335/377] bpf/progs/offload.c: improve ipv6 overhead calc &
 pmtu checks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bug: 263884894
Bug: 419747540
Test: TreeHugger
Flag: EXEMPT mainline
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Icbc3c0dfa1d60f9eec84e41172a2b95a687a50fd
---
 bpf/progs/offload.c | 27 +++++++++++++++------------
 bpf/progs/offload.h |  2 ++
 2 files changed, 17 insertions(+), 12 deletions(-)

diff --git a/bpf/progs/offload.c b/bpf/progs/offload.c
index b226ef1855..b0dc324db7 100644
--- a/bpf/progs/offload.c
+++ b/bpf/progs/offload.c
@@ -98,6 +98,7 @@ static inline __always_inline int do_forward6(struct __sk_buff* skb,
     // Let the kernel's stack handle these cases and generate appropriate ICMP errors.
     if (ip6->hop_limit <= 1) TC_PUNT(LOW_TTL);
 
+    int gso_hdr_size = sizeof(struct ipv6hdr);
     // If hardware offload is running and programming flows based on conntrack entries,
     // try not to interfere with it.
     if (ip6->nexthdr == IPPROTO_TCP) {
@@ -117,6 +118,10 @@ static inline __always_inline int do_forward6(struct __sk_buff* skb,
 
         // Do not offload TCP packets with any one of the SYN/FIN/RST flags
         if (tcph->syn || tcph->fin || tcph->rst) TC_PUNT(TCPV6_CONTROL_PACKET);
+
+        gso_hdr_size += tcph->doff * 4;
+    } else if (ip6->nexthdr == IPPROTO_UDP) {
+        gso_hdr_size += sizeof(struct udphdr);
     }
 
     // Protect against forwarding packets sourced from ::1 or fe80::/64 or other weirdness.
@@ -168,24 +173,22 @@ static inline __always_inline int do_forward6(struct __sk_buff* skb,
     // Required IPv6 minimum mtu is 1280, below that not clear what we should do, abort...
     if (v->pmtu < IPV6_MIN_MTU) TC_PUNT(BELOW_IPV6_MTU);
 
-    // Approximate handling of TCP/IPv6 overhead for incoming LRO/GRO packets: default
-    // outbound path mtu of 1500 is not necessarily correct, but worst case we simply
-    // undercount, which is still better then not accounting for this overhead at all.
-    // Note: this really shouldn't be device/path mtu at all, but rather should be
-    // derived from this particular connection's mss (ie. from gro segment size).
-    // This would require a much newer kernel with newer ebpf accessors.
-    // (This is also blindly assuming 12 bytes of tcp timestamp option in tcp header)
+    // Handling of IPv6 overhead for incoming LRO/GRO packets
     uint64_t packets = 1;
     uint64_t L3_bytes = skb->len - l2_header_size;
     if (L3_bytes > v->pmtu) {
+        if (gso_hdr_size == sizeof(struct ipv6hdr)) TC_PUNT(UNKNOWN_IPV6_GSO);
+        const int mss = v->pmtu - gso_hdr_size;
+        const uint64_t payload = L3_bytes - gso_hdr_size;
         if (KVER_IS_AT_LEAST(kver, 5, 4, 0)) {
             if (skb->gso_segs <= 1) TC_PUNT(ABOVE_IPV6_PMTU);
+            // ?udp gso frags: gso_size is variable (thus 0), could this fail to trigger?
+            if (gso_hdr_size + skb->gso_size > v->pmtu) TC_PUNT(ABOVE_IPV6_PMTU_GSO);
+            packets = skb->gso_segs;
+        } else {
+            packets = (payload + mss - 1) / mss;
         }
-        const int tcp6_overhead = sizeof(struct ipv6hdr) + sizeof(struct tcphdr) + 12;
-        const int mss = v->pmtu - tcp6_overhead;
-        const uint64_t payload = L3_bytes - tcp6_overhead;
-        packets = (payload + mss - 1) / mss;
-        L3_bytes = tcp6_overhead * packets + payload;
+        L3_bytes = gso_hdr_size * packets + payload;
     }
 
     // Are we past the limit?  If so, then abort...
diff --git a/bpf/progs/offload.h b/bpf/progs/offload.h
index d36a5552b9..a4f72ba4b6 100644
--- a/bpf/progs/offload.h
+++ b/bpf/progs/offload.h
@@ -43,6 +43,8 @@
     ERR(ABOVE_IPV4_PMTU_GSO)  \
     ERR(BELOW_IPV6_MTU)       \
     ERR(ABOVE_IPV6_PMTU)      \
+    ERR(ABOVE_IPV6_PMTU_GSO)  \
+    ERR(UNKNOWN_IPV6_GSO)     \
     ERR(LIMIT_REACHED)        \
     ERR(CHANGE_HEAD_FAILED)   \
     ERR(TOO_SHORT)            \

From 7d82de4f3e04750139247b16673088d80d98b6c1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Mon, 2 Jun 2025 07:48:58 -0700
Subject: [PATCH 336/377] bpf/progs/netd.c: use skb->gso_segs when possible
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use skb->gso_segs to calculate the number of segments.
This removes the need to estimate the segment count on our own.
This will improve the accuracy of the accounting.

Bug: 263884894
Flag: EXEMPT mainline
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ibc7da2fcd968d6871fca32527cd8c6d694d77452
---
 bpf/progs/netd.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/bpf/progs/netd.c b/bpf/progs/netd.c
index 223e6c73c3..324e1484f7 100644
--- a/bpf/progs/netd.c
+++ b/bpf/progs/netd.c
@@ -193,13 +193,14 @@ DEFINE_BPF_MAP_EXT(local_net_blocked_uid_map, HASH, uint32_t, bool, -1000,
             uint64_t packets = 1;                                                                \
             uint64_t bytes = skb->len;                                                           \
             if (bytes > mtu) {                                                                   \
-                bool is_ipv6 = (skb->protocol == htons(ETH_P_IPV6));                             \
-                int ip_overhead = (is_ipv6 ? sizeof(struct ipv6hdr) : sizeof(struct iphdr));     \
-                int tcp_overhead = ip_overhead + sizeof(struct tcphdr) + 12;                     \
-                int mss = mtu - tcp_overhead;                                                    \
-                uint64_t payload = bytes - tcp_overhead;                                         \
-                packets = (payload + mss - 1) / mss;                                             \
-                bytes = tcp_overhead * packets + payload;                                        \
+                const bool is_ipv6 = (skb->protocol == htons(ETH_P_IPV6));                       \
+                const int ip_overhead = is_ipv6 ? sizeof(struct ipv6hdr) : sizeof(struct iphdr); \
+                const int overhead = ip_overhead + sizeof(struct tcphdr) + 12;                   \
+                const int mss = mtu - overhead;                                                  \
+                const uint64_t payload = bytes - overhead;                                       \
+                const bool is_5_4 = KVER_IS_AT_LEAST(kver, 5, 4, 0);                             \
+                packets = is_5_4 ? skb->gso_segs : (payload + mss - 1) / mss;                    \
+                bytes = overhead * packets + payload;                                            \
             }                                                                                    \
             if (egress.egress) {                                                                 \
                 __sync_fetch_and_add(&value->txPackets, packets);                                \

From b33d755683aaf08d396d7d8302fd340630cc7893 Mon Sep 17 00:00:00 2001
From: Diego Valenzuela <dvalenzuela@google.com>
Date: Thu, 22 May 2025 10:06:54 -0700
Subject: [PATCH 337/377] Integrate a fix to avoid calculation of socket key
 when the datagram does not has an ip address.

Bug:419554480

This is not used in platform code. This code path is only used when the
mDNS stack is used as a library.

Flag: EXEMPT dead code in the platform
Test: - Use a pre-S device to test.
 - Test with the updated library and integration with Cast sample to test.
Change-Id: I94d3c8a8bacf8581f44760d41afba830cdd09252
---
 .../server/connectivity/mdns/MdnsSocketClient.java    | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/service-t/src/com/android/server/connectivity/mdns/MdnsSocketClient.java b/service-t/src/com/android/server/connectivity/mdns/MdnsSocketClient.java
index dceb9078b2..40039c5682 100644
--- a/service-t/src/com/android/server/connectivity/mdns/MdnsSocketClient.java
+++ b/service-t/src/com/android/server/connectivity/mdns/MdnsSocketClient.java
@@ -35,6 +35,7 @@ import com.android.server.connectivity.mdns.util.MdnsUtils;
 
 import java.io.IOException;
 import java.net.DatagramPacket;
+import java.net.InetAddress;
 import java.net.Inet4Address;
 import java.net.Inet6Address;
 import java.net.InetSocketAddress;
@@ -458,8 +459,14 @@ public class MdnsSocketClient implements MdnsSocketClientBase {
 
                 if (!shouldStopSocketLoop) {
                     String responseType = socket == multicastSocket ? MULTICAST_TYPE : UNICAST_TYPE;
-                    final SocketKey key = mdnsFeatureFlags.mIsSocketClientNetworkGuessingEnabled
-                            ? interfaceProvider.guessNetworkOfRemoteHost(packet.getAddress())
+                    // packet.getAddress() can return:
+                    // an IP address of the machine to which this datagram is being sent or
+                    // from which the datagram was received
+                    // or {@code null} if not set.
+                    final InetAddress packetAddress = packet.getAddress();
+                    final SocketKey key =
+                        (mdnsFeatureFlags.mIsSocketClientNetworkGuessingEnabled && packetAddress != null)
+                            ? interfaceProvider.guessNetworkOfRemoteHost(packetAddress)
                             : null;
                     final int interfaceIndex;
                     if (socket == null || !propagateInterfaceIndex) {

From f1f59d721d9027ab54ff22a1788ac07d03a2fe7d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Mon, 2 Jun 2025 15:45:36 -0700
Subject: [PATCH 338/377] bpf/progs/offload.c: add comment about pmtu
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bug: 263884894
Flag: EXEMPT mainline
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I34c8d033ee0da34fc6db4d6093ed6a10c57c0dc1
---
 bpf/progs/offload.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/bpf/progs/offload.c b/bpf/progs/offload.c
index b0dc324db7..ae6f9aea95 100644
--- a/bpf/progs/offload.c
+++ b/bpf/progs/offload.c
@@ -176,6 +176,8 @@ static inline __always_inline int do_forward6(struct __sk_buff* skb,
     // Handling of IPv6 overhead for incoming LRO/GRO packets
     uint64_t packets = 1;
     uint64_t L3_bytes = skb->len - l2_header_size;
+    // I don't trust v->pmtu to not be higher then it should be: it might just
+    // be device (instead of path/route/ipv6) mtu and that itself might be wrong...
     if (L3_bytes > v->pmtu) {
         if (gso_hdr_size == sizeof(struct ipv6hdr)) TC_PUNT(UNKNOWN_IPV6_GSO);
         const int mss = v->pmtu - gso_hdr_size;
@@ -423,6 +425,8 @@ static inline __always_inline int do_forward4_bottom(struct __sk_buff* skb,
     // Handling of IPv4 overhead for incoming LRO/GRO packets
     uint64_t packets = 1;
     uint64_t L3_bytes = skb->len - l2_header_size;
+    // I don't trust v->pmtu to not be higher then it should be: it might just
+    // be device (instead of path/route) mtu and that itself might be wrong...
     if (L3_bytes > v->pmtu) {
         // we know it is IPv4 without IP options, and either TCP or UDP
         const int hdr_sz = sizeof(struct iphdr) + (is_tcp ? tcph->doff * 4 : sizeof(struct udphdr));

From 5138000196b25bed11fb4593fb0ab0247d8b257c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Mon, 2 Jun 2025 16:03:03 -0700
Subject: [PATCH 339/377] bpf/progs/netd.c: split 5.4+ specific cgroup
 in/egress progs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Test: TreeHugger
Flag: EXEMPT mainline
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ic58ed5117b2ea9e654597aa57c201707695d3eca
---
 bpf/progs/netd.c | 30 ++++++++++++++++++++++--------
 1 file changed, 22 insertions(+), 8 deletions(-)

diff --git a/bpf/progs/netd.c b/bpf/progs/netd.c
index 324e1484f7..9b72ee16b2 100644
--- a/bpf/progs/netd.c
+++ b/bpf/progs/netd.c
@@ -631,11 +631,18 @@ DEFINE_NETD_BPF_PROG_RANGES("cgroupskb/ingress/stats$5_10_u",
     return bpf_traffic_account(skb, INGRESS, KVER_5_10, SDK_LEVEL_U);
 }
 
-// Android T/U/V 4.19 & T/U/V/25Q2 5.4 & T 5.10/5.15
-DEFINE_NETD_BPF_PROG_KVER_RANGE("cgroupskb/ingress/stats$4_19",
-                                bpf_cgroup_ingress_4_19, KVER_4_19, KVER_INF)
+// Android T/U/V/25Q2 5.4 & T 5.10/5.15
+DEFINE_NETD_BPF_PROG_KVER_RANGE("cgroupskb/ingress/stats$5_4",
+                                bpf_cgroup_ingress_5_4, KVER_5_4, KVER_INF)
 (struct __sk_buff* skb) {
-    return bpf_traffic_account(skb, INGRESS, KVER_4_19, SDK_LEVEL_T);
+    return bpf_traffic_account(skb, INGRESS, KVER_5_4, SDK_LEVEL_T);
+}
+
+// Android T/U/V 4.19
+DEFINE_NETD_BPF_PROG_KVER_RANGE("cgroupskb/ingress/stats$4_19",
+                               bpf_cgroup_ingress_4_19, KVER_4_19, KVER_5_4)
+(struct __sk_buff* skb) {
+return bpf_traffic_account(skb, INGRESS, KVER_4_19, SDK_LEVEL_T);
 }
 
 // Android T 4.9 & T/U 4.14
@@ -671,11 +678,18 @@ DEFINE_NETD_BPF_PROG_RANGES("cgroupskb/egress/stats$5_10_u",
     return bpf_traffic_account(skb, EGRESS, KVER_5_10, SDK_LEVEL_U);
 }
 
-// Android T/U/V 4.19 & T/U/V/25Q2 5.4 & T 5.10/5.15
-DEFINE_NETD_BPF_PROG_KVER_RANGE("cgroupskb/egress/stats$4_19",
-                                bpf_cgroup_egress_4_19, KVER_4_19, KVER_INF)
+// Android T/U/V/25Q2 5.4 & T 5.10/5.15
+DEFINE_NETD_BPF_PROG_KVER_RANGE("cgroupskb/egress/stats$5_4",
+                                bpf_cgroup_egress_5_4, KVER_5_4, KVER_INF)
 (struct __sk_buff* skb) {
-    return bpf_traffic_account(skb, EGRESS, KVER_4_19, SDK_LEVEL_T);
+    return bpf_traffic_account(skb, EGRESS, KVER_5_4, SDK_LEVEL_T);
+}
+
+// Android T/U/V 4.19
+DEFINE_NETD_BPF_PROG_KVER_RANGE("cgroupskb/egress/stats$4_19",
+                                bpf_cgroup_egress_4_19, KVER_4_19, KVER_5_4)
+(struct __sk_buff* skb) {
+return bpf_traffic_account(skb, EGRESS, KVER_4_19, SDK_LEVEL_T);
 }
 
 // Android T 4.9 & T/U 4.14

From cc0f6828505f53b508c454a9d95450b8c0b99da7 Mon Sep 17 00:00:00 2001
From: Junyu Lai <junyulai@google.com>
Date: Mon, 2 Jun 2025 20:30:30 +0800
Subject: [PATCH 340/377] Sync change DefaultNetworkRematchInfo to repeated to
 Connectivity

Test: TH
Flag: EXEMPT atom definition only change
Bug: 419123367
Change-Id: I42715ac12ae3b03ba72d2f631b23ebb4ebbdea2e
---
 service/src/com/android/metrics/stats.proto | 26 ++++++++++++++-------
 1 file changed, 17 insertions(+), 9 deletions(-)

diff --git a/service/src/com/android/metrics/stats.proto b/service/src/com/android/metrics/stats.proto
index 39c50508c1..acde9c6e40 100644
--- a/service/src/com/android/metrics/stats.proto
+++ b/service/src/com/android/metrics/stats.proto
@@ -266,30 +266,38 @@ message NetworkSelectionRematchReasonsInfo {
 }
 
 /**
- * Logs rematch information for the default network
+ * Logs rematch event for the default network
  *
  * Logs from:
  *   packages/modules/Connectivity/service/src/com/android/server/ConnectivityService.java
  */
-message DefaultNetworkRematchInfo {
+message DefaultNetworkRematch {
     // The session id comes from each reboot, this is used to correlate the statistics of the
     // networkselect on the same boot
     optional int64 session_id = 1;
 
+    // The reason of network rematch
+    optional .android.stats.connectivity.RematchReason rematch_reason = 2;
+
+    optional DefaultNetworkRematchInfoList default_network_rematch_info_list = 3;
+}
+
+message DefaultNetworkRematchInfoList {
+    repeated DefaultNetworkRematchInfo default_network_rematch_info = 1;
+}
+
+message DefaultNetworkRematchInfo {
     // The information of old device default network
-    optional NetworkDescription old_network = 2;
+    optional NetworkDescription old_network = 1;
 
     // The information of new device default network
-    optional NetworkDescription new_network = 3;
-
-    // The reason of network rematch
-    optional .android.stats.connectivity.RematchReason rematch_reason = 4;
+    optional NetworkDescription new_network = 2;
 
     // The time duration the device kept the old network as the default in seconds
-    optional int32 time_duration_on_old_network_sec = 5;
+    optional int32 time_duration_on_old_network_sec = 3;
 
     // Uid ranges which applied to this event.
-    optional UidRanges uid_ranges = 6;
+    optional UidRanges uid_ranges = 4;
 }
 
 message UidRanges {

From d964253878fd2cb1947c16b24559abaf0db90263 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Mon, 2 Jun 2025 08:02:00 -0700
Subject: [PATCH 341/377] bpf/progs/netd.c: use more correct gso size overhead
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

(still not quite right for TCP...)

Bug: 263884894
Flag: EXEMPT mainline
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ie7d63b5bb0acf724f9ffaf57b4e78dda5648e37d
---
 bpf/progs/netd.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/bpf/progs/netd.c b/bpf/progs/netd.c
index 9b72ee16b2..93ef5c5f21 100644
--- a/bpf/progs/netd.c
+++ b/bpf/progs/netd.c
@@ -193,13 +193,16 @@ DEFINE_BPF_MAP_EXT(local_net_blocked_uid_map, HASH, uint32_t, bool, -1000,
             uint64_t packets = 1;                                                                \
             uint64_t bytes = skb->len;                                                           \
             if (bytes > mtu) {                                                                   \
+                const bool is5_4 = KVER_IS_AT_LEAST(kver, 5, 4, 0);                              \
                 const bool is_ipv6 = (skb->protocol == htons(ETH_P_IPV6));                       \
                 const int ip_overhead = is_ipv6 ? sizeof(struct ipv6hdr) : sizeof(struct iphdr); \
-                const int overhead = ip_overhead + sizeof(struct tcphdr) + 12;                   \
+                struct bpf_sock * const sk = is5_4 && skb->sk ? bpf_sk_fullsock(skb->sk) : NULL; \
+                const bool is_tcp = !sk || sk->protocol == IPPROTO_TCP;                          \
+                const int L4_size = is_tcp ? sizeof(struct tcphdr) + 12 : sizeof(struct udphdr); \
+                const int overhead = ip_overhead + L4_size;                                      \
                 const int mss = mtu - overhead;                                                  \
                 const uint64_t payload = bytes - overhead;                                       \
-                const bool is_5_4 = KVER_IS_AT_LEAST(kver, 5, 4, 0);                             \
-                packets = is_5_4 ? skb->gso_segs : (payload + mss - 1) / mss;                    \
+                packets = is5_4 ? skb->gso_segs : (payload + mss - 1) / mss;                     \
                 bytes = overhead * packets + payload;                                            \
             }                                                                                    \
             if (egress.egress) {                                                                 \

From 2fba8b1a7aadf38dd059cc348e34d3c49a8fec97 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Tue, 3 Jun 2025 15:03:56 -0700
Subject: [PATCH 342/377] clatd: disable AARCH64 specific seccomp kill filter
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

(while investigating observed failures)

Bug: 418375944
Test: TreeHugger
Flag: EXEMPT mainline
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I1b34d172eb4fd5d631046db47c3d9be39d21b903
---
 clatd/main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/clatd/main.c b/clatd/main.c
index 9e5710e600..a98155bcc0 100644
--- a/clatd/main.c
+++ b/clatd/main.c
@@ -152,7 +152,7 @@ void enable_seccomp(void) {
     // _exit(0)
     BPF2_SECCOMP_ALLOW_IF_EQUAL(__NR_exit_group),    // 94
 
-#if defined(__aarch64__)
+#if defined(__aarch64__) && 0  // disabled
     // Pixels are aarch64 - if we break clatd functionality on them,
     // we *will* notice on GoogleGuest WiFi network (which is ipv6 only)
     BPF_SECCOMP_KILL,

From 7c2b72901d05340b461e39e301b5a5eda125d7d0 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Mon, 2 Jun 2025 15:04:23 -0700
Subject: [PATCH 343/377] Test EthernetTracker#trackAvailableInterfaces

Coverage for this code path was removed a while ago, because the old
test relied on the old implementation of setEthernetEnabled(). This test
adds a similar test based on setIncludeTestInterfaces() instead, which
calls the trackAvailableInterfaces() code path.
trackAvailableInterfaces() is used when the ethernet service first
starts up (either at boot, or after a system server crash).

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I635031bb670ef62d4ccd0cb67d282ee907219089
---
 .../android/net/cts/EthernetManagerTest.kt    | 30 +++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/tests/cts/net/src/android/net/cts/EthernetManagerTest.kt b/tests/cts/net/src/android/net/cts/EthernetManagerTest.kt
index b1b237ed1d..6b3bfdaaf9 100644
--- a/tests/cts/net/src/android/net/cts/EthernetManagerTest.kt
+++ b/tests/cts/net/src/android/net/cts/EthernetManagerTest.kt
@@ -667,6 +667,36 @@ class EthernetManagerTest {
         listener.assertNoCallback()
     }
 
+    @Test
+    fun testCallbacks_withRunningInterfaces() {
+        // Do not run this test when unrestricted interfaces are present. Refer to testCallbacks.
+        assumeNoInterfaceForTetheringAvailable()
+
+        // The interfaces must be created before setIncludeTestInterfaces is set to false, so the
+        // test can ensure that the RTM_NEWLINK has been processed before proceeding.
+        val iface1 = createInterface()
+        val iface2 = createInterface()
+        val iface3 = createInterface()
+
+        // Prevent test interfaces from being tracked and wait for the call to be processed by
+        // calling setEthernetEnabled() which waits on a completion callback.
+        setIncludeTestInterfaces(false)
+        setEthernetEnabled(true)
+
+        val listener = EthernetStateListener()
+        addInterfaceStateListener(listener)
+        listener.assertNoCallback()
+
+        // Include test interfaces again, and ensure that they are tracked properly.
+        setIncludeTestInterfaces(true)
+        setEthernetEnabled(true)
+
+        listener.expectCallback(iface1, STATE_LINK_UP, ROLE_CLIENT)
+        listener.expectCallback(iface2, STATE_LINK_UP, ROLE_CLIENT)
+        listener.expectCallback(iface3, STATE_LINK_UP, ROLE_CLIENT)
+        listener.assertNoCallback()
+    }
+
     @Test
     fun testGetInterfaceList() {
         // Create two test interfaces and check the return list contains the interface names.

From 1a2b238bc1466e7d0a252ab38b959d4df918aeeb Mon Sep 17 00:00:00 2001
From: Quang Anh Luong <qal@google.com>
Date: Tue, 3 Jun 2025 14:59:07 +0900
Subject: [PATCH 344/377] Remove pending BT request when service disconnects

If the PAN service disconnects before the BT iface is available, the BT
TetheringRequest will be stuck pending and prevent any new BT
startTethering attempts. This may happen if the user turns BT tethering
on and turns off BT without connecting to any device.

Fix this by always removing the pending BT request when the PAN service
disconnects.

Flag: EXEMPT minor bugfix

Bug: 420412916
Test: atest TetheringTest, manually verify turning BT tethering on,
turning off BT, and turning BT tethering on again.

Change-Id: I6bc96d6e4016d83af6cfd8e549d474ce651a44fc
---
 .../networkstack/tethering/Tethering.java     | 16 +++---
 .../networkstack/tethering/TetheringTest.java | 53 ++++++++++++++++---
 2 files changed, 54 insertions(+), 15 deletions(-)

diff --git a/Tethering/src/com/android/networkstack/tethering/Tethering.java b/Tethering/src/com/android/networkstack/tethering/Tethering.java
index 771a9ff7b0..00103d68af 100644
--- a/Tethering/src/com/android/networkstack/tethering/Tethering.java
+++ b/Tethering/src/com/android/networkstack/tethering/Tethering.java
@@ -960,13 +960,15 @@ public class Tethering {
                 // reachable before next onServiceConnected.
                 mIsConnected = false;
 
-                if (mPendingPanRequestListener != null) {
-                    sendTetherResultAndRemoveOnError(
-                            mRequestTracker.getOrCreatePendingRequest(TETHERING_BLUETOOTH),
-                            mPendingPanRequestListener,
-                            TETHER_ERROR_SERVICE_UNAVAIL);
-                }
-                mPendingPanRequestListener = null;
+                // Remove any pending request even if bluetooth tethering is not started.
+                // Call sendTetherResultAndRemoveOnError for convenience (and to update the metrics)
+                // even though mPendingPanRequestListener is guaranteed to be null here (when the
+                // service connects onServiceConnected sets it to null, and whenever the service is
+                // connected, it's never set to non-null).
+                sendTetherResultAndRemoveOnError(
+                        mRequestTracker.getOrCreatePendingRequest(TETHERING_BLUETOOTH),
+                        null /* listener */,
+                        TETHER_ERROR_SERVICE_UNAVAIL);
                 mBluetoothIfaceRequest = null;
                 mBluetoothCallback = null;
                 maybeDisableBluetoothIpServing();
diff --git a/Tethering/tests/unit/src/com/android/networkstack/tethering/TetheringTest.java b/Tethering/tests/unit/src/com/android/networkstack/tethering/TetheringTest.java
index a68bc51be9..5614a35219 100644
--- a/Tethering/tests/unit/src/com/android/networkstack/tethering/TetheringTest.java
+++ b/Tethering/tests/unit/src/com/android/networkstack/tethering/TetheringTest.java
@@ -3292,6 +3292,10 @@ public class TetheringTest {
 
         @Override
         public void onResult(final int resultCode) {
+            if (mHasResult) {
+                fail("Received result: " + resultCode + ", but we already have a result: "
+                        + mExpectedResult);
+            }
             mHasResult = true;
             if (resultCode != mExpectedResult) {
                 fail("expected result: " + mExpectedResult + " but actual result: " + resultCode);
@@ -3314,11 +3318,9 @@ public class TetheringTest {
         final LinkAddress serverLinkAddr = new LinkAddress("192.168.20.1/24");
         final LinkAddress clientLinkAddr = new LinkAddress("192.168.20.42/24");
         final String serverAddr = "192.168.20.1";
-        final ResultListener firstResult = new ResultListener(TETHER_ERROR_NO_ERROR);
-        final ResultListener secondResult = new ResultListener(TETHER_ERROR_NO_ERROR);
-        final ResultListener thirdResult = new ResultListener(TETHER_ERROR_NO_ERROR);
 
         // Enable USB tethering and check that Tethering starts USB.
+        final ResultListener firstResult = new ResultListener(TETHER_ERROR_NO_ERROR);
         mTethering.startTethering(createTetheringRequest(TETHERING_USB), TEST_CALLER_PKG,
                 firstResult);
         mLooper.dispatchAll();
@@ -3327,6 +3329,7 @@ public class TetheringTest {
         verifyNoMoreInteractions(mUsbManager);
 
         // Enable USB tethering again with the same request and expect no change to USB.
+        final ResultListener secondResult = new ResultListener(TETHER_ERROR_NO_ERROR);
         mTethering.startTethering(createTetheringRequest(TETHERING_USB), TEST_CALLER_PKG,
                 secondResult);
         mLooper.dispatchAll();
@@ -3336,22 +3339,24 @@ public class TetheringTest {
 
         // Enable USB tethering again with the same request but different uid/package and expect no
         // change to USB.
+        final ResultListener thirdResult = new ResultListener(TETHER_ERROR_NO_ERROR);
         TetheringRequest differentUidPackage = createTetheringRequest(TETHERING_USB);
         differentUidPackage.setUid(TEST_CALLER_UID_2);
         differentUidPackage.setPackageName(TEST_CALLER_PKG_2);
-        mTethering.startTethering(differentUidPackage, TEST_CALLER_PKG_2, secondResult);
+        mTethering.startTethering(differentUidPackage, TEST_CALLER_PKG_2, thirdResult);
         mLooper.dispatchAll();
-        secondResult.assertHasResult();
+        thirdResult.assertHasResult();
         verify(mUsbManager, never()).setCurrentFunctions(UsbManager.FUNCTION_NONE);
         reset(mUsbManager);
 
         // Enable USB tethering with a different request and expect that USB is stopped and
         // started.
+        final ResultListener fourthResult = new ResultListener(TETHER_ERROR_NO_ERROR);
         mTethering.startTethering(createTetheringRequest(TETHERING_USB,
                   serverLinkAddr, clientLinkAddr, false, CONNECTIVITY_SCOPE_GLOBAL, null),
-                  TEST_CALLER_PKG, thirdResult);
+                  TEST_CALLER_PKG, fourthResult);
         mLooper.dispatchAll();
-        thirdResult.assertHasResult();
+        fourthResult.assertHasResult();
         verify(mUsbManager, times(1)).setCurrentFunctions(UsbManager.FUNCTION_NONE);
         verify(mUsbManager, times(1)).setCurrentFunctions(UsbManager.FUNCTION_RNDIS);
 
@@ -3988,6 +3993,38 @@ public class TetheringTest {
         verifyNetdCommandForBtTearDown();
     }
 
+    @Test
+    @IgnoreUpTo(Build.VERSION_CODES.S_V2)
+    public void testPendingBluetoothRequestRemovedWhenPanServiceDisconnectsBeforeIfaceAvailable()
+            throws Exception {
+        initTetheringOnTestThread();
+
+        final ResultListener result = new ResultListener(TETHER_ERROR_NO_ERROR);
+        mockBluetoothSettings(true /* bluetoothOn */, true /* tetheringOn */);
+        mTethering.startTethering(createTetheringRequest(TETHERING_BLUETOOTH),
+                TEST_CALLER_PKG, result);
+        mLooper.dispatchAll();
+        ServiceListener serviceListener =
+                verifySetBluetoothTethering(true /* enable */, true /* bindToPanService */);
+        result.assertHasResult();
+
+        // Mock BT turning off
+        serviceListener.onServiceDisconnected(BluetoothProfile.PAN);
+        mLooper.dispatchAll();
+
+        // Pending request should be removed
+        assertTrue(mTethering.getPendingTetheringRequests().isEmpty());
+        // Mock BT tethering started again should succeed
+        final ResultListener result2 = new ResultListener(TETHER_ERROR_NO_ERROR);
+        mockBluetoothSettings(true /* bluetoothOn */, true /* tetheringOn */);
+        mTethering.startTethering(createTetheringRequest(TETHERING_BLUETOOTH),
+                TEST_CALLER_PKG, result2);
+        serviceListener.onServiceConnected(BluetoothProfile.PAN, mBluetoothPan);
+        mLooper.dispatchAll();
+        verifySetBluetoothTethering(true /* enable */, false /* bindToPanService */);
+        result2.assertHasResult();
+    }
+
     @Test
     @IgnoreAfter(Build.VERSION_CODES.S_V2)
     public void testBluetoothTetheringBeforeT() throws Exception {
@@ -4203,7 +4240,7 @@ public class TetheringTest {
         }
         verify(mBluetoothPan).isTetheringOn();
         verifyNoMoreInteractions(mBluetoothAdapter, mBluetoothPan);
-        reset(mBluetoothAdapter, mBluetoothPan);
+        reset(mBluetoothAdapter, mBluetoothPan, mBluetoothPanShim);
 
         return listener;
     }

From 816ad97d6164b7373727c79ce7c5e881fde8d93c Mon Sep 17 00:00:00 2001
From: Xiao Ma <xiaom@google.com>
Date: Fri, 30 May 2025 16:38:53 +0900
Subject: [PATCH 345/377] DHCPv6 addr reg: add IA Address option id (5).

ADDR_REG_INFORM and ADDR_REG_REPLY message will take this option to
represent the IPv6 address to be registered.

Flag: EXEMPT guarded by an legacy experiment flag
Bug: 293393743
Test: TH
Change-Id: Ib4b86069dfb504cee948ef3880ccf1ee8ea5d5b9
---
 .../net/module/util/dhcp6/Dhcp6Packet.java     | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java
index 3990dd3fcc..ee70dbbc11 100644
--- a/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java
+++ b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java
@@ -20,6 +20,7 @@ import android.net.MacAddress;
 import android.util.Log;
 
 import androidx.annotation.NonNull;
+import androidx.annotation.Nullable;
 
 import com.android.internal.annotations.VisibleForTesting;
 import com.android.net.module.util.HexDump;
@@ -80,8 +81,16 @@ public class Dhcp6Packet {
      * DHCPv6 Optional Type: Server Identifier.
      */
     public static final byte DHCP6_SERVER_IDENTIFIER = 2;
+    @Nullable
     protected final byte[] mServerDuid;
 
+    /**
+     * DHCPv6 Optional Type: IA Address option.
+     */
+    public static final byte DHCP6_IA_ADDR = 5;
+    @Nullable
+    protected byte[] mIaAddress;
+
     /**
      * DHCPv6 Optional Type: Option Request Option.
      */
@@ -198,10 +207,19 @@ public class Dhcp6Packet {
     /**
      * Returns the server's DUID.
      */
+    @Nullable
     public byte[] getServerDuid() {
         return mServerDuid;
     }
 
+    /**
+     * Returns the IA Address option.
+     */
+    @Nullable
+    public byte[] getIaAddress() {
+        return mIaAddress;
+    }
+
     /**
      * Returns the SOL_MAX_RT option value in milliseconds.
      */

From e3ac6c4c95a74c5f7d412d2d7cf5238592d88228 Mon Sep 17 00:00:00 2001
From: Xiao Ma <xiaom@google.com>
Date: Fri, 30 May 2025 16:44:50 +0900
Subject: [PATCH 346/377] DHCPv6 addr reg: add ADDR_REG_INFORM packet class.

Flag: EXEMPT guarded by an legacy experiment flag
Bug: 293393743
Test: TH
Change-Id: I74c3412238377454d914c1b550f000621be411e7
---
 .../util/dhcp6/Dhcp6AddrRegInformPacket.java  | 56 +++++++++++++++++++
 1 file changed, 56 insertions(+)
 create mode 100644 staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6AddrRegInformPacket.java

diff --git a/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6AddrRegInformPacket.java b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6AddrRegInformPacket.java
new file mode 100644
index 0000000000..265c41ffa8
--- /dev/null
+++ b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6AddrRegInformPacket.java
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.net.module.util.dhcp6;
+
+import static com.android.net.module.util.NetworkStackConstants.DHCP_MAX_LENGTH;
+
+import androidx.annotation.NonNull;
+
+import java.nio.ByteBuffer;
+
+/**
+ * DHCPv6 ADDR-REG-INFORM packet class, a client sends an an ADDR-REG-INFORM message to register
+ * an IPv6 address is in use to DHCPv6 addr-reg server.
+ *
+ * https://www.rfc-editor.org/rfc/rfc9686.html#section-4.2
+ */
+public class Dhcp6AddrRegInformPacket extends Dhcp6Packet {
+    /**
+     * Generates a ADDR-REG-INFORM packet with the specified parameters.
+     */
+    Dhcp6AddrRegInformPacket(int transId, int elapsedTime, @NonNull final byte[] clientDuid,
+            @NonNull final byte[] iaAddress) {
+        super(transId, elapsedTime, clientDuid, null /* serverDuid */, null /* iapd */);
+        mIaAddress = iaAddress;
+    }
+
+    /**
+     * Build a DHCPv6 ADDR-REG-INFORM message with the specific parameters.
+     */
+    public ByteBuffer buildPacket() {
+        final ByteBuffer packet = ByteBuffer.allocate(DHCP_MAX_LENGTH);
+        final int msgTypeAndTransId = (DHCP6_MESSAGE_TYPE_ADDR_REG_INFORM << 24) | mTransId;
+        packet.putInt(msgTypeAndTransId);
+
+        addTlv(packet, DHCP6_CLIENT_IDENTIFIER, mClientDuid);
+        addTlv(packet, DHCP6_ELAPSED_TIME, (short) (mElapsedTime & 0xFFFF));
+        addTlv(packet, DHCP6_IA_ADDR, mIaAddress);
+
+        packet.flip();
+        return packet;
+    }
+}

From c0a87bd9c04e7d3a9a96179da87250e3775949ad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Wed, 4 Jun 2025 00:00:06 -0700
Subject: [PATCH 347/377] clatd: disable seccomp
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bug: 418375944
Test: TreeHugger
Flag: EXEMPT mainline, bug fix, disable codepath
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I5c36a89c12d4cf836ee1b434b582a6ad2256037e
---
 clatd/main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/clatd/main.c b/clatd/main.c
index a98155bcc0..8fc9edaf08 100644
--- a/clatd/main.c
+++ b/clatd/main.c
@@ -371,7 +371,9 @@ int main(int argc, char **argv) {
   // TODO: actually perform true DAD
   send_dad(tunnel.write_fd6, &Global_Clatd_Config.ipv6_local_subnet);
 
+#if 0
   enable_seccomp();  // WARNING: from this point forward very limited system calls available.
+#endif
 
   event_loop(&tunnel);
 

From ead97d1ef387fefc445214c755d4ab60c0de0c63 Mon Sep 17 00:00:00 2001
From: Jimi Chen <jimictw@google.com>
Date: Mon, 2 Jun 2025 06:31:34 +0000
Subject: [PATCH 348/377] Format multidevice tests with pyformat

Use the following commands to apply pyformat
pyformat -i -r --force_quote_type single staticlibs/
pyformat -i -r --force_quote_type single tests/

Flag: EXEMPT mainline
Bug: 419423721
Test: TH
Change-Id: I0d3914ec652664ed4ec5d44afc25d97ff8bb4626
---
 .../tests/unit/host/python/adb_utils_test.py  | 50 +++++++++----------
 .../unit/host/python/assert_utils_test.py     | 31 ++++++------
 .../tests/unit/host/python/run_tests.py       |  2 +-
 staticlibs/testutils/host/python/adb_utils.py | 34 ++++++-------
 .../testutils/host/python/mdns_utils.py       |  4 +-
 .../host/python/multi_devices_test_base.py    |  4 +-
 .../testutils/host/python/tether_utils.py     | 16 +++---
 .../testutils/host/python/wifip2p_utils.py    | 10 ++--
 8 files changed, 77 insertions(+), 74 deletions(-)

diff --git a/staticlibs/tests/unit/host/python/adb_utils_test.py b/staticlibs/tests/unit/host/python/adb_utils_test.py
index 8fcca375f6..319991e5fa 100644
--- a/staticlibs/tests/unit/host/python/adb_utils_test.py
+++ b/staticlibs/tests/unit/host/python/adb_utils_test.py
@@ -29,12 +29,12 @@ class TestAdbUtils(base_test.BaseTestClass, parameterized.TestCase):
   def setup_test(self):
     self.mock_ad = MagicMock()  # Mock Android device object
     self.mock_ad.log = MagicMock()
-    self.mock_ad.adb.shell.return_value = b""  # Default empty return for shell
+    self.mock_ad.adb.shell.return_value = b''  # Default empty return for shell
 
   @patch(
-      "net_tests_utils.host.python.adb_utils.expect_dumpsys_state_with_retry"
+      'net_tests_utils.host.python.adb_utils.expect_dumpsys_state_with_retry'
   )
-  @patch("net_tests_utils.host.python.adb_utils._set_screen_state")
+  @patch('net_tests_utils.host.python.adb_utils._set_screen_state')
   def test_set_doze_mode_enable(
       self, mock_set_screen_state, mock_expect_dumpsys_state
   ):
@@ -42,29 +42,29 @@ class TestAdbUtils(base_test.BaseTestClass, parameterized.TestCase):
     mock_set_screen_state.assert_called_once_with(self.mock_ad, False)
 
   @patch(
-      "net_tests_utils.host.python.adb_utils.expect_dumpsys_state_with_retry"
+      'net_tests_utils.host.python.adb_utils.expect_dumpsys_state_with_retry'
   )
   def test_set_doze_mode_disable(self, mock_expect_dumpsys_state):
     adb_utils.set_doze_mode(self.mock_ad, False)
 
-  @patch("net_tests_utils.host.python.adb_utils._get_screen_state")
+  @patch('net_tests_utils.host.python.adb_utils._get_screen_state')
   def test_set_screen_state_success(self, mock_get_screen_state):
     mock_get_screen_state.side_effect = [False, True]  # Simulate toggle
     adb_utils._set_screen_state(self.mock_ad, True)
 
-  @patch("net_tests_utils.host.python.adb_utils._get_screen_state")
+  @patch('net_tests_utils.host.python.adb_utils._get_screen_state')
   def test_set_screen_state_failure(self, mock_get_screen_state):
     mock_get_screen_state.return_value = False  # State doesn't change
     with asserts.assert_raises(UnexpectedBehaviorError):
       adb_utils._set_screen_state(self.mock_ad, True)
 
   @parameterized.parameters(
-      ("Awake", True),
-      ("Asleep", False),
-      ("Dozing", False),
-      ("SomeOtherState", False),
+      ('Awake', True),
+      ('Asleep', False),
+      ('Dozing', False),
+      ('SomeOtherState', False),
   )  # Declare inputs for state_str and expected_result.
-  @patch("net_tests_utils.host.python.adb_utils.get_value_of_key_from_dumpsys")
+  @patch('net_tests_utils.host.python.adb_utils.get_value_of_key_from_dumpsys')
   def test_get_screen_state(self, state_str, expected_result, mock_get_value):
     mock_get_value.return_value = state_str
     asserts.assert_equal(
@@ -73,44 +73,44 @@ class TestAdbUtils(base_test.BaseTestClass, parameterized.TestCase):
 
   def test_get_value_of_key_from_dumpsys(self):
     self.mock_ad.adb.shell.return_value = (
-        b"mWakefulness=Awake\nmOtherKey=SomeValue"
+        b'mWakefulness=Awake\nmOtherKey=SomeValue'
     )
     result = adb_utils.get_value_of_key_from_dumpsys(
-        self.mock_ad, "power", "mWakefulness"
+        self.mock_ad, 'power', 'mWakefulness'
     )
-    asserts.assert_equal(result, "Awake")
+    asserts.assert_equal(result, 'Awake')
 
   @parameterized.parameters(
-      (True, ["true"]),
-      (False, ["false"]),
+      (True, ['true']),
+      (False, ['false']),
       (
           True,
-          ["false", "true"],
+          ['false', 'true'],
       ),  # Expect True, get False which is unexpected, then get True
       (
           False,
-          ["true", "false"],
+          ['true', 'false'],
       ),  # Expect False, get True which is unexpected, then get False
   )  # Declare inputs for expected_state and returned_value
-  @patch("net_tests_utils.host.python.adb_utils.get_value_of_key_from_dumpsys")
+  @patch('net_tests_utils.host.python.adb_utils.get_value_of_key_from_dumpsys')
   def test_expect_dumpsys_state_with_retry_success(
       self, expected_state, returned_value, mock_get_value
   ):
     mock_get_value.side_effect = returned_value
     # Verify the method returns and does not throw.
     adb_utils.expect_dumpsys_state_with_retry(
-        self.mock_ad, "service", "key", expected_state, 0
+        self.mock_ad, 'service', 'key', expected_state, 0
     )
 
-  @patch("net_tests_utils.host.python.adb_utils.get_value_of_key_from_dumpsys")
+  @patch('net_tests_utils.host.python.adb_utils.get_value_of_key_from_dumpsys')
   def test_expect_dumpsys_state_with_retry_failure(self, mock_get_value):
-    mock_get_value.return_value = "false"
+    mock_get_value.return_value = 'false'
     with asserts.assert_raises(UnexpectedBehaviorError):
       adb_utils.expect_dumpsys_state_with_retry(
-          self.mock_ad, "service", "key", True, 0
+          self.mock_ad, 'service', 'key', True, 0
       )
 
-  @patch("net_tests_utils.host.python.adb_utils.get_value_of_key_from_dumpsys")
+  @patch('net_tests_utils.host.python.adb_utils.get_value_of_key_from_dumpsys')
   def test_expect_dumpsys_state_with_retry_not_found(self, mock_get_value):
     # Simulate the get_value_of_key_from_dumpsys cannot find the give key.
     mock_get_value.return_value = None
@@ -118,5 +118,5 @@ class TestAdbUtils(base_test.BaseTestClass, parameterized.TestCase):
     # Expect the function to raise UnexpectedBehaviorError due to the exception
     with asserts.assert_raises(UnexpectedBehaviorError):
       adb_utils.expect_dumpsys_state_with_retry(
-          self.mock_ad, "service", "key", True
+          self.mock_ad, 'service', 'key', True
       )
diff --git a/staticlibs/tests/unit/host/python/assert_utils_test.py b/staticlibs/tests/unit/host/python/assert_utils_test.py
index 1d85a1212f..6f6ba09a7c 100644
--- a/staticlibs/tests/unit/host/python/assert_utils_test.py
+++ b/staticlibs/tests/unit/host/python/assert_utils_test.py
@@ -15,7 +15,10 @@
 from mobly import asserts
 from mobly import base_test
 from net_tests_utils.host.python.assert_utils import (
-    UnexpectedBehaviorError, UnexpectedExceptionError, expect_with_retry, expect_throws
+    UnexpectedBehaviorError,
+    UnexpectedExceptionError,
+    expect_throws,
+    expect_with_retry,
 )
 
 
@@ -56,7 +59,7 @@ class TestAssertUtils(base_test.BaseTestClass):
         retry_interval_sec=0,
     )
     asserts.assert_false(
-        retry_action_called, "retry_action called."
+        retry_action_called, 'retry_action called.'
     )  # Assert retry_action was NOT called
 
   def test_retry_action_not_called_failed(self):
@@ -75,7 +78,7 @@ class TestAssertUtils(base_test.BaseTestClass):
           retry_interval_sec=0,
       )
     asserts.assert_false(
-        retry_action_called, "retry_action called."
+        retry_action_called, 'retry_action called.'
     )  # Assert retry_action was NOT called
 
   def test_retry_action_called(self):
@@ -93,23 +96,23 @@ class TestAssertUtils(base_test.BaseTestClass):
           max_retries=2,
           retry_interval_sec=0,
       )
-    asserts.assert_true(retry_action_called, "retry_action not called.")
+    asserts.assert_true(retry_action_called, 'retry_action not called.')
 
   def test_expect_exception_throws(self):
-      def raise_unexpected_behavior_error():
-          raise UnexpectedBehaviorError()
+    def raise_unexpected_behavior_error():
+      raise UnexpectedBehaviorError()
 
-      expect_throws(raise_unexpected_behavior_error, UnexpectedBehaviorError)
+    expect_throws(raise_unexpected_behavior_error, UnexpectedBehaviorError)
 
   def test_unexpect_exception_throws(self):
-      def raise_value_error():
-          raise ValueError()
+    def raise_value_error():
+      raise ValueError()
 
-      with asserts.assert_raises(UnexpectedExceptionError):
-          expect_throws(raise_value_error, UnexpectedBehaviorError)
+    with asserts.assert_raises(UnexpectedExceptionError):
+      expect_throws(raise_value_error, UnexpectedBehaviorError)
 
   def test_no_exception_throws(self):
-      def raise_no_error():
-          return
+    def raise_no_error():
+      return
 
-      expect_throws(raise_no_error, UnexpectedBehaviorError)
\ No newline at end of file
+    expect_throws(raise_no_error, UnexpectedBehaviorError)
diff --git a/staticlibs/tests/unit/host/python/run_tests.py b/staticlibs/tests/unit/host/python/run_tests.py
index fa6a310293..14f3587e72 100644
--- a/staticlibs/tests/unit/host/python/run_tests.py
+++ b/staticlibs/tests/unit/host/python/run_tests.py
@@ -21,7 +21,7 @@ from host.python.assert_utils_test import TestAssertUtils
 from mobly import suite_runner
 
 
-if __name__ == "__main__":
+if __name__ == '__main__':
   # For MoblyBinaryHostTest, this entry point will be called twice:
   # 1. List tests.
   #   <mobly-par-file-name> -- --list_tests
diff --git a/staticlibs/testutils/host/python/adb_utils.py b/staticlibs/testutils/host/python/adb_utils.py
index 13c06464fd..023cb01164 100644
--- a/staticlibs/testutils/host/python/adb_utils.py
+++ b/staticlibs/testutils/host/python/adb_utils.py
@@ -16,32 +16,32 @@ import re
 from mobly.controllers import android_device
 from net_tests_utils.host.python import assert_utils
 
-BYTE_DECODE_UTF_8 = "utf-8"
+BYTE_DECODE_UTF_8 = 'utf-8'
 
 
 def set_doze_mode(ad: android_device.AndroidDevice, enable: bool) -> None:
   if enable:
-    adb_shell(ad, "cmd battery unplug")
+    adb_shell(ad, 'cmd battery unplug')
     expect_dumpsys_state_with_retry(
-        ad, "deviceidle", key="mCharging", expected_state=False
+        ad, 'deviceidle', key='mCharging', expected_state=False
     )
     _set_screen_state(ad, False)
-    adb_shell(ad, "dumpsys deviceidle enable deep")
+    adb_shell(ad, 'dumpsys deviceidle enable deep')
     expect_dumpsys_state_with_retry(
-        ad, "deviceidle", key="mDeepEnabled", expected_state=True
+        ad, 'deviceidle', key='mDeepEnabled', expected_state=True
     )
-    adb_shell(ad, "dumpsys deviceidle force-idle deep")
+    adb_shell(ad, 'dumpsys deviceidle force-idle deep')
     expect_dumpsys_state_with_retry(
-        ad, "deviceidle", key="mForceIdle", expected_state=True
+        ad, 'deviceidle', key='mForceIdle', expected_state=True
     )
   else:
-    adb_shell(ad, "cmd battery reset")
+    adb_shell(ad, 'cmd battery reset')
     expect_dumpsys_state_with_retry(
-        ad, "deviceidle", key="mCharging", expected_state=True
+        ad, 'deviceidle', key='mCharging', expected_state=True
     )
-    adb_shell(ad, "dumpsys deviceidle unforce")
+    adb_shell(ad, 'dumpsys deviceidle unforce')
     expect_dumpsys_state_with_retry(
-        ad, "deviceidle", key="mForceIdle", expected_state=False
+        ad, 'deviceidle', key='mForceIdle', expected_state=False
     )
 
 
@@ -51,13 +51,13 @@ def _set_screen_state(
   assert_utils.expect_with_retry(
       predicate=lambda: _get_screen_state(ad) == target_state,
       retry_action=lambda: adb_shell(
-          ad, "input keyevent KEYCODE_POWER"
+          ad, 'input keyevent KEYCODE_POWER'
       ),  # Toggle power key again when retry.
   )
 
 
 def _get_screen_state(ad: android_device.AndroidDevice) -> bool:
-  return get_value_of_key_from_dumpsys(ad, "power", "mWakefulness") == "Awake"
+  return get_value_of_key_from_dumpsys(ad, 'power', 'mWakefulness') == 'Awake'
 
 
 def get_value_of_key_from_dumpsys(
@@ -66,12 +66,12 @@ def get_value_of_key_from_dumpsys(
   output = get_dumpsys_for_service(ad, service)
   # Search for key=value pattern from the dumpsys output.
   # e.g. mWakefulness=Awake
-  pattern = rf"{key}=(.*)"
+  pattern = rf'{key}=(.*)'
   # Only look for the first occurrence.
   match = re.search(pattern, output)
   if match:
     ad.log.debug(
-        "Getting key-value from dumpsys: " + key + "=" + match.group(1)
+        'Getting key-value from dumpsys: ' + key + '=' + match.group(1)
     )
     return match.group(1)
   else:
@@ -100,7 +100,7 @@ def expect_dumpsys_state_with_retry(
 def get_dumpsys_for_service(
     ad: android_device.AndroidDevice, service: str
 ) -> str:
-  return adb_shell(ad, "dumpsys " + service)
+  return adb_shell(ad, 'dumpsys ' + service)
 
 
 def adb_shell(ad: android_device.AndroidDevice, shell_cmd: str) -> str:
@@ -113,6 +113,6 @@ def adb_shell(ad: android_device.AndroidDevice, shell_cmd: str) -> str:
   Returns:
     string, replies from adb shell command.
   """
-  ad.log.debug("Executing adb shell %s", shell_cmd)
+  ad.log.debug('Executing adb shell %s', shell_cmd)
   data = ad.adb.shell(shell_cmd)
   return data.decode(BYTE_DECODE_UTF_8).strip()
diff --git a/staticlibs/testutils/host/python/mdns_utils.py b/staticlibs/testutils/host/python/mdns_utils.py
index 1234e54605..315762e5e1 100644
--- a/staticlibs/testutils/host/python/mdns_utils.py
+++ b/staticlibs/testutils/host/python/mdns_utils.py
@@ -23,10 +23,10 @@ def assume_mdns_test_preconditions(
   discovery = discovery_device.connectivity_multi_devices_snippet
 
   asserts.skip_if(
-      not advertising.isAtLeastT(), "Advertising device SDK is lower than T."
+      not advertising.isAtLeastT(), 'Advertising device SDK is lower than T.'
   )
   asserts.skip_if(
-      not discovery.isAtLeastT(), "Discovery device SDK is lower than T."
+      not discovery.isAtLeastT(), 'Discovery device SDK is lower than T.'
   )
 
 
diff --git a/staticlibs/testutils/host/python/multi_devices_test_base.py b/staticlibs/testutils/host/python/multi_devices_test_base.py
index 72bac0cb2b..6db9577493 100644
--- a/staticlibs/testutils/host/python/multi_devices_test_base.py
+++ b/staticlibs/testutils/host/python/multi_devices_test_base.py
@@ -28,7 +28,7 @@ from mobly import base_test
 from mobly import utils
 from mobly.controllers import android_device
 
-CONNECTIVITY_MULTI_DEVICES_SNIPPET_PACKAGE = "com.google.snippet.connectivity"
+CONNECTIVITY_MULTI_DEVICES_SNIPPET_PACKAGE = 'com.google.snippet.connectivity'
 
 
 class MultiDevicesTestBase(base_test.BaseTestClass):
@@ -41,7 +41,7 @@ class MultiDevicesTestBase(base_test.BaseTestClass):
 
     def setup_device(device):
       device.load_snippet(
-          "connectivity_multi_devices_snippet",
+          'connectivity_multi_devices_snippet',
           CONNECTIVITY_MULTI_DEVICES_SNIPPET_PACKAGE,
       )
 
diff --git a/staticlibs/testutils/host/python/tether_utils.py b/staticlibs/testutils/host/python/tether_utils.py
index 710f8a80a7..5c22e265d2 100644
--- a/staticlibs/testutils/host/python/tether_utils.py
+++ b/staticlibs/testutils/host/python/tether_utils.py
@@ -32,7 +32,7 @@ def generate_uuid32_base64() -> str:
       str: The Base64-encoded UUID32 string. Which is 22 characters.
   """
   # Strip padding characters to make it safer for hotspot name length limit.
-  return base64.b64encode(uuid.uuid1().bytes).decode("utf-8").strip("=")
+  return base64.b64encode(uuid.uuid1().bytes).decode('utf-8').strip('=')
 
 
 def assume_hotspot_test_preconditions(
@@ -44,23 +44,23 @@ def assume_hotspot_test_preconditions(
   client = client_device.connectivity_multi_devices_snippet
 
   # Assert pre-conditions specific to each upstream type.
-  asserts.skip_if(not client.hasWifiFeature(), "Client requires Wifi feature")
+  asserts.skip_if(not client.hasWifiFeature(), 'Client requires Wifi feature')
   asserts.skip_if(
-      not server.hasHotspotFeature(), "Server requires hotspot feature"
+      not server.hasHotspotFeature(), 'Server requires hotspot feature'
   )
   if upstream_type == UpstreamType.CELLULAR:
     asserts.skip_if(
-        not server.hasTelephonyFeature(), "Server requires Telephony feature"
+        not server.hasTelephonyFeature(), 'Server requires Telephony feature'
     )
   elif upstream_type == UpstreamType.WIFI:
     asserts.skip_if(
         not server.isStaApConcurrencySupported(),
-        "Server requires Wifi AP + STA concurrency",
+        'Server requires Wifi AP + STA concurrency',
     )
   elif upstream_type == UpstreamType.NONE:
     pass
   else:
-    raise ValueError(f"Invalid upstream type: {upstream_type}")
+    raise ValueError(f'Invalid upstream type: {upstream_type}')
 
 
 def setup_hotspot_and_client_for_upstream_type(
@@ -84,11 +84,11 @@ def setup_hotspot_and_client_for_upstream_type(
   elif upstream_type == UpstreamType.NONE:
     pass
   else:
-    raise ValueError(f"Invalid upstream type: {upstream_type}")
+    raise ValueError(f'Invalid upstream type: {upstream_type}')
 
   # Generate ssid/passphrase with random characters to make sure nearby devices won't
   # connect unexpectedly. Note that total length of ssid cannot go over 32.
-  test_ssid = "HOTSPOT-" + generate_uuid32_base64()
+  test_ssid = 'HOTSPOT-' + generate_uuid32_base64()
   test_passphrase = generate_uuid32_base64()
 
   # Create a hotspot with fixed SSID and password.
diff --git a/staticlibs/testutils/host/python/wifip2p_utils.py b/staticlibs/testutils/host/python/wifip2p_utils.py
index bae348b9b3..4b7ebbfacb 100644
--- a/staticlibs/testutils/host/python/wifip2p_utils.py
+++ b/staticlibs/testutils/host/python/wifip2p_utils.py
@@ -25,13 +25,13 @@ def assume_wifi_p2p_test_preconditions(
   client = client_device.connectivity_multi_devices_snippet
 
   # Assert pre-conditions
-  asserts.skip_if(not server.hasWifiFeature(), "Server requires Wifi feature")
-  asserts.skip_if(not client.hasWifiFeature(), "Client requires Wifi feature")
+  asserts.skip_if(not server.hasWifiFeature(), 'Server requires Wifi feature')
+  asserts.skip_if(not client.hasWifiFeature(), 'Client requires Wifi feature')
   asserts.skip_if(
-      not server.isP2pSupported(), "Server requires Wi-fi P2P feature"
+      not server.isP2pSupported(), 'Server requires Wi-fi P2P feature'
   )
   asserts.skip_if(
-      not client.isP2pSupported(), "Client requires Wi-fi P2P feature"
+      not client.isP2pSupported(), 'Client requires Wi-fi P2P feature'
   )
 
 
@@ -54,7 +54,7 @@ def setup_wifi_p2p_server_and_client(
   # network name must starts with prefix "DIRECT-", followed by any two
   # random chars from the set ('A' - 'Z', 'a' - 'z', '0' - '9')
   # This follows the documentation on WifiP2pConfig.Builder#setNetworkName.
-  group_name = "DIRECT-XY" + tether_utils.generate_uuid32_base64()
+  group_name = 'DIRECT-XY' + tether_utils.generate_uuid32_base64()
   group_passphrase = tether_utils.generate_uuid32_base64()
 
   # Server creates a Wi-Fi P2P group

From cfc8a85432978cfb5ff8b605f9ddf4c5ee57b03f Mon Sep 17 00:00:00 2001
From: Jimi Chen <jimictw@google.com>
Date: Wed, 28 May 2025 13:13:17 +0000
Subject: [PATCH 349/377] Force device unroot in the multi-device setup

In mobly, it will root the device if the device is rootable.
If there is some operation needs root permission,
the test result will be inconsistent between user and userdebug build.

Flag: EXEMPT mainline
Bug: 419423721
Test: atest CtsConnectivityMultiDevicesTestCases
Change-Id: Ib962b565aeaf8f0e1737b700a16420277e088e6b
---
 staticlibs/testutils/host/python/adb_utils.py | 72 +++++++++++++++++++
 .../host/python/multi_devices_test_base.py    | 15 ++++
 2 files changed, 87 insertions(+)

diff --git a/staticlibs/testutils/host/python/adb_utils.py b/staticlibs/testutils/host/python/adb_utils.py
index 023cb01164..e3260a9920 100644
--- a/staticlibs/testutils/host/python/adb_utils.py
+++ b/staticlibs/testutils/host/python/adb_utils.py
@@ -12,8 +12,13 @@
 #  See the License for the specific language governing permissions and
 #  limitations under the License.
 
+import logging
 import re
+import time
+import types
+from mobly import utils
 from mobly.controllers import android_device
+from mobly.controllers.android_device_lib import adb
 from net_tests_utils.host.python import assert_utils
 
 BYTE_DECODE_UTF_8 = 'utf-8'
@@ -103,6 +108,73 @@ def get_dumpsys_for_service(
   return adb_shell(ad, 'dumpsys ' + service)
 
 
+def unroot_adb(self) -> bytes:
+  """Executes the 'adb unroot' command on the device with retry logic.
+
+  This method is intended to be dynamically attached to an AdbProxy instance
+  (or similar object) that provides an '_exec_adb_cmd' method for executing
+  ADB commands. It attempts to unroot the device, and if an AdbError occurs,
+  it retries the command a specified number of times with an exponentially
+  increasing delay.
+
+  Args:
+    self: The instance of the ADB client (e.g., an AdbProxy object) that has the
+      '_exec_adb_cmd' method available to run ADB commands.
+
+  Returns:
+    bytes: The raw byte output from the 'adb unroot' command's successful
+      execution.
+
+  Raises:
+    adb.AdbError: If the 'adb unroot' command fails after all specified
+      retry attempts.
+  """
+  retry_interval = adb.ADB_ROOT_RETRY_ATTEMPT_INTERVAL_SEC
+  for attempt in range(adb.ADB_ROOT_RETRY_ATTEMPTS):
+    try:
+      # Assuming 'self' here is an object that has a '_exec_adb_cmd' method,
+      # similar to your original 'root' method's context (e.g., an AdbProxy).
+      return self._exec_adb_cmd(
+          'unroot', args=None, shell=False, timeout=None, stderr=None
+      )
+    except adb.AdbError as e:
+      if attempt + 1 < adb.ADB_ROOT_RETRY_ATTEMPTS:
+        # Decode stderr for logging, as Mobly often provides bytes
+        decoded_stderr = e.stderr.decode('utf-8', errors='ignore').strip()
+        logging.error(
+            f'Retry the command "{utils.cli_cmd_to_string(e.cmd)}" since Error'
+            f' "{decoded_stderr}" occurred (attempt'
+            f' {attempt + 1}/{adb.ADB_ROOT_RETRY_ATTEMPTS}).'
+        )
+        time.sleep(retry_interval)
+        retry_interval *= 2
+      else:
+        raise e
+
+
+def unroot(ad: android_device.AndroidDevice):
+  """Dynamically unroots an Android device by attaching 'unroot_adb' to its ADB proxy.
+
+  This function addresses a potential issue where Mobly might attempt to root
+  a device upon registration. When running user or userdebug builds,
+  this automatic rooting can lead to unexpected or inconsistent device behavior.
+  To mitigate this, this function temporarily attaches the 'unroot_adb' method
+  to the device's ADB proxy (`ad.adb`), executes it, and then removes it,
+  ensuring the device returns to an unrooted state and the ADB proxy's state
+  remains clean.
+
+  Args:
+    ad: The `android_device.AndroidDevice` instance to be unrooted.
+  """
+  attach_method_name = 'unroot_adb'
+  try:
+    setattr(ad.adb, attach_method_name, types.MethodType(unroot_adb, ad.adb))
+    getattr(ad.adb, attach_method_name)()
+    ad.adb.wait_for_device()
+  finally:
+    delattr(ad.adb, attach_method_name)
+
+
 def adb_shell(ad: android_device.AndroidDevice, shell_cmd: str) -> str:
   """Runs adb shell command.
 
diff --git a/staticlibs/testutils/host/python/multi_devices_test_base.py b/staticlibs/testutils/host/python/multi_devices_test_base.py
index 6db9577493..a0b15ccd98 100644
--- a/staticlibs/testutils/host/python/multi_devices_test_base.py
+++ b/staticlibs/testutils/host/python/multi_devices_test_base.py
@@ -24,9 +24,11 @@
 #  See the License for the specific language governing permissions and
 #  limitations under the License.
 
+from mobly import asserts
 from mobly import base_test
 from mobly import utils
 from mobly.controllers import android_device
+from net_tests_utils.host.python import adb_utils
 
 CONNECTIVITY_MULTI_DEVICES_SNIPPET_PACKAGE = 'com.google.snippet.connectivity'
 
@@ -39,6 +41,19 @@ class MultiDevicesTestBase(base_test.BaseTestClass):
         android_device, min_number=2
     )
 
+    if self.clientDevice.is_adb_root:
+      adb_utils.unroot(self.clientDevice)
+
+    if self.serverDevice.is_adb_root:
+      adb_utils.unroot(self.serverDevice)
+
+    asserts.assert_false(
+        self.clientDevice.is_adb_root, 'client device should be unroot'
+    )
+    asserts.assert_false(
+        self.serverDevice.is_adb_root, 'server device should be unroot'
+    )
+
     def setup_device(device):
       device.load_snippet(
           'connectivity_multi_devices_snippet',

From f3245684d5ce7a6cb9ca227b1afbf3d9c07c1ceb Mon Sep 17 00:00:00 2001
From: Chris Desir <cdesir@google.com>
Date: Tue, 3 Jun 2025 18:33:05 +0000
Subject: [PATCH 350/377] Increase WAIT_RA_TIMEOUT_MS

EthernetTethering tests on auto devices are flaky waiting for RA. Increased timeout will give a more generous window to receive RA.

Flag: EXEMPT bugfix
Bug: 418010532
Test: atest android.net.EthernetTetheringTest#testLocalOnlyTethering --iterations 50
Test: atest android.net.EthernetTetheringTest --iterations 20
Change-Id: I6092ee805267a6d50fa2842d3131eeae544c3443
---
 .../integration/base/android/net/EthernetTetheringTestBase.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Tethering/tests/integration/base/android/net/EthernetTetheringTestBase.java b/Tethering/tests/integration/base/android/net/EthernetTetheringTestBase.java
index 1323f28ff7..1e4d4dc13a 100644
--- a/Tethering/tests/integration/base/android/net/EthernetTetheringTestBase.java
+++ b/Tethering/tests/integration/base/android/net/EthernetTetheringTestBase.java
@@ -108,7 +108,7 @@ public abstract class EthernetTetheringTestBase {
     // See TetheredInterfaceRequester.getInterface, isInterfaceForTetheringAvailable.
     private static final int SHORT_TIMEOUT_MS = 1000;
     private static final int TETHER_REACHABILITY_ATTEMPTS = 20;
-    protected static final long WAIT_RA_TIMEOUT_MS = 2000;
+    protected static final long WAIT_RA_TIMEOUT_MS = 10000;
 
     // Address and NAT prefix definition.
     protected static final MacAddress TEST_MAC = MacAddress.fromString("1:2:3:4:5:6");

From 50d7eee5a41fed72f9c05100304178668955dd9e Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Wed, 4 Jun 2025 10:41:42 -0700
Subject: [PATCH 351/377] Remove tests which are covered by EthernetManagerTest

Test interface tracking is already covered by EthernetManagerTest (in
fact, that test relies heavily on this functionality), so it does not
need to be part of EthernetTrackerTest. Additionally, both
isValidTestInterface() and setIncludeTestInterfaces() are trivial
functions that do not improve coverage significantly. Long-term, the
ethernet unit tests should be reimagined as more of a module-wide unit
test, rather than testing individual classes. This will make the tests
much more valuable and could allow testing scenarios that are not
possible in a end-to-end integration test.

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I94540b6e7b94b1de00965f4e54393d573788c59a
---
 .../server/ethernet/EthernetTrackerTest.java  | 33 -------------------
 1 file changed, 33 deletions(-)

diff --git a/tests/unit/java/com/android/server/ethernet/EthernetTrackerTest.java b/tests/unit/java/com/android/server/ethernet/EthernetTrackerTest.java
index c6ae03985c..def064a03f 100644
--- a/tests/unit/java/com/android/server/ethernet/EthernetTrackerTest.java
+++ b/tests/unit/java/com/android/server/ethernet/EthernetTrackerTest.java
@@ -259,37 +259,4 @@ public class EthernetTrackerTest {
         verify(mFactory).updateInterface(
                 eq(TEST_IFACE), eq(ipConfig), eq(capabilities));
     }
-
-    @Test
-    public void testIsValidTestInterfaceIsFalseWhenTestInterfacesAreNotIncluded() {
-        final String validIfaceName = TEST_TAP_PREFIX + "123";
-        tracker.setIncludeTestInterfaces(false);
-        waitForIdle();
-
-        final boolean isValidTestInterface = tracker.isValidTestInterface(validIfaceName);
-
-        assertFalse(isValidTestInterface);
-    }
-
-    @Test
-    public void testIsValidTestInterfaceIsFalseWhenTestInterfaceNameIsInvalid() {
-        final String invalidIfaceName = "123" + TEST_TAP_PREFIX;
-        tracker.setIncludeTestInterfaces(true);
-        waitForIdle();
-
-        final boolean isValidTestInterface = tracker.isValidTestInterface(invalidIfaceName);
-
-        assertFalse(isValidTestInterface);
-    }
-
-    @Test
-    public void testIsValidTestInterfaceIsTrueWhenTestInterfacesIncludedAndValidName() {
-        final String validIfaceName = TEST_TAP_PREFIX + "123";
-        tracker.setIncludeTestInterfaces(true);
-        waitForIdle();
-
-        final boolean isValidTestInterface = tracker.isValidTestInterface(validIfaceName);
-
-        assertTrue(isValidTestInterface);
-    }
 }

From 5fd68b67854d3c84b7c81a609d05115af0698d7e Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Tue, 3 Jun 2025 14:37:16 -0700
Subject: [PATCH 352/377] Change trackAvailable to trigger GETLINK dump

Instead of calling NetworkInterface#getNetworkInterfaces() (which calls
getifaddrs() and triggers an RTM_GETLINK dump request), trigger the
RTM_GETLINK dump request in EthernetTracker directly. The resulting
RTM_NEWLINK messages will be processed by the NetlinkMonitor callback.

This means that there will be a single entry point for link tracking
which contains all required information (ifindex, ifname, mac).

This change also makes the behavior of EthernetTracker more correct.
Previously, the interface list was retrieved out-of-band from
EthernetNetlinkMonitor. This means that it was possible for an
RTM_NEWLINK to be queued at the same time as #getNetworkInterfaces() was
called. In that case, #getNetworkInterfaces() returns up-to-date
information and is processed before the queued RTM_NEWLINK event with
the now outdated information.

The new code retrieves all information on a single netlink socket and
processes them in order on the same handler thread.

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I1e6e17fa4eb3dd8fe308fd54c2bb16a8ad36dc43
---
 .../server/ethernet/EthernetTracker.java      | 27 ++++++++++++++++---
 .../net/module/util/FdEventsReader.java       |  5 ++++
 .../net/module/util/ip/NetlinkMonitor.java    | 24 +++++++++++++++++
 3 files changed, 52 insertions(+), 4 deletions(-)

diff --git a/service-t/src/com/android/server/ethernet/EthernetTracker.java b/service-t/src/com/android/server/ethernet/EthernetTracker.java
index f3a0af3f81..18abff11ad 100644
--- a/service-t/src/com/android/server/ethernet/EthernetTracker.java
+++ b/service-t/src/com/android/server/ethernet/EthernetTracker.java
@@ -26,6 +26,7 @@ import static android.net.TestNetworkManager.TEST_TAP_PREFIX;
 
 import static com.android.internal.annotations.VisibleForTesting.Visibility.PACKAGE;
 import static com.android.net.module.util.netlink.NetlinkConstants.IFF_UP;
+import static com.android.net.module.util.netlink.NetlinkConstants.RTM_GETLINK;
 
 import android.annotation.NonNull;
 import android.annotation.Nullable;
@@ -64,12 +65,15 @@ import com.android.net.module.util.netlink.NetlinkMessage;
 import com.android.net.module.util.netlink.NetlinkUtils;
 import com.android.net.module.util.netlink.RtNetlinkLinkMessage;
 import com.android.net.module.util.netlink.StructIfinfoMsg;
+import com.android.net.module.util.netlink.StructNlMsgHdr;
 import com.android.server.connectivity.ConnectivityResources;
 
 import java.io.FileDescriptor;
 import java.net.InetAddress;
 import java.net.NetworkInterface;
 import java.net.SocketException;
+import java.nio.ByteBuffer;
+import java.nio.ByteOrder;
 import java.util.ArrayList;
 import java.util.Enumeration;
 import java.util.Iterator;
@@ -763,10 +767,25 @@ public class EthernetTracker {
     }
 
     private void trackAvailableInterfaces() {
-        final List<String> ifaces = getEthernetInterfaceList();
-        for (String iface : ifaces) {
-            maybeTrackInterface(iface);
-        }
+        // TODO: Clean up NetlinkMessage classes and add support for building a generic GETLINK
+        // message.
+        // Allocate enough space for struct nlmsghdr + struct rtgenmsg
+        final ByteBuffer buf = ByteBuffer.allocate(StructNlMsgHdr.STRUCT_SIZE + 1);
+        buf.order(ByteOrder.nativeOrder());
+
+        final StructNlMsgHdr nlmsghdr = new StructNlMsgHdr();
+        nlmsghdr.nlmsg_len = buf.capacity();
+        nlmsghdr.nlmsg_type = RTM_GETLINK;
+        nlmsghdr.nlmsg_flags = StructNlMsgHdr.NLM_F_DUMP | StructNlMsgHdr.NLM_F_REQUEST;
+        nlmsghdr.pack(buf);
+
+        // struct rtgenmsg {
+        //   unsigned char rtgen_family;
+        // }
+        buf.put((byte) OsConstants.AF_UNSPEC);
+        buf.flip();
+
+        mNetlinkMonitor.sendNetlinkMessage(buf);
     }
 
     private static class ListenerInfo {
diff --git a/staticlibs/device/com/android/net/module/util/FdEventsReader.java b/staticlibs/device/com/android/net/module/util/FdEventsReader.java
index f88883bf22..e6c01416b9 100644
--- a/staticlibs/device/com/android/net/module/util/FdEventsReader.java
+++ b/staticlibs/device/com/android/net/module/util/FdEventsReader.java
@@ -141,6 +141,11 @@ public abstract class FdEventsReader<BufferType> {
         return mPacketsReceived;
     }
 
+    /** Returns the FileDescriptor if the FdEventsReader is running, null otherwise. */
+    protected FileDescriptor getFd() {
+        return isRunning() ? mFd : null;
+    }
+
     /**
      * Subclasses MUST create the listening socket here, including setting all desired socket
      * options, interface or address/port binding, etc. The socket MUST be created nonblocking.
diff --git a/staticlibs/device/com/android/net/module/util/ip/NetlinkMonitor.java b/staticlibs/device/com/android/net/module/util/ip/NetlinkMonitor.java
index 15a46337a3..b4309e76ba 100644
--- a/staticlibs/device/com/android/net/module/util/ip/NetlinkMonitor.java
+++ b/staticlibs/device/com/android/net/module/util/ip/NetlinkMonitor.java
@@ -41,6 +41,7 @@ import com.android.net.module.util.netlink.NetlinkMessage;
 import com.android.net.module.util.netlink.NetlinkUtils;
 
 import java.io.FileDescriptor;
+import java.io.InterruptedIOException;
 import java.net.SocketAddress;
 import java.net.SocketException;
 import java.nio.ByteBuffer;
@@ -95,6 +96,29 @@ public class NetlinkMonitor extends PacketReader {
         this(h, log, tag, family, bindGroups, DEFAULT_SOCKET_RECV_BUFSIZE);
     }
 
+    /**
+     * Send a netlink message on the underlying netlink socket.
+     *
+     * Any responses will be processed by {@link #processNetlinkMessage}. This is particularly
+     * useful to request a dump of the current state when the {@link NetlinkMonitor} is first
+     * created.
+     * This prevents having an application to open multiple netlink sockets of the same family (for
+     * example by using a utility function in {@link NetlinkUtils} which can introduce races.
+     *
+     * TODO(b/422484024): add builder support to NetlinkMessage and accept a NetlinkMessage object
+     * rather than a ByteBuffer.
+     */
+    public void sendNetlinkMessage(ByteBuffer msg) {
+        if (!isRunning()) throw new IllegalStateException("NetlinkMonitor must be running");
+
+        final FileDescriptor fd = getFd();
+        try {
+            Os.write(fd, msg);
+        } catch (ErrnoException | InterruptedIOException e) {
+            Log.e(mTag, "Failed to send netlink message", e);
+        }
+    }
+
     @Override
     protected FileDescriptor createFd() {
         FileDescriptor fd = null;

From 7516d81c879666c5e9dd10f4c7468f0d1a20d87d Mon Sep 17 00:00:00 2001
From: Junyu Lai <junyulai@google.com>
Date: Mon, 2 Jun 2025 21:56:31 +0800
Subject: [PATCH 353/377] Report DefaultNetworkRematch for satellite network

This change introduces the `DefaultNetworkRematchMetrics`
class to collect and log data about default network reassignments.

The primary motivation is to monitor the behavior of satellite
networks when they act as a default network fallback. This class
records an event whenever a default network request with the
`PREFERENCE_ORDER_SATELLITE_FALLBACK` preference is moved from
one network to another.

For each reassignment, a `DEFAULT_NETWORK_REMATCH` atom is logged
to ConnectivityStatsLog. This atom includes detailed `NetworkDescription`
protos for the old and new networks, capturing their transport
types, capabilities, and metered/validated states. It also logs
the duration the device spent on the previous network.

Sample metrics:
event_metrics {
  data {
    aggregated_atom_info {
      atom {
        default_network_rematch {
          session_id: 1099094483789245667
          rematch_reason: RMR_UNKNOWN
          default_network_rematch_info_list {
            default_network_rematch_info {
              old_network {
                transport_types: 1
                metered_state: METERED_YES
                validated_state: VS_VALID
                score_policies: -4575657221408423932
                capabilities: 137711448064
                enterprise_id: 0
              }
              time_duration_on_old_network_sec: 9
              uid_ranges {
                uid_range {
                  begin: 10137
                  end: 10137
                }
              }
            }
          }
        }
      }
      elapsed_timestamp_nanos: 73821951490
    }
  }
}

Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.metrics.DefaultNetworkRematchMetricsTest  \
      --update-device
Test: Manual:
   1. Change code to use TRANSPORT_CELLULAR
   2. m statsd_testdrive && statsd_testdrive -e 525
   3. Turn off mobile data.
Flag: EXEMPT controlled by kill switch
Bug: 419123367
Change-Id: I40ba78d81cd30b2dc783e855aa76e776f76ace98
---
 .../metrics/DefaultNetworkRematchMetrics.java | 216 +++++++++++++++
 .../android/server/ConnectivityService.java   | 111 +++++---
 .../DefaultNetworkRematchMetricsTest.kt       | 261 ++++++++++++++++++
 .../server/ConnectivityServiceTest.java       |   7 +
 .../CSDefaultNetworkRematchMetricsTest.kt     | 121 ++++++++
 .../server/connectivityservice/base/CSTest.kt |   6 +
 6 files changed, 683 insertions(+), 39 deletions(-)
 create mode 100644 service/src/com/android/metrics/DefaultNetworkRematchMetrics.java
 create mode 100644 tests/unit/java/com/android/metrics/DefaultNetworkRematchMetricsTest.kt
 create mode 100644 tests/unit/java/com/android/server/connectivityservice/CSDefaultNetworkRematchMetricsTest.kt

diff --git a/service/src/com/android/metrics/DefaultNetworkRematchMetrics.java b/service/src/com/android/metrics/DefaultNetworkRematchMetrics.java
new file mode 100644
index 0000000000..df32044b58
--- /dev/null
+++ b/service/src/com/android/metrics/DefaultNetworkRematchMetrics.java
@@ -0,0 +1,216 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.metrics;
+
+import static android.net.NetworkCapabilities.NET_CAPABILITY_NOT_METERED;
+import static android.net.NetworkCapabilities.NET_CAPABILITY_TEMPORARILY_NOT_METERED;
+import static android.net.NetworkCapabilities.TRANSPORT_SATELLITE;
+import static android.stats.connectivity.MeteredState.METERED_NO;
+import static android.stats.connectivity.MeteredState.METERED_TEMPORARILY_UNMETERED;
+import static android.stats.connectivity.MeteredState.METERED_YES;
+
+import static com.android.net.module.util.FrameworkConnectivityStatsLog.DEFAULT_NETWORK_REMATCH;
+import static com.android.server.ConnectivityService.PREFERENCE_ORDER_SATELLITE_FALLBACK;
+import static com.android.server.ConnectivityStatsLog.DEFAULT_NETWORK_REMATCH__REMATCH_REASON__RMR_UNKNOWN;
+
+import android.annotation.NonNull;
+import android.annotation.Nullable;
+import android.net.NetworkCapabilities;
+import android.os.SystemClock;
+import android.stats.connectivity.MeteredState;
+import android.stats.connectivity.ValidatedState;
+
+import androidx.annotation.VisibleForTesting;
+
+import com.android.server.ConnectivityService;
+import com.android.server.ConnectivityStatsLog;
+import com.android.server.connectivity.NetworkAgentInfo;
+
+import java.util.Random;
+import java.util.Set;
+
+/**
+ * Collects and reports metrics regarding default network rematch events.
+ *
+ * This class does not provide thread safety and should be only accessed on the same thread.
+ */
+public class DefaultNetworkRematchMetrics {
+    private final Dependencies mDeps;
+    private final DefaultNetworkRematchInfoList.Builder mBuilder =
+            DefaultNetworkRematchInfoList.newBuilder();
+    private final long mSessionId = new Random().nextLong();
+
+    public DefaultNetworkRematchMetrics() {
+        this(new Dependencies());
+    }
+
+    @VisibleForTesting
+    DefaultNetworkRematchMetrics(Dependencies deps) {
+        mDeps = deps;
+    }
+
+    /** Dependency class */
+    public static class Dependencies {
+        /**
+         * Writes a DEFAULT_NETWORK_REMATCH event to ConnectivityStatsLog.
+         */
+        public void writeStats(long sessionId, int rematchReason,
+                @NonNull DefaultNetworkRematchInfoList list) {
+            ConnectivityStatsLog.write(DEFAULT_NETWORK_REMATCH, sessionId, rematchReason,
+                    list.toByteArray());
+        }
+
+        /**
+         * Returns SystemClock.elapsedRealtime()
+         */
+        public long getElapsedRealtime() {
+            return SystemClock.elapsedRealtime();
+        }
+    }
+
+    /**
+     * Adds a default network reassignment event to the list of events to be logged.
+     *
+     * @param nri The NetworkRequestInfo for the default network request.
+     * @param oldNetwork The previous default network.
+     * @param newNetwork The new default network.
+     */
+    public void addEvent(@NonNull ConnectivityService.NetworkRequestInfo nri,
+            @Nullable NetworkAgentInfo oldNetwork,
+            @Nullable NetworkAgentInfo newNetwork) {
+        // TODO: Record event for network other than satellite after figuring out
+        //  how to deal with the amount of data single device reports.
+        // Only logs for satellite multilayer requests.
+        if (nri.getPreferenceOrderForNetd() != PREFERENCE_ORDER_SATELLITE_FALLBACK) {
+            return;
+        }
+        // Only logs when moving away from a satellite network to another network type.
+        if (oldNetwork == null || !oldNetwork.getCapsNoCopy().hasTransport(TRANSPORT_SATELLITE)) {
+            return;
+        }
+        mBuilder.addDefaultNetworkRematchInfo(
+                getDefaultNetworkRematchInfo(nri, oldNetwork, newNetwork));
+    }
+
+    /**
+     * Writes the collected events to the stats log and clears the event list, with reason unknown.
+     */
+    public void writeStatsAndClear() {
+        writeStatsAndClear(DEFAULT_NETWORK_REMATCH__REMATCH_REASON__RMR_UNKNOWN);
+    }
+
+    /**
+     * Writes the collected events to the stats log and clears the event list.
+     */
+    public void writeStatsAndClear(int rematchReason) {
+        if (mBuilder.getDefaultNetworkRematchInfoCount() == 0) return; // Skip.
+        mDeps.writeStats(mSessionId, rematchReason, mBuilder.build());
+        mBuilder.clear();
+    }
+
+    @NonNull
+    private DefaultNetworkRematchInfo getDefaultNetworkRematchInfo(
+            @NonNull ConnectivityService.NetworkRequestInfo nri,
+            @Nullable NetworkAgentInfo oldNetwork, @Nullable NetworkAgentInfo newNetwork) {
+        final DefaultNetworkRematchInfo.Builder infoBuilder =
+                DefaultNetworkRematchInfo.newBuilder();
+        if (oldNetwork != null) {
+            infoBuilder.setOldNetwork(getNetworkDescription(oldNetwork));
+            infoBuilder.setTimeDurationOnOldNetworkSec(
+                    (int) ((mDeps.getElapsedRealtime() - nri.getSatisfiedTime()) / 1000));
+        }
+        if (newNetwork != null) {
+            infoBuilder.setNewNetwork(getNetworkDescription(newNetwork));
+        }
+        infoBuilder.setUidRanges(getUidRangesProto(nri.getUids()));
+        return infoBuilder.build();
+    }
+
+    /**
+     * Creates a NetworkDescription proto from a NetworkAgentInfo.
+     *
+     * @param nai The NetworkAgentInfo to describe.
+     * @return A NetworkDescription proto.
+     */
+    @VisibleForTesting
+    public static NetworkDescription getNetworkDescription(@NonNull final NetworkAgentInfo nai) {
+        final NetworkCapabilities caps = nai.getCapsNoCopy();
+        final NetworkDescription.Builder builder = NetworkDescription.newBuilder();
+        builder.setTransportTypes((int) caps.getTransportTypesInternal());
+        builder.setMeteredState(getMeteredState(caps));
+        builder.setValidatedState(getValidatedState(caps));
+        builder.setScorePolicies(nai.getScore().getPoliciesInternal());
+        builder.setCapabilities(caps.getCapabilitiesInternal());
+        builder.setEnterpriseId(caps.getEnterpriseIdsInternal());
+        return builder.build();
+    }
+
+    /**
+     * Determines the MeteredState from NetworkCapabilities.
+     *
+     * @param caps The NetworkCapabilities of the network.
+     * @return The corresponding MeteredState.
+     */
+    @VisibleForTesting
+    public static MeteredState getMeteredState(@NonNull NetworkCapabilities caps) {
+        if (caps.hasCapability(NET_CAPABILITY_TEMPORARILY_NOT_METERED)) {
+            return METERED_TEMPORARILY_UNMETERED;
+        }
+        if (caps.hasCapability(NET_CAPABILITY_NOT_METERED)) {
+            return METERED_NO;
+        }
+        return METERED_YES;
+    }
+
+    /**
+     * Determines the ValidatedState from NetworkCapabilities.
+     *
+     * @param caps The NetworkCapabilities of the network.
+     * @return The corresponding ValidatedState.
+     */
+    @VisibleForTesting
+    public static ValidatedState getValidatedState(@NonNull NetworkCapabilities caps) {
+        if (caps.hasCapability(NetworkCapabilities.NET_CAPABILITY_CAPTIVE_PORTAL)) {
+            return ValidatedState.VS_PORTAL;
+        }
+        if (caps.hasCapability(NetworkCapabilities.NET_CAPABILITY_PARTIAL_CONNECTIVITY)) {
+            return ValidatedState.VS_PARTIAL;
+        }
+        if (caps.hasCapability(NetworkCapabilities.NET_CAPABILITY_VALIDATED)) {
+            return ValidatedState.VS_VALID;
+        }
+        return ValidatedState.VS_INVALID;
+    }
+
+    /**
+     * Converts a set of UidRange objects to the UidRanges proto format.
+     *
+     * @param rangeSet The set of UidRange objects.
+     * @return The UidRanges proto.
+     */
+    @VisibleForTesting
+    public static UidRanges getUidRangesProto(@NonNull Set<android.net.UidRange> rangeSet) {
+        final UidRanges.Builder listBuilder = UidRanges.newBuilder();
+        for (android.net.UidRange range : rangeSet) {
+            final UidRange.Builder rangeBuilder = UidRange.newBuilder();
+            rangeBuilder.setBegin(range.start);
+            rangeBuilder.setEnd(range.stop);
+            listBuilder.addUidRange(rangeBuilder.build());
+        }
+        return listBuilder.build();
+    }
+}
diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index 2a9d0140a1..f00233e422 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -103,7 +103,6 @@ import static android.net.NetworkCapabilities.NET_CAPABILITY_NOT_VPN;
 import static android.net.NetworkCapabilities.NET_CAPABILITY_OEM_PAID;
 import static android.net.NetworkCapabilities.NET_CAPABILITY_OEM_PRIVATE;
 import static android.net.NetworkCapabilities.NET_CAPABILITY_PARTIAL_CONNECTIVITY;
-import static android.net.NetworkCapabilities.NET_CAPABILITY_TEMPORARILY_NOT_METERED;
 import static android.net.NetworkCapabilities.NET_CAPABILITY_VALIDATED;
 import static android.net.NetworkCapabilities.NET_ENTERPRISE_ID_1;
 import static android.net.NetworkCapabilities.NET_ENTERPRISE_ID_5;
@@ -134,6 +133,7 @@ import static android.system.OsConstants.ETH_P_ALL;
 import static android.system.OsConstants.IPPROTO_TCP;
 import static android.system.OsConstants.IPPROTO_UDP;
 
+import static com.android.metrics.DefaultNetworkRematchMetrics.getNetworkDescription;
 import static com.android.net.module.util.BpfUtils.BPF_CGROUP_GETSOCKOPT;
 import static com.android.net.module.util.BpfUtils.BPF_CGROUP_INET4_BIND;
 import static com.android.net.module.util.BpfUtils.BPF_CGROUP_INET4_CONNECT;
@@ -156,6 +156,7 @@ import static com.android.net.module.util.PermissionUtils.enforceNetworkStackPer
 import static com.android.net.module.util.PermissionUtils.enforceNetworkStackPermissionOr;
 import static com.android.net.module.util.PermissionUtils.hasAnyPermissionOf;
 import static com.android.server.ConnectivityStatsLog.CONNECTIVITY_STATE_SAMPLE;
+import static com.android.server.ConnectivityStatsLog.DEFAULT_NETWORK_REMATCH__REMATCH_REASON__RMR_NETWORK_DISCONNECTED;
 import static com.android.server.NetIdManager.MAX_NET_ID;
 import static com.android.server.NetIdManager.MIN_NET_ID;
 import static com.android.server.connectivity.ConnectivityFlags.CELLULAR_DATA_INACTIVITY_TIMEOUT;
@@ -309,9 +310,7 @@ import android.os.SystemProperties;
 import android.os.UserHandle;
 import android.os.UserManager;
 import android.provider.Settings;
-import android.stats.connectivity.MeteredState;
 import android.stats.connectivity.RequestType;
-import android.stats.connectivity.ValidatedState;
 import android.sysprop.NetworkProperties;
 import android.system.ErrnoException;
 import android.system.OsConstants;
@@ -337,9 +336,9 @@ import com.android.metrics.ConnectionDurationForTransports;
 import com.android.metrics.ConnectionDurationPerTransports;
 import com.android.metrics.ConnectivitySampleMetricsHelper;
 import com.android.metrics.ConnectivityStateSample;
+import com.android.metrics.DefaultNetworkRematchMetrics;
 import com.android.metrics.NetworkCountForTransports;
 import com.android.metrics.NetworkCountPerTransports;
-import com.android.metrics.NetworkDescription;
 import com.android.metrics.NetworkList;
 import com.android.metrics.NetworkRequestCount;
 import com.android.metrics.RequestCountForType;
@@ -670,7 +669,8 @@ public class ConnectivityService extends IConnectivityManager.Stub
      * The default request uses PREFERENCE_ORDER_DEFAULT.
      */
     // Used when sending to netd to code for "no order".
-    static final int PREFERENCE_ORDER_NONE = 0;
+    @VisibleForTesting
+    public static final int PREFERENCE_ORDER_NONE = 0;
     // Order for requests that don't code for a per-app preference. As it is
     // out of the valid range, the corresponding order should be
     // PREFERENCE_ORDER_NONE when sending to netd.
@@ -695,8 +695,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
     static final int PREFERENCE_ORDER_MOBILE_DATA_PREFERERRED = 30;
     // Order of setting satellite network preference fallback when default message application
     // with role_sms role and android.permission.SATELLITE_COMMUNICATION permission detected
-    @VisibleForTesting
-    static final int PREFERENCE_ORDER_SATELLITE_FALLBACK = 40;
+    public static final int PREFERENCE_ORDER_SATELLITE_FALLBACK = 40;
     // Preference order that signifies the network shouldn't be set as a default network for
     // the UIDs, only give them access to it. TODO : replace this with a boolean
     // in NativeUidRangeConfig
@@ -1095,6 +1094,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
     private long mLastWakeLockAcquireTimestamp = 0;
 
     private final IpConnectivityLog mMetricsLog;
+    private final DefaultNetworkRematchMetrics mDefaultNetworkRematchMetrics;
 
     @Nullable private final NetworkRequestStateStatsMetrics mNetworkRequestStateStatsMetrics;
 
@@ -1718,6 +1718,14 @@ public class ConnectivityService extends IConnectivityManager.Stub
             return new SatelliteCoarseUsageMetricsCollector(context);
         }
 
+        /**
+         * @see DefaultNetworkRematchMetrics
+         */
+        @Nullable
+        public DefaultNetworkRematchMetrics makeDefaultNetworkRematchMetrics() {
+            return new DefaultNetworkRematchMetrics();
+        }
+
         /** Creates an L2capNetworkProvider */
         public L2capNetworkProvider makeL2capNetworkProvider(Context context) {
             return new L2capNetworkProvider(context);
@@ -2104,8 +2112,10 @@ public class ConnectivityService extends IConnectivityManager.Stub
         if (mConstrainedDataSatelliteMetrics) {
             mSatelliteCoarseUsageMetricsCollector =
                     mDeps.makeSatelliteCoarseUsageMetricsCollector(mContext);
+            mDefaultNetworkRematchMetrics = mDeps.makeDefaultNetworkRematchMetrics();
         } else {
             mSatelliteCoarseUsageMetricsCollector = null;
+            mDefaultNetworkRematchMetrics = null;
         }
 
         if (mDeps.flagConnectivityServiceDestroySocket()) {
@@ -2955,33 +2965,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
     private static NetworkList sampleNetworks(@NonNull final ArraySet<NetworkAgentInfo> nais) {
         final NetworkList.Builder builder = NetworkList.newBuilder();
         for (final NetworkAgentInfo nai : nais) {
-            final NetworkCapabilities nc = nai.networkCapabilities;
-            final NetworkDescription.Builder d = NetworkDescription.newBuilder();
-            d.setTransportTypes((int) nc.getTransportTypesInternal());
-            final MeteredState meteredState;
-            if (nc.hasCapability(NET_CAPABILITY_TEMPORARILY_NOT_METERED)) {
-                meteredState = MeteredState.METERED_TEMPORARILY_UNMETERED;
-            } else if (nc.hasCapability(NET_CAPABILITY_NOT_METERED)) {
-                meteredState = MeteredState.METERED_NO;
-            } else {
-                meteredState = MeteredState.METERED_YES;
-            }
-            d.setMeteredState(meteredState);
-            final ValidatedState validatedState;
-            if (nc.hasCapability(NET_CAPABILITY_CAPTIVE_PORTAL)) {
-                validatedState = ValidatedState.VS_PORTAL;
-            } else if (nc.hasCapability(NET_CAPABILITY_PARTIAL_CONNECTIVITY)) {
-                validatedState = ValidatedState.VS_PARTIAL;
-            } else if (nc.hasCapability(NET_CAPABILITY_VALIDATED)) {
-                validatedState = ValidatedState.VS_VALID;
-            } else {
-                validatedState = ValidatedState.VS_INVALID;
-            }
-            d.setValidatedState(validatedState);
-            d.setScorePolicies(nai.getScore().getPoliciesInternal());
-            d.setCapabilities(nc.getCapabilitiesInternal());
-            d.setEnterpriseId(nc.getEnterpriseIdsInternal());
-            builder.addNetworkDescription(d);
+            builder.addNetworkDescription(getNetworkDescription(nai));
         }
         return builder.build();
     }
@@ -5829,7 +5813,13 @@ public class ConnectivityService extends IConnectivityManager.Stub
                 // TODO : setting the satisfier is in fact the job of the rematch. Teach the
                 // rematch not to keep disconnected agents instead of setting it here ; this
                 // will also allow removing updating the offers below.
+                if (mConstrainedDataSatelliteMetrics && mDefaultNetworkRequests.contains(nri)) {
+                    // Must be called before satisfier changes to get satisfied time.
+                    // See NRI#getSatisfiedTime().
+                    mDefaultNetworkRematchMetrics.addEvent(nri, currentNetwork, null);
+                }
                 nri.setSatisfier(null, null);
+
                 for (final NetworkOfferInfo noi : mNetworkOffers) {
                     informOffer(nri, noi.offer, mNetworkRanker);
                 }
@@ -5841,6 +5831,19 @@ public class ConnectivityService extends IConnectivityManager.Stub
                 }
             }
         }
+        // This has to be called before rematch because rematch collects and builds
+        // another event. When a default network(1) disconnects, this call reports a
+        // network1->null reassignment for default network requests. A subsequent
+        // rematch (rematchAllNetworksAndRequests) will then report a null->network2
+        // event if a new network(2) takes over as default.
+        // This two-step reporting (network1->null, then null->network2) instead of
+        // a direct network1->network2 is a result of current architectural within
+        // ConnectivityService. This can be resolved if the TODO before setSatisfier
+        // above is fixed.
+        if (mConstrainedDataSatelliteMetrics) {
+            mDefaultNetworkRematchMetrics.writeStatsAndClear(
+                    DEFAULT_NETWORK_REMATCH__REMATCH_REASON__RMR_NETWORK_DISCONNECTED);
+        }
         nai.clearInactivityState();
         // TODO: mLegacyTypeTracker.remove seems redundant given there's a full rematch right after.
         //  Currently, deleting it breaks tests that check for the default network disconnecting.
@@ -8084,8 +8087,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
      * Tracks info about the requester.
      * Also used to notice when the calling process dies so as to self-expire
      */
-    @VisibleForTesting
-    protected class NetworkRequestInfo implements IBinder.DeathRecipient {
+    public class NetworkRequestInfo implements IBinder.DeathRecipient {
         // The requests to be satisfied in priority order. Non-multilayer requests will only have a
         // single NetworkRequest in mRequests.
         final List<NetworkRequest> mRequests;
@@ -8119,6 +8121,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
                 @Nullable final NetworkRequest activeRequest) {
             mSatisfier = satisfier;
             mActiveRequest = activeRequest;
+            mSatisfiedTime = SystemClock.elapsedRealtime();
         }
 
         // The network currently satisfying this NRI. Only one request in an NRI can have a
@@ -8129,6 +8132,16 @@ public class ConnectivityService extends IConnectivityManager.Stub
             return mSatisfier;
         }
 
+        private long mSatisfiedTime = 0;
+
+        /**
+         * Get timestamp (SystemClock.elapsedRealtime()) when the satisfier is set for this NRI.
+         * Resets when the satisfier changes.
+         */
+        public long getSatisfiedTime() {
+            return mSatisfiedTime;
+        }
+
         // The request in mRequests assigned to a network agent. This is null if none of the
         // requests in mRequests can be satisfied. This member has the constraint of only being
         // accessible on the handler thread.
@@ -8213,7 +8226,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
          * Get the list of UIDs this nri applies to.
          */
         @NonNull
-        Set<UidRange> getUids() {
+        public Set<UidRange> getUids() {
             // networkCapabilities.getUids() returns a defensive copy.
             // multilayer requests will all have the same uids so return the first one.
             final Set<UidRange> uids = mRequests.get(0).networkCapabilities.getUidRanges();
@@ -8550,7 +8563,8 @@ public class ConnectivityService extends IConnectivityManager.Stub
             return mPreferenceOrder < target.mPreferenceOrder;
         }
 
-        int getPreferenceOrderForNetd() {
+        /** Return the preference order. */
+        public int getPreferenceOrderForNetd() {
             if (mPreferenceOrder >= PREFERENCE_ORDER_NONE
                     && mPreferenceOrder <= PREFERENCE_ORDER_LOWEST) {
                 return mPreferenceOrder;
@@ -11674,6 +11688,21 @@ public class ConnectivityService extends IConnectivityManager.Stub
         }
     }
 
+    private void writeStatsForDefaultNetworkChanges(@NonNull final NetworkReassignment changes) {
+        if (!mConstrainedDataSatelliteMetrics) return;
+        for (final NetworkRequestInfo defaultRequestInfo : mDefaultNetworkRequests) {
+            final NetworkReassignment.RequestReassignment reassignment =
+                    changes.getReassignment(defaultRequestInfo);
+            if (null == reassignment) {
+                continue;
+            }
+            mDefaultNetworkRematchMetrics.addEvent(defaultRequestInfo,
+                    reassignment.mOldNetwork, reassignment.mNewNetwork);
+        }
+        // TODO: fill rematch reason.
+        mDefaultNetworkRematchMetrics.writeStatsAndClear();
+    }
+
     private void resetHttpProxyForNonDefaultNetwork(NetworkAgentInfo oldDefaultNetwork) {
         if (null == oldDefaultNetwork) return;
         // The network stopped being the default. If it was using a PAC proxy, then the
@@ -12112,7 +12141,11 @@ public class ConnectivityService extends IConnectivityManager.Stub
             if (nai.isBackgroundNetwork()) oldBgNetworks.add(nai);
         }
 
-        // First, update the lists of satisfied requests in the network agents. This is necessary
+        // This needs to be called before NRI#setSatisfier() because the NRI#getSatisfiedTime()
+        // will be reset when that happens.
+        writeStatsForDefaultNetworkChanges(changes);
+
+        // Update the lists of satisfied requests in the network agents. This is necessary
         // because some code later depends on this state to be correct, most prominently computing
         // the linger status.
         for (final NetworkReassignment.RequestReassignment event :
diff --git a/tests/unit/java/com/android/metrics/DefaultNetworkRematchMetricsTest.kt b/tests/unit/java/com/android/metrics/DefaultNetworkRematchMetricsTest.kt
new file mode 100644
index 0000000000..9595be297a
--- /dev/null
+++ b/tests/unit/java/com/android/metrics/DefaultNetworkRematchMetricsTest.kt
@@ -0,0 +1,261 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.metrics
+
+import android.net.NetworkCapabilities
+import android.net.NetworkCapabilities.NET_CAPABILITY_CAPTIVE_PORTAL
+import android.net.NetworkCapabilities.NET_CAPABILITY_NOT_METERED
+import android.net.NetworkCapabilities.NET_CAPABILITY_PARTIAL_CONNECTIVITY
+import android.net.NetworkCapabilities.NET_CAPABILITY_TEMPORARILY_NOT_METERED
+import android.net.NetworkCapabilities.NET_CAPABILITY_VALIDATED
+import android.net.NetworkCapabilities.TRANSPORT_SATELLITE
+import android.net.UidRange
+import android.os.Build
+import android.stats.connectivity.MeteredState.METERED_NO
+import android.stats.connectivity.MeteredState.METERED_TEMPORARILY_UNMETERED
+import android.stats.connectivity.MeteredState.METERED_YES
+import android.stats.connectivity.ValidatedState.VS_INVALID
+import android.stats.connectivity.ValidatedState.VS_PARTIAL
+import android.stats.connectivity.ValidatedState.VS_PORTAL
+import android.stats.connectivity.ValidatedState.VS_VALID
+import com.android.metrics.DefaultNetworkRematchMetrics.Dependencies
+import com.android.server.ConnectivityService
+import com.android.server.ConnectivityService.PREFERENCE_ORDER_NONE
+import com.android.server.ConnectivityService.PREFERENCE_ORDER_SATELLITE_FALLBACK
+import com.android.server.connectivity.FullScore
+import com.android.server.connectivity.NetworkAgentInfo
+import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
+import com.android.testutils.DevSdkIgnoreRunner
+import kotlin.test.assertEquals
+import kotlin.test.assertTrue
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.mockito.ArgumentCaptor
+import org.mockito.Mockito.any
+import org.mockito.Mockito.anyInt
+import org.mockito.Mockito.anyLong
+import org.mockito.Mockito.clearInvocations
+import org.mockito.Mockito.doReturn
+import org.mockito.Mockito.mock
+import org.mockito.Mockito.never
+import org.mockito.Mockito.times
+import org.mockito.Mockito.verify
+
+@RunWith(DevSdkIgnoreRunner::class)
+@IgnoreUpTo(Build.VERSION_CODES.TIRAMISU)
+class DefaultNetworkRematchMetricsTest {
+
+    private val deps = mock(Dependencies::class.java)
+
+    private val nc = mock(NetworkCapabilities::class.java).also {
+        doReturn(1L shl TRANSPORT_SATELLITE).`when`(it).transportTypesInternal
+        doReturn(0L).`when`(it).capabilitiesInternal
+        doReturn(true).`when`(it).hasTransport(TRANSPORT_SATELLITE)
+    }
+
+    private val score = mock(FullScore::class.java).also {
+        doReturn(0L).`when`(it).policiesInternal
+    }
+
+    private val oldNai = mock(NetworkAgentInfo::class.java).also {
+        doReturn(nc).`when`(it).capsNoCopy
+        doReturn(score).`when`(it).score
+    }
+
+    private val newNai = mock(NetworkAgentInfo::class.java).also {
+        doReturn(nc).`when`(it).capsNoCopy
+        doReturn(score).`when`(it).score
+    }
+
+    private val nri = mock(ConnectivityService.NetworkRequestInfo::class.java).also {
+                doReturn(PREFERENCE_ORDER_SATELLITE_FALLBACK).`when`(it).preferenceOrderForNetd
+                doReturn(emptySet<UidRange>()).`when`(it).uids
+            }
+
+    private val infoListCaptor = ArgumentCaptor.forClass(DefaultNetworkRematchInfoList::class.java)
+
+    private val metrics = DefaultNetworkRematchMetrics(deps)
+
+    @Test
+    fun testAddEvent_wrongPreference_isIgnored() {
+        doReturn(PREFERENCE_ORDER_NONE).`when`(nri).preferenceOrderForNetd
+
+        metrics.addEvent(nri, oldNai, newNai)
+        metrics.writeStatsAndClear()
+
+        verify(deps, never()).writeStats(anyLong(), anyInt(), any())
+    }
+
+    @Test
+    fun testAddEvent_notFromSatellite_isIgnored() {
+        // Setup: The old network is not a satellite network. The mock for its capabilities
+        // will return false when checked for the SATELLITE transport type.
+        val nonSatelliteCaps = mock(NetworkCapabilities::class.java)
+        doReturn(false).`when`(nonSatelliteCaps).hasTransport(TRANSPORT_SATELLITE)
+        doReturn(nonSatelliteCaps).`when`(oldNai).capsNoCopy
+
+        // Action: Attempt to add the event and write stats.
+        metrics.addEvent(nri, oldNai, newNai)
+        metrics.writeStatsAndClear()
+
+        // Verification: The event should be ignored, so writeStats should never be called.
+        verify(deps, never()).writeStats(anyLong(), anyInt(), any())
+    }
+
+    @Test
+    fun testAddEvent_validRequest_isAdded() {
+        metrics.addEvent(nri, oldNai, newNai)
+        metrics.writeStatsAndClear()
+
+        verify(deps, times(1)).writeStats(anyLong(), anyInt(), any())
+    }
+
+    @Test
+    fun testWriteStats_noEvents_doesNothing() {
+        metrics.writeStatsAndClear()
+        verify(deps, never()).writeStats(anyLong(), anyInt(), any())
+    }
+
+    @Test
+    fun testWriteStats_withEvents_writesAndClears() {
+        // Setup: Define the time the network satisfied time and the current time.
+        val satisfiedTimeMs = 100_000L
+        val currentTimeMs = 220_000L // 120 seconds after satisfied
+        val expectedDurationSec = ((currentTimeMs - satisfiedTimeMs) / 1000).toInt()
+
+        // Mock the dependencies to return the defined times.
+        doReturn(satisfiedTimeMs).`when`(oldNai).connectedTime
+        doReturn(currentTimeMs).`when`(deps).elapsedRealtime
+
+        // Mock the dependencies to return the defined times.
+        doReturn(satisfiedTimeMs).`when`(nri).satisfiedTime
+
+        // First call: Add event and write
+        metrics.addEvent(nri, oldNai, newNai)
+        metrics.writeStatsAndClear()
+
+        verify(deps, times(1)).writeStats(anyLong(), anyInt(), infoListCaptor.capture())
+        val capturedList = infoListCaptor.value
+        assertEquals(1, capturedList.defaultNetworkRematchInfoList.size)
+        val info = capturedList.defaultNetworkRematchInfoList[0]
+        assertEquals(expectedDurationSec, info.timeDurationOnOldNetworkSec)
+
+        // Second call: Should do nothing as events are cleared
+        clearInvocations(deps)
+        metrics.writeStatsAndClear()
+        verify(deps, never()).writeStats(anyLong(), anyInt(), any())
+    }
+
+    @Test
+    fun testGetMeteredState() {
+        // Temporarily Unmetered should be checked first
+        val tempUnmeteredCaps = mock(NetworkCapabilities::class.java)
+        doReturn(true).`when`(tempUnmeteredCaps)
+                .hasCapability(NET_CAPABILITY_TEMPORARILY_NOT_METERED)
+        doReturn(true).`when`(tempUnmeteredCaps)
+                .hasCapability(NET_CAPABILITY_NOT_METERED)
+        assertEquals(
+            METERED_TEMPORARILY_UNMETERED,
+            DefaultNetworkRematchMetrics.getMeteredState(tempUnmeteredCaps)
+        )
+
+        // Not Metered
+        val notMeteredCaps = mock(NetworkCapabilities::class.java)
+        doReturn(true).`when`(notMeteredCaps).hasCapability(NET_CAPABILITY_NOT_METERED)
+        assertEquals(METERED_NO, DefaultNetworkRematchMetrics.getMeteredState(notMeteredCaps))
+
+        // Metered (default)
+        val meteredCaps = mock(NetworkCapabilities::class.java)
+        assertEquals(METERED_YES, DefaultNetworkRematchMetrics.getMeteredState(meteredCaps))
+    }
+
+    @Test
+    fun testGetValidatedState() {
+        // Valid
+        val validatedCaps = mock(NetworkCapabilities::class.java)
+        doReturn(true).`when`(validatedCaps).hasCapability(NET_CAPABILITY_VALIDATED)
+        assertEquals(VS_VALID, DefaultNetworkRematchMetrics.getValidatedState(validatedCaps))
+
+        // Captive Portal
+        val portalCaps = mock(NetworkCapabilities::class.java)
+        doReturn(true).`when`(portalCaps).hasCapability(NET_CAPABILITY_CAPTIVE_PORTAL)
+        assertEquals(VS_PORTAL, DefaultNetworkRematchMetrics.getValidatedState(portalCaps))
+
+        // Partial Connectivity
+        val partialCaps = mock(NetworkCapabilities::class.java)
+        doReturn(true).`when`(partialCaps).hasCapability(NET_CAPABILITY_PARTIAL_CONNECTIVITY)
+        assertEquals(VS_PARTIAL, DefaultNetworkRematchMetrics.getValidatedState(partialCaps))
+
+        // Invalid
+        val invalidCaps = mock(NetworkCapabilities::class.java).also {
+            doReturn(false).`when`(it).hasCapability(NET_CAPABILITY_VALIDATED)
+            doReturn(false).`when`(it).hasCapability(NET_CAPABILITY_CAPTIVE_PORTAL)
+            doReturn(false).`when`(it).hasCapability(NET_CAPABILITY_PARTIAL_CONNECTIVITY)
+        }
+        assertEquals(VS_INVALID, DefaultNetworkRematchMetrics.getValidatedState(invalidCaps))
+    }
+
+    @Test
+    fun testGetUidRangesProto() {
+        val uids = setOf(UidRange(1000, 1000), UidRange(2000, 3000))
+        doReturn(uids).`when`(nri).uids
+
+        metrics.addEvent(nri, oldNai, null)
+        metrics.writeStatsAndClear()
+
+        verify(deps).writeStats(anyLong(), anyInt(), infoListCaptor.capture())
+        val capturedInfo = infoListCaptor.value.defaultNetworkRematchInfoList[0]
+
+        val capturedRanges = capturedInfo.uidRanges.uidRangeList
+        assertEquals(2, capturedRanges.size)
+        assertTrue(capturedRanges.any { it.begin == 1000 && it.end == 1000 })
+        assertTrue(capturedRanges.any { it.begin == 2000 && it.end == 3000 })
+    }
+
+    @Test
+    fun testGetNetworkDescription() {
+        val transports = 0x67890ABL
+        val capsInternal = 12345L
+        val scorePoliciesInternal = 0xDEADBEEFL
+        val enterpriseIds = 0x03
+
+        val caps = mock(NetworkCapabilities::class.java).also {
+            doReturn(transports).`when`(it).transportTypesInternal
+            doReturn(true).`when`(it).hasCapability(NET_CAPABILITY_VALIDATED)
+            doReturn(true).`when`(it).hasCapability(NET_CAPABILITY_NOT_METERED)
+            doReturn(capsInternal).`when`(it).capabilitiesInternal
+            doReturn(enterpriseIds).`when`(it).enterpriseIdsInternal
+        }
+        val score = mock(FullScore::class.java).also {
+            doReturn(scorePoliciesInternal).`when`(it).policiesInternal
+        }
+
+        val nai = mock(NetworkAgentInfo::class.java).also {
+            doReturn(caps).`when`(it).capsNoCopy
+            doReturn(score).`when`(it).score
+        }
+
+        val description = DefaultNetworkRematchMetrics.getNetworkDescription(nai)
+
+        assertEquals(transports.toInt(), description.transportTypes)
+        assertEquals(VS_VALID, description.validatedState)
+        assertEquals(METERED_NO, description.meteredState)
+        assertEquals(capsInternal, description.capabilities)
+        assertEquals(scorePoliciesInternal, description.scorePolicies)
+        assertEquals(enterpriseIds, description.enterpriseId)
+    }
+}
diff --git a/tests/unit/java/com/android/server/ConnectivityServiceTest.java b/tests/unit/java/com/android/server/ConnectivityServiceTest.java
index 7cb7219411..08be2ecf03 100644
--- a/tests/unit/java/com/android/server/ConnectivityServiceTest.java
+++ b/tests/unit/java/com/android/server/ConnectivityServiceTest.java
@@ -391,6 +391,7 @@ import com.android.internal.net.VpnConfig;
 import com.android.internal.util.WakeupMessage;
 import com.android.internal.util.test.BroadcastInterceptingContext;
 import com.android.internal.util.test.FakeSettingsProvider;
+import com.android.metrics.DefaultNetworkRematchMetrics;
 import com.android.metrics.SatelliteCoarseUsageMetricsCollector;
 import com.android.modules.utils.build.SdkLevel;
 import com.android.net.module.util.ArrayTrackRecord;
@@ -652,6 +653,7 @@ public class ConnectivityServiceTest {
     @Mock KeepaliveTracker.Dependencies mMockKeepaliveTrackerDependencies;
     @Mock SatelliteAccessController mSatelliteAccessController;
     @Mock SatelliteCoarseUsageMetricsCollector mSatelliteCoarseUsageMetricsCollector;
+    @Mock DefaultNetworkRematchMetrics mDefaultNetworkRematchMetrics;
 
     // BatteryStatsManager is final and cannot be mocked with regular mockito, so just mock the
     // underlying binder calls.
@@ -2101,6 +2103,11 @@ public class ConnectivityServiceTest {
             return mSatelliteCoarseUsageMetricsCollector;
         }
 
+        @Override
+        public DefaultNetworkRematchMetrics makeDefaultNetworkRematchMetrics() {
+            return mDefaultNetworkRematchMetrics;
+        }
+
         @Override
         public boolean intentFilterEquals(final PendingIntent a, final PendingIntent b) {
             return runAsShell(GET_INTENT_SENDER_INTENT, () -> a.intentFilterEquals(b));
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSDefaultNetworkRematchMetricsTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSDefaultNetworkRematchMetricsTest.kt
new file mode 100644
index 0000000000..80b78836bd
--- /dev/null
+++ b/tests/unit/java/com/android/server/connectivityservice/CSDefaultNetworkRematchMetricsTest.kt
@@ -0,0 +1,121 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.server
+
+import android.net.Network
+import android.net.NetworkCapabilities.NET_CAPABILITY_INTERNET
+import android.net.NetworkCapabilities.TRANSPORT_CELLULAR
+import android.net.NetworkCapabilities.TRANSPORT_WIFI
+import android.os.Build
+import com.android.server.ConnectivityService.NetworkRequestInfo
+import com.android.server.ConnectivityStatsLog.DEFAULT_NETWORK_REMATCH__REMATCH_REASON__RMR_NETWORK_DISCONNECTED
+import com.android.server.connectivity.NetworkAgentInfo
+import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
+import com.android.testutils.DevSdkIgnoreRunner
+import org.junit.Assert.fail
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.mockito.ArgumentCaptor
+import org.mockito.Mockito.atLeastOnce
+import org.mockito.Mockito.reset
+import org.mockito.Mockito.verify
+
+private const val DEFAULT_REQUEST_ID = 1
+private inline fun <reified T> argumentCaptor() = ArgumentCaptor.forClass(T::class.java)
+
+@IgnoreUpTo(Build.VERSION_CODES.TIRAMISU)
+@RunWith(DevSdkIgnoreRunner::class)
+class CSDefaultNetworkRematchMetricsTest : CSTest() {
+    @Test
+    fun testRematchWritesStats() {
+        waitForIdle()
+        reset(defaultNetworkRematchMetrics)
+
+        // 1. Connect a cellular network. It becomes the default.
+        val naiCell = Agent(nc = nc(TRANSPORT_CELLULAR, NET_CAPABILITY_INTERNET))
+        naiCell.connect(true)
+        waitForIdle()
+        eventuallyExpectAddEvent(DEFAULT_REQUEST_ID, null, naiCell.network)
+        verify(defaultNetworkRematchMetrics, atLeastOnce()).writeStatsAndClear()
+        reset(defaultNetworkRematchMetrics)
+
+        // 2. Connect a WiFi network. It has a higher score and will cause a rematch.
+        val naiWifi = Agent(nc = nc(TRANSPORT_WIFI, NET_CAPABILITY_INTERNET))
+        naiWifi.connect(true)
+        waitForIdle()
+
+        // 3. Verify: The rematch should trigger writing the stats.
+        eventuallyExpectAddEvent(DEFAULT_REQUEST_ID, naiCell.network, naiWifi.network)
+        verify(defaultNetworkRematchMetrics, atLeastOnce()).writeStatsAndClear()
+    }
+
+    @Test
+    fun testDisconnectWritesStats() {
+        waitForIdle()
+        reset(defaultNetworkRematchMetrics)
+
+        // 1. Connect a cellular network. It becomes the default.
+        val naiCell = Agent(nc = nc(TRANSPORT_CELLULAR, NET_CAPABILITY_INTERNET))
+        naiCell.connect(true)
+        waitForIdle()
+        eventuallyExpectAddEvent(DEFAULT_REQUEST_ID, null, naiCell.network)
+        verify(defaultNetworkRematchMetrics, atLeastOnce()).writeStatsAndClear()
+        reset(defaultNetworkRematchMetrics)
+
+        // 2. Disconnect the cellular network.
+        naiCell.disconnect()
+        waitForIdle()
+
+        // 3. Verify: Disconnecting the default network should trigger writing the stats.
+        eventuallyExpectAddEvent(DEFAULT_REQUEST_ID, naiCell.network, null)
+        verify(defaultNetworkRematchMetrics, atLeastOnce()).writeStatsAndClear(
+                DEFAULT_NETWORK_REMATCH__REMATCH_REASON__RMR_NETWORK_DISCONNECTED
+        )
+    }
+
+    private fun eventuallyExpectAddEvent(
+            expectedRequestId: Int,
+            expectedOldNetwork: Network?,
+            expectedNewNetwork: Network?
+    ) {
+        val nriCaptor = argumentCaptor<NetworkRequestInfo>()
+        val oldNetworkCaptor = argumentCaptor<NetworkAgentInfo?>()
+        val newNetworkCaptor = argumentCaptor<NetworkAgentInfo?>()
+        verify(defaultNetworkRematchMetrics, atLeastOnce()).addEvent(
+                nriCaptor.capture(),
+                oldNetworkCaptor.capture(),
+                newNetworkCaptor.capture()
+        )
+
+        // TODO: Support checking multilayer requests.
+        val capturedEvents = nriCaptor.allValues.indices.map { i ->
+            val requestId = nriCaptor.allValues[i].mRequests[0].requestId
+            val oldNetwork = oldNetworkCaptor.allValues[i]
+            val newNetwork = newNetworkCaptor.allValues[i]
+            if (requestId == expectedRequestId && oldNetwork?.network == expectedOldNetwork &&
+                    newNetwork?.network == expectedNewNetwork) {
+                        return
+                    }
+            Triple(requestId, oldNetwork?.network, newNetwork?.network)
+        }
+
+        fail(
+                "Expecting ($expectedRequestId, $expectedOldNetwork, $expectedNewNetwork) " +
+                        "but got $capturedEvents"
+        )
+    }
+}
diff --git a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
index 916f04d93d..1d05e4ad20 100644
--- a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
@@ -66,6 +66,7 @@ import android.util.SparseArray
 import androidx.test.platform.app.InstrumentationRegistry
 import com.android.internal.app.IBatteryStats
 import com.android.internal.util.test.BroadcastInterceptingContext
+import com.android.metrics.DefaultNetworkRematchMetrics
 import com.android.metrics.SatelliteCoarseUsageMetricsCollector
 import com.android.modules.utils.build.SdkLevel
 import com.android.net.module.util.ArrayTrackRecord
@@ -235,6 +236,7 @@ open class CSTest {
     val multicastRoutingCoordinatorService = mock<MulticastRoutingCoordinatorService>()
     val satelliteAccessController = mock<SatelliteAccessController>()
     val satelliteCoarseUsageMetricsCollector = mock<SatelliteCoarseUsageMetricsCollector>()
+    val defaultNetworkRematchMetrics = mock<DefaultNetworkRematchMetrics>()
     val quicConnectionCloser = mock<QuicConnectionCloser>()
     val destroySocketsWrapper = mock<DestroySocketsWrapper>()
     val dnsResolver = mock<IDnsResolver>()
@@ -351,6 +353,10 @@ open class CSTest {
                 context: Context
         ) = satelliteCoarseUsageMetricsCollector
 
+        override fun makeDefaultNetworkRematchMetrics(): DefaultNetworkRematchMetrics? {
+            return defaultNetworkRematchMetrics
+        }
+
         private inner class AOOKTDeps(c: Context) : AutomaticOnOffKeepaliveTracker.Dependencies(c) {
             override fun isTetheringFeatureNotChickenedOut(name: String): Boolean {
                 return isFeatureEnabled(context, name)

From abab191ff392a2b2d012ae6877664056e2e9fcc9 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Tue, 3 Jun 2025 16:38:02 -0700
Subject: [PATCH 354/377] Move trackAvailableInterfaces into
 EthernetNetlinkMonitor

This change moves trackAvailableInterfaces into EthernetNetlinkMonitor
and renames it to requestLinkDump.

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I0d3173a6376207a5391deb696df666534e700276
---
 .../server/ethernet/EthernetTracker.java      | 51 ++++++++++---------
 1 file changed, 26 insertions(+), 25 deletions(-)

diff --git a/service-t/src/com/android/server/ethernet/EthernetTracker.java b/service-t/src/com/android/server/ethernet/EthernetTracker.java
index 18abff11ad..cf77f4935f 100644
--- a/service-t/src/com/android/server/ethernet/EthernetTracker.java
+++ b/service-t/src/com/android/server/ethernet/EthernetTracker.java
@@ -149,7 +149,7 @@ public class EthernetTracker {
     private final Handler mHandler;
     private final EthernetNetworkFactory mFactory;
     private final EthernetConfigStore mConfigStore;
-    private final NetlinkMonitor mNetlinkMonitor;
+    private final EthernetNetlinkMonitor mNetlinkMonitor;
     private final Dependencies mDeps;
 
     private final RemoteCallbackList<IEthernetServiceListener> mListeners =
@@ -203,6 +203,29 @@ public class EthernetTracker {
                     OsConstants.NETLINK_ROUTE, NetlinkConstants.RTMGRP_LINK);
         }
 
+        /** Request RTM_GETLINK dump. Resulting callbacks are handled by #processNetlinkMessage. */
+        public void requestLinkDump() {
+            // TODO(b/422484024): Clean up NetlinkMessage classes and add support for building a
+            // generic GETLINK message.
+            // Allocate enough space for struct nlmsghdr + struct rtgenmsg
+            final ByteBuffer buf = ByteBuffer.allocate(StructNlMsgHdr.STRUCT_SIZE + 1);
+            buf.order(ByteOrder.nativeOrder());
+
+            final StructNlMsgHdr nlmsghdr = new StructNlMsgHdr();
+            nlmsghdr.nlmsg_len = buf.capacity();
+            nlmsghdr.nlmsg_type = RTM_GETLINK;
+            nlmsghdr.nlmsg_flags = StructNlMsgHdr.NLM_F_DUMP | StructNlMsgHdr.NLM_F_REQUEST;
+            nlmsghdr.pack(buf);
+
+            // struct rtgenmsg {
+            //   unsigned char rtgen_family;
+            // }
+            buf.put((byte) OsConstants.AF_UNSPEC);
+            buf.flip();
+
+            sendNetlinkMessage(buf);
+        }
+
         private void onNewLink(EthernetPort port, boolean linkUp) {
             final String ifname = port.getInterfaceName();
             if (!mFactory.hasInterface(ifname) && !ifname.equals(mTetheringInterface)) {
@@ -314,7 +337,7 @@ public class EthernetTracker {
 
         mHandler.post(() -> {
             mNetlinkMonitor.start();
-            trackAvailableInterfaces();
+            mNetlinkMonitor.requestLinkDump();
         });
     }
 
@@ -507,7 +530,7 @@ public class EthernetTracker {
         mHandler.post(() -> {
             mIncludeTestInterfaces = include;
             if (include) {
-                trackAvailableInterfaces();
+                mNetlinkMonitor.requestLinkDump();
             } else {
                 removeTestData();
                 // remove all test interfaces
@@ -766,28 +789,6 @@ public class EthernetTracker {
         broadcastInterfaceStateChange(iface);
     }
 
-    private void trackAvailableInterfaces() {
-        // TODO: Clean up NetlinkMessage classes and add support for building a generic GETLINK
-        // message.
-        // Allocate enough space for struct nlmsghdr + struct rtgenmsg
-        final ByteBuffer buf = ByteBuffer.allocate(StructNlMsgHdr.STRUCT_SIZE + 1);
-        buf.order(ByteOrder.nativeOrder());
-
-        final StructNlMsgHdr nlmsghdr = new StructNlMsgHdr();
-        nlmsghdr.nlmsg_len = buf.capacity();
-        nlmsghdr.nlmsg_type = RTM_GETLINK;
-        nlmsghdr.nlmsg_flags = StructNlMsgHdr.NLM_F_DUMP | StructNlMsgHdr.NLM_F_REQUEST;
-        nlmsghdr.pack(buf);
-
-        // struct rtgenmsg {
-        //   unsigned char rtgen_family;
-        // }
-        buf.put((byte) OsConstants.AF_UNSPEC);
-        buf.flip();
-
-        mNetlinkMonitor.sendNetlinkMessage(buf);
-    }
-
     private static class ListenerInfo {
 
         boolean canUseRestrictedNetworks = false;

From 9a807952641729562bc0e4d5eb1533d68cfc5a87 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Thu, 29 May 2025 15:03:26 -0700
Subject: [PATCH 355/377] Pass EthernetPort into maybeTrackInterface

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I5405d71d71a17eb6ee6ba4c7ccd309d49c503240
---
 .../src/com/android/server/ethernet/EthernetTracker.java | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/service-t/src/com/android/server/ethernet/EthernetTracker.java b/service-t/src/com/android/server/ethernet/EthernetTracker.java
index cf77f4935f..6d3ca04692 100644
--- a/service-t/src/com/android/server/ethernet/EthernetTracker.java
+++ b/service-t/src/com/android/server/ethernet/EthernetTracker.java
@@ -230,7 +230,7 @@ public class EthernetTracker {
             final String ifname = port.getInterfaceName();
             if (!mFactory.hasInterface(ifname) && !ifname.equals(mTetheringInterface)) {
                 Log.i(TAG, "onInterfaceAdded: " + port);
-                maybeTrackInterface(ifname);
+                maybeTrackInterface(port);
             }
             Log.i(TAG, "interfaceLinkStateChanged: " + port + ", up: " + linkUp);
             updateInterfaceState(ifname, linkUp);
@@ -770,14 +770,15 @@ public class EthernetTracker {
         mTetheredInterfaceWasAvailable = available;
     }
 
-    private void maybeTrackInterface(String iface) {
+    private void maybeTrackInterface(EthernetPort port) {
+        final String iface = port.getInterfaceName();
         // If we don't already track this interface, and if this interface matches
         // our regex, start tracking it.
         if (mFactory.hasInterface(iface) || iface.equals(mTetheringInterface)) {
-            if (DBG) Log.w(TAG, "Ignoring already-tracked interface " + iface);
+            if (DBG) Log.w(TAG, "Ignoring already-tracked " + port);
             return;
         }
-        if (DBG) Log.i(TAG, "maybeTrackInterface: " + iface);
+        if (DBG) Log.i(TAG, "maybeTrackInterface: " + port);
 
         // Do not use an interface for tethering if it has configured NetworkCapabilities.
         if (mTetheringInterface == null && !mNetworkCapabilities.containsKey(iface)) {

From a77d5ac1268d82337a779a702c88268d0544665e Mon Sep 17 00:00:00 2001
From: Chalard Jean <jchalard@google.com>
Date: Fri, 2 May 2025 14:51:22 +0900
Subject: [PATCH 356/377] Make a base class for testable callbacks

Have TestableNetworkCallback adopt it, as a first client. It's also by
far the most complex.

Test: TH
Flag: EXEMPT test-only
Change-Id: Ifd636a09d0695f04b17330c4987f2b7b742508fa
---
 .../testutils/TestableNetworkCallbackTest.kt  |  35 +-
 .../TestableNetworkCallbackTestJava.java      |  22 +-
 .../ConnectivityCheckTest.kt                  |   2 +-
 .../testutils/TestableNetworkCallback.kt      | 233 ++++++------
 .../net/module/util/TestableCallback.kt       | 358 ++++++++++++++++++
 .../net/cts/ConnectivityManagerTest.java      |  10 +-
 .../CSL2capProviderTest.kt                    |  14 +-
 7 files changed, 522 insertions(+), 152 deletions(-)
 create mode 100644 staticlibs/testutils/hostdevice/com/android/net/module/util/TestableCallback.kt

diff --git a/staticlibs/tests/unit/src/com/android/testutils/TestableNetworkCallbackTest.kt b/staticlibs/tests/unit/src/com/android/testutils/TestableNetworkCallbackTest.kt
index c35013da86..c7661d49bc 100644
--- a/staticlibs/tests/unit/src/com/android/testutils/TestableNetworkCallbackTest.kt
+++ b/staticlibs/tests/unit/src/com/android/testutils/TestableNetworkCallbackTest.kt
@@ -122,6 +122,7 @@ class TestableNetworkCallbackTest {
         mCallback.assertNoCallback(SHORT_TIMEOUT_MS)
         mCallback.onAvailable(Network(100))
         assertFails { mCallback.assertNoCallback(SHORT_TIMEOUT_MS) }
+        mCallback.expect<Available>()
         val net = Network(101)
         mCallback.assertNoCallback { it is Available }
         mCallback.onAvailable(net)
@@ -277,33 +278,33 @@ class TestableNetworkCallbackTest {
     fun testAllExpectOverloads() {
         // This test should never run, it only checks that all overloads exist and build
         assumeTrue(false)
-        val hn = object : TestableNetworkCallback.HasNetwork { override val network = ANY_NETWORK }
+        val hn = object : TestableNetworkCallback.HasNetwork { override val network = AnyNetwork }
 
         // Method with all arguments (version that takes a Network)
-        mCallback.expect(AVAILABLE, ANY_NETWORK, 10, "error") { true }
+        mCallback.expect(AVAILABLE, AnyNetwork, 10, "error") { true }
 
         // Java overloads omitting one argument. One line for omitting each argument, in positional
         // order. Versions that take a Network.
         mCallback.expect(AVAILABLE, 10, "error") { true }
-        mCallback.expect(AVAILABLE, ANY_NETWORK, "error") { true }
-        mCallback.expect(AVAILABLE, ANY_NETWORK, 10) { true }
-        mCallback.expect(AVAILABLE, ANY_NETWORK, 10, "error")
+        mCallback.expect(AVAILABLE, AnyNetwork, "error") { true }
+        mCallback.expect(AVAILABLE, AnyNetwork, 10) { true }
+        mCallback.expect(AVAILABLE, AnyNetwork, 10, "error")
 
         // Java overloads for omitting two arguments. One line for omitting each pair of arguments.
         // Versions that take a Network.
         mCallback.expect(AVAILABLE, "error") { true }
         mCallback.expect(AVAILABLE, 10) { true }
         mCallback.expect(AVAILABLE, 10, "error")
-        mCallback.expect(AVAILABLE, ANY_NETWORK) { true }
-        mCallback.expect(AVAILABLE, ANY_NETWORK, "error")
-        mCallback.expect(AVAILABLE, ANY_NETWORK, 10)
+        mCallback.expect(AVAILABLE, AnyNetwork) { true }
+        mCallback.expect(AVAILABLE, AnyNetwork, "error")
+        mCallback.expect(AVAILABLE, AnyNetwork, 10)
 
         // Java overloads for omitting three arguments. One line for each remaining argument.
         // Versions that take a Network.
         mCallback.expect(AVAILABLE) { true }
         mCallback.expect(AVAILABLE, "error")
         mCallback.expect(AVAILABLE, 10)
-        mCallback.expect(AVAILABLE, ANY_NETWORK)
+        mCallback.expect(AVAILABLE, AnyNetwork)
 
         // Java overload for omitting all four arguments.
         mCallback.expect(AVAILABLE)
@@ -322,23 +323,23 @@ class TestableNetworkCallbackTest {
         mCallback.expect(AVAILABLE, hn)
 
         // Same as above but for reified versions.
-        mCallback.expect<Available>(ANY_NETWORK, 10, "error") { true }
+        mCallback.expect<Available>(AnyNetwork, 10, "error") { true }
         mCallback.expect<Available>(timeoutMs = 10, errorMsg = "error") { true }
-        mCallback.expect<Available>(network = ANY_NETWORK, errorMsg = "error") { true }
-        mCallback.expect<Available>(network = ANY_NETWORK, timeoutMs = 10) { true }
-        mCallback.expect<Available>(network = ANY_NETWORK, timeoutMs = 10, errorMsg = "error")
+        mCallback.expect<Available>(network = AnyNetwork, errorMsg = "error") { true }
+        mCallback.expect<Available>(network = AnyNetwork, timeoutMs = 10) { true }
+        mCallback.expect<Available>(network = AnyNetwork, timeoutMs = 10, errorMsg = "error")
 
         mCallback.expect<Available>(errorMsg = "error") { true }
         mCallback.expect<Available>(timeoutMs = 10) { true }
         mCallback.expect<Available>(timeoutMs = 10, errorMsg = "error")
-        mCallback.expect<Available>(network = ANY_NETWORK) { true }
-        mCallback.expect<Available>(network = ANY_NETWORK, errorMsg = "error")
-        mCallback.expect<Available>(network = ANY_NETWORK, timeoutMs = 10)
+        mCallback.expect<Available>(network = AnyNetwork) { true }
+        mCallback.expect<Available>(network = AnyNetwork, errorMsg = "error")
+        mCallback.expect<Available>(network = AnyNetwork, timeoutMs = 10)
 
         mCallback.expect<Available> { true }
         mCallback.expect<Available>(errorMsg = "error")
         mCallback.expect<Available>(timeoutMs = 10)
-        mCallback.expect<Available>(network = ANY_NETWORK)
+        mCallback.expect<Available>(network = AnyNetwork)
         mCallback.expect<Available>()
 
         mCallback.expect<Available>(hn, 10, "error") { true }
diff --git a/staticlibs/tests/unit/src/com/android/testutils/TestableNetworkCallbackTestJava.java b/staticlibs/tests/unit/src/com/android/testutils/TestableNetworkCallbackTestJava.java
index da1cbe4dc0..8f29628068 100644
--- a/staticlibs/tests/unit/src/com/android/testutils/TestableNetworkCallbackTestJava.java
+++ b/staticlibs/tests/unit/src/com/android/testutils/TestableNetworkCallbackTestJava.java
@@ -17,7 +17,7 @@
 package com.android.testutils;
 
 import static com.android.testutils.TestableNetworkCallback.Event.AVAILABLE;
-import static com.android.testutils.TestableNetworkCallbackKt.anyNetwork;
+import static com.android.testutils.TestableNetworkCallbackKt.AnyNetwork;
 
 import static org.junit.Assume.assumeTrue;
 
@@ -25,37 +25,37 @@ import org.junit.Test;
 
 public class TestableNetworkCallbackTestJava {
     @Test
-    void testAllExpectOverloads() {
+    public void testAllExpectOverloads() {
         // This test should never run, it only checks that all overloads exist and build
         assumeTrue(false);
         final TestableNetworkCallback callback = new TestableNetworkCallback();
-        TestableNetworkCallback.HasNetwork hn = TestableNetworkCallbackKt::anyNetwork;
+        TestableNetworkCallback.HasNetwork hn = TestableNetworkCallbackKt::AnyNetwork;
 
         // Method with all arguments (version that takes a Network)
-        callback.expect(AVAILABLE, anyNetwork(), 10, "error", cb -> true);
+        callback.expect(AVAILABLE, AnyNetwork(), 10, "error", cb -> true);
 
         // Overloads omitting one argument. One line for omitting each argument, in positional
         // order. Versions that take a Network.
         callback.expect(AVAILABLE, 10, "error", cb -> true);
-        callback.expect(AVAILABLE, anyNetwork(), "error", cb -> true);
-        callback.expect(AVAILABLE, anyNetwork(), 10, cb -> true);
-        callback.expect(AVAILABLE, anyNetwork(), 10, "error");
+        callback.expect(AVAILABLE, AnyNetwork(), "error", cb -> true);
+        callback.expect(AVAILABLE, AnyNetwork(), 10, cb -> true);
+        callback.expect(AVAILABLE, AnyNetwork(), 10, "error");
 
         // Overloads for omitting two arguments. One line for omitting each pair of arguments.
         // Versions that take a Network.
         callback.expect(AVAILABLE, "error", cb -> true);
         callback.expect(AVAILABLE, 10, cb -> true);
         callback.expect(AVAILABLE, 10, "error");
-        callback.expect(AVAILABLE, anyNetwork(), cb -> true);
-        callback.expect(AVAILABLE, anyNetwork(), "error");
-        callback.expect(AVAILABLE, anyNetwork(), 10);
+        callback.expect(AVAILABLE, AnyNetwork(), cb -> true);
+        callback.expect(AVAILABLE, AnyNetwork(), "error");
+        callback.expect(AVAILABLE, AnyNetwork(), 10);
 
         // Overloads for omitting three arguments. One line for each remaining argument.
         // Versions that take a Network.
         callback.expect(AVAILABLE, cb -> true);
         callback.expect(AVAILABLE, "error");
         callback.expect(AVAILABLE, 10);
-        callback.expect(AVAILABLE, anyNetwork());
+        callback.expect(AVAILABLE, AnyNetwork());
 
         // Java overload for omitting all four arguments.
         callback.expect(AVAILABLE);
diff --git a/staticlibs/testutils/app/connectivitychecker/src/com/android/testutils/connectivitypreparer/ConnectivityCheckTest.kt b/staticlibs/testutils/app/connectivitychecker/src/com/android/testutils/connectivitypreparer/ConnectivityCheckTest.kt
index de175ce15d..a784b8a0d8 100644
--- a/staticlibs/testutils/app/connectivitychecker/src/com/android/testutils/connectivitypreparer/ConnectivityCheckTest.kt
+++ b/staticlibs/testutils/app/connectivitychecker/src/com/android/testutils/connectivitypreparer/ConnectivityCheckTest.kt
@@ -81,7 +81,7 @@ class ConnectivityCheckTest {
                     .addCapability(NET_CAPABILITY_INTERNET)
                     .build()
             )
-            val capChanged = cb.eventuallyExpect<CapabilitiesChanged>(from = 0)
+            val capChanged = cb.eventuallyExpect<CapabilitiesChanged>()
             val network = capChanged.network
             val ssid = capChanged.caps.ssid
             assertFalse(ssid.isNullOrEmpty(), "No SSID for wifi network $network")
diff --git a/staticlibs/testutils/devicetests/com/android/testutils/TestableNetworkCallback.kt b/staticlibs/testutils/devicetests/com/android/testutils/TestableNetworkCallback.kt
index ccf72c8a7d..3a15278429 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/TestableNetworkCallback.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/TestableNetworkCallback.kt
@@ -23,7 +23,12 @@ import android.net.Network
 import android.net.NetworkCapabilities
 import android.net.NetworkCapabilities.NET_CAPABILITY_VALIDATED
 import android.util.Log
-import com.android.net.module.util.ArrayTrackRecord
+import com.android.net.module.util.Expectable
+import com.android.net.module.util.TestableCallback
+import com.android.net.module.util.assertNo
+import com.android.net.module.util.eventuallyExpect
+import com.android.net.module.util.expect
+import com.android.testutils.TestableNetworkCallback.Event
 import com.android.testutils.TestableNetworkCallback.Event.Available
 import com.android.testutils.TestableNetworkCallback.Event.BlockedStatus
 import com.android.testutils.TestableNetworkCallback.Event.BlockedStatusInt
@@ -38,12 +43,11 @@ import com.android.testutils.TestableNetworkCallback.Event.Suspended
 import com.android.testutils.TestableNetworkCallback.Event.Unavailable
 import kotlin.reflect.KClass
 import kotlin.test.assertEquals
-import kotlin.test.assertNotNull
 import kotlin.test.fail
 
-object NULL_NETWORK : Network(-1)
-object ANY_NETWORK : Network(-2)
-fun anyNetwork() = ANY_NETWORK
+object NullNetwork : Network(-1)
+object AnyNetwork : Network(-2)
+fun AnyNetwork() = AnyNetwork
 
 private val DEFAULT_TAG = TestableNetworkCallback::class.simpleName
     ?: fail("Could not determine class name")
@@ -56,15 +60,15 @@ private val NOOP = Runnable {}
  * See comments on the public constructor below for a description of the arguments.
  */
 open class TestableNetworkCallback private constructor(
-    src: TestableNetworkCallback?,
-    val defaultTimeoutMs: Long,
-    private val defaultNoCallbackTimeoutMs: Long,
+    defaultCallbackTimeoutMs: Long,
+    defaultCallbackNoEventTimeoutMs: Long,
     private val waiterFunc: Runnable,
-    private val logTag: String
-) : NetworkCallback() {
-    private val backingRecord: ArrayTrackRecord<Event> =
-        src?.backingRecord ?: ArrayTrackRecord()
-    val history: ArrayTrackRecord<Event>.ReadHead = backingRecord.newReadHead()
+    private val logTag: String,
+    val callbackTracker: TestableCallback<Event> = TestableCallback(
+        defaultCallbackTimeoutMs,
+        defaultCallbackNoEventTimeoutMs
+    )
+) : NetworkCallback(), Expectable<Event> by callbackTracker {
     val mark get() = history.mark
 
     sealed class Event {
@@ -80,7 +84,7 @@ open class TestableNetworkCallback private constructor(
             override val network: Network,
             val caps: NetworkCapabilities
         ) : Event() {
-            constructor(caps: NetworkCapabilities) : this(NULL_NETWORK, caps)
+            constructor(caps: NetworkCapabilities) : this(NullNetwork, caps)
         }
         data class Available(override val network: Network) : Event()
         data class CapabilitiesChanged(
@@ -102,7 +106,7 @@ open class TestableNetworkCallback private constructor(
         data class Unavailable(
             override val network: Network
         ) : Event() {
-            constructor() : this(NULL_NETWORK)
+            constructor() : this(NullNetwork)
         }
         data class BlockedStatus(
             override val network: Network,
@@ -226,18 +230,25 @@ open class TestableNetworkCallback private constructor(
         noCallbackTimeoutMs: Long = DEFAULT_NO_CALLBACK_TIMEOUT,
         waiterFunc: Runnable = NOOP, // "() -> Unit" would forbid calling with a void func from Java
         logTag: String = DEFAULT_TAG
-    ) : this(null, timeoutMs, noCallbackTimeoutMs, waiterFunc, logTag)
+    ) : this(
+        timeoutMs,
+        noCallbackTimeoutMs,
+        waiterFunc,
+        logTag,
+        TestableCallback(timeoutMs, noCallbackTimeoutMs)
+    )
 
     fun createLinkedCopy() = TestableNetworkCallback(
-        this,
         defaultTimeoutMs,
-        defaultNoCallbackTimeoutMs,
+        defaultNoEventTimeoutMs,
         waiterFunc,
-        logTag
+        logTag,
+        callbackTracker
     )
 
     // The last available network, or null if any network was lost since the last call to
     // onAvailable. TODO : fix this by fixing the tests that rely on this behavior
+    // DO NOT ADD CALLS TO THIS METHOD. USE THE RETURN VALUE OF expect<> INSTEAD.
     val lastAvailableNetwork: Network?
         get() = when (val it = history.lastOrNull { it is Available || it is Lost }) {
             is Available -> it.network
@@ -254,25 +265,56 @@ open class TestableNetworkCallback private constructor(
     fun poll(timeoutMs: Long = defaultTimeoutMs, predicate: (Event) -> Boolean = { true }) =
             history.poll(timeoutMs, predicate)
 
+    // Proxy methods to avoid having to write expect<_, T>, see TestableCallback.kt
+    inline fun <reified T : Event> expect(
+        timeoutMs: Long = defaultTimeoutMs,
+        errorMsg: String? = null,
+        noinline predicate: (T) -> Boolean = { true }
+    ) = expect<_, T>(timeoutMs, errorMsg, predicate)
+
+    inline fun <reified T : Event> eventuallyExpect(
+        timeoutMs: Long = defaultTimeoutMs,
+        errorMsg: String? = null,
+        noinline predicate: (T) -> Boolean = { true }
+    ) = eventuallyExpect<_, T>(timeoutMs, errorMsg, predicate)
+
+    inline fun <reified T : Event> assertNo(
+        timeoutMs: Long = defaultTimeoutMs,
+        errorMsg: String? = null,
+        noinline predicate: (T) -> Boolean = { true }
+    ) = assertNo<_, T>(timeoutMs, errorMsg, predicate)
+
     /*****
-     * expect family of methods.
-     * These methods fetch the next callback and assert it matches the conditions : type,
-     * passed predicate. If no callback is received within the timeout, these methods fail.
+     * expect family of methods, to support Java code
+     *
+     * See Expectable#expect
      */
+    @Suppress("SuspiciousEqualsCombination") // === and == combination is legit here
     @JvmOverloads
     fun <T : Event> expect(
         type: KClass<T>,
-        network: Network = ANY_NETWORK,
+        network: Network = AnyNetwork,
         timeoutMs: Long = defaultTimeoutMs,
         errorMsg: String? = null,
         test: (T) -> Boolean = { true }
-    ) = expect<Event>(network, timeoutMs, errorMsg) {
-        if (type.isInstance(it)) {
-            test(it as T) // Cast can't fail since type.isInstance(it) and type: KClass<T>
-        } else {
-            fail("Expected callback ${type.simpleName}, got $it")
-        }
-    } as T
+    ): T = callbackTracker.expect(type, timeoutMs, errorMsg) {
+        (network === AnyNetwork || it.network == network) && test(it)
+    }
+
+    // Add a version of the standard expect method that takes a network.
+    inline fun <reified T : Event> expect(
+        network: Network = AnyNetwork,
+        timeoutMs: Long = defaultTimeoutMs,
+        errorMsg: String? = null,
+        noinline test: (T) -> Boolean = { true }
+    ) = expect(T::class, network, timeoutMs, errorMsg, test)
+
+    inline fun <reified T : Event> expect(
+        network: HasNetwork,
+        timeoutMs: Long = defaultTimeoutMs,
+        errorMsg: String? = null,
+        noinline test: (T) -> Boolean = { true }
+    ) = expect(T::class, network.network, timeoutMs, errorMsg, test)
 
     @JvmOverloads
     fun <T : Event> expect(
@@ -287,13 +329,11 @@ open class TestableNetworkCallback private constructor(
     // here. Note that @JvmOverloads give us the versions without the last arguments too, so
     // there is no need to explicitly define versions without the test predicate.
     // Without |network|
-    @JvmOverloads
     fun <T : Event> expect(
         type: KClass<T>,
         timeoutMs: Long,
         errorMsg: String?,
-        test: (T) -> Boolean = { true }
-    ) = expect(type, ANY_NETWORK, timeoutMs, errorMsg, test)
+    ) = expect(type, AnyNetwork, timeoutMs, errorMsg)
 
     // Without |timeout|, in Network and HasNetwork versions
     @JvmOverloads
@@ -333,7 +373,7 @@ open class TestableNetworkCallback private constructor(
         type: KClass<T>,
         errorMsg: String?,
         test: (T) -> Boolean = { true }
-    ) = expect(type, ANY_NETWORK, defaultTimeoutMs, errorMsg, test)
+    ) = expect(type, AnyNetwork, defaultTimeoutMs, errorMsg, test)
 
     // Without |network| or |errorMsg|
     @JvmOverloads
@@ -341,7 +381,7 @@ open class TestableNetworkCallback private constructor(
         type: KClass<T>,
         timeoutMs: Long,
         test: (T) -> Boolean = { true }
-    ) = expect(type, ANY_NETWORK, timeoutMs, null, test)
+    ) = expect(type, AnyNetwork, timeoutMs, null, test)
 
     // Without |timeout| or |errorMsg|, in Network and HasNetwork versions
     fun <T : Event> expect(
@@ -360,37 +400,54 @@ open class TestableNetworkCallback private constructor(
     fun <T : Event> expect(
         type: KClass<T>,
         test: (T) -> Boolean
-    ) = expect(type, ANY_NETWORK, defaultTimeoutMs, null, test)
+    ) = expect(type, AnyNetwork, defaultTimeoutMs, null, test)
 
-    // Kotlin reified versions. Don't call methods above, or the predicate would need to be noinline
-    inline fun <reified T : Event> expect(
-        network: Network = ANY_NETWORK,
+    /*****
+     * eventuallyExpect family of methods, to support Java code
+     *
+     * See Expectable#eventuallyExpect
+     */
+    @JvmOverloads
+    fun <T : Event> eventuallyExpect(
+        type: KClass<T>,
         timeoutMs: Long = defaultTimeoutMs,
-        errorMsg: String? = null,
-        test: (T) -> Boolean = { true }
-    ) = (poll(timeoutMs) ?: failWithErrorReason(errorMsg,
-        "Did not receive ${T::class.simpleName} after ${timeoutMs}ms"))
-            .also {
-                if (it !is T) {
-                    failWithErrorReason(
-                        errorMsg,
-                        "Expected callback ${T::class.simpleName}, got $it"
-                    )
-                }
-                if (ANY_NETWORK !== network && it.network != network) {
-                    failWithErrorReason(errorMsg, "Expected network $network for callback : $it")
-                }
-                if (!test(it)) {
-                    failWithErrorReason(errorMsg, "Callback doesn't match predicate : $it")
-                }
-            } as T
+        predicate: (cb: T) -> Boolean = { true }
+    ) = callbackTracker.eventuallyExpect(type, timeoutMs, errorMsg = null, predicate)
 
-    inline fun <reified T : Event> expect(
-        network: HasNetwork,
+    // eventuallyExpect with a starting point.
+    // TODO : remove these method, their interface is not easy to use ; instead, use an
+    // explicit out-of-order checking mechanism.
+    @Suppress("UNCHECKED_CAST")
+    fun <T : Event> eventuallyExpect(
+        type: KClass<T>,
+        timeoutMs: Long,
+        from: Int,
+        predicate: (T) -> Boolean
+    ): T {
+        val event = history.poll(timeoutMs, pos = from) {
+            type.isInstance(it) && predicate(it as T)
+        }
+        if (null == event) {
+            failWithErrorReason(
+                null,
+                "Callback ${type.simpleName} not received within ${timeoutMs}ms. " +
+                        "Got ${history.backtrace()}"
+            )
+        }
+        return event as T
+    }
+
+    fun <T : Event> eventuallyExpect(
+        type: KClass<T>,
+        from: Int,
+        predicate: (T) -> Boolean
+    ): T = eventuallyExpect(type, timeoutMs = defaultTimeoutMs, from, predicate)
+
+    inline fun <reified T : Event> eventuallyExpect(
         timeoutMs: Long = defaultTimeoutMs,
-        errorMsg: String? = null,
-        test: (T) -> Boolean = { true }
-    ) = expect(network.network, timeoutMs, errorMsg, test)
+        from: Int,
+        noinline predicate: (T) -> Boolean = { true }
+    ) = eventuallyExpect(T::class, timeoutMs, from, predicate)
 
     /*****
      * assertNoCallback family of methods.
@@ -400,59 +457,15 @@ open class TestableNetworkCallback private constructor(
      */
     @JvmOverloads
     fun assertNoCallback(
-        timeoutMs: Long = defaultNoCallbackTimeoutMs,
+        timeoutMs: Long = defaultNoEventTimeoutMs,
         valid: (Event) -> Boolean = { true }
     ) {
         waiterFunc.run()
-        history.poll(timeoutMs) { valid(it) }?.let { fail("Expected no callback but got $it") }
+        callbackTracker.assertNoCallback(timeoutMs, errorMsg = null, valid)
     }
 
     fun assertNoCallback(valid: (Event) -> Boolean) =
-            assertNoCallback(defaultNoCallbackTimeoutMs, valid)
-
-    /*****
-     * eventuallyExpect family of methods.
-     * These methods make sure a callback that matches the type/predicate is received eventually.
-     * Any callback of the wrong type, or doesn't match the optional predicate, is ignored.
-     * They fail if no callback matching the predicate is received within the timeout.
-     */
-    inline fun <reified T : Event> eventuallyExpect(
-        timeoutMs: Long = defaultTimeoutMs,
-        from: Int = mark,
-        crossinline predicate: (T) -> Boolean = { true }
-    ): T = history.poll(timeoutMs, from) { it is T && predicate(it) }.also {
-        assertNotNull(
-            it,
-            "Callback ${T::class} not received within ${timeoutMs}ms. " +
-                "Got ${history.backtrace()}"
-        )
-    } as T
-
-    @JvmOverloads
-    fun <T : Event> eventuallyExpect(
-        type: KClass<T>,
-        timeoutMs: Long = defaultTimeoutMs,
-        predicate: (cb: T) -> Boolean = { true }
-    ) = history.poll(timeoutMs) { type.java.isInstance(it) && predicate(it as T) }.also {
-        assertNotNull(
-            it,
-            "Callback ${type.java} not received within ${timeoutMs}ms. " +
-                "Got ${history.backtrace()}"
-        )
-    } as T
-
-    fun <T : Event> eventuallyExpect(
-        type: KClass<T>,
-        timeoutMs: Long = defaultTimeoutMs,
-        from: Int = mark,
-        predicate: (cb: T) -> Boolean = { true }
-    ) = history.poll(timeoutMs, from) { type.java.isInstance(it) && predicate(it as T) }.also {
-        assertNotNull(
-            it,
-            "Callback ${type.java} not received within ${timeoutMs}ms. " +
-                "Got ${history.backtrace()}"
-        )
-    } as T
+            assertNoCallback(defaultNoEventTimeoutMs, valid)
 
     // Expects onAvailable and the callbacks that follow it. These are:
     // - onSuspended, iff the network was suspended when the callbacks fire.
@@ -639,5 +652,5 @@ open class TestableNetworkCallback private constructor(
     fun expectCaps(
         tmt: Long,
         valid: (NetworkCapabilities) -> Boolean
-    ) = expect<CapabilitiesChanged>(ANY_NETWORK, tmt) { valid(it.caps) }.caps
+    ) = expect<CapabilitiesChanged>(AnyNetwork, tmt) { valid(it.caps) }.caps
 }
diff --git a/staticlibs/testutils/hostdevice/com/android/net/module/util/TestableCallback.kt b/staticlibs/testutils/hostdevice/com/android/net/module/util/TestableCallback.kt
new file mode 100644
index 0000000000..09350d0e76
--- /dev/null
+++ b/staticlibs/testutils/hostdevice/com/android/net/module/util/TestableCallback.kt
@@ -0,0 +1,358 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+@file:Suppress("UNCHECKED_CAST") // cast is checked by type.isInstance throughout the file
+
+package com.android.net.module.util
+
+import com.android.testutils.failWithErrorReason
+import kotlin.reflect.KClass
+
+private const val DEFAULT_TIMEOUT = 30_000L // ms
+private const val DEFAULT_NO_EVENT_TIMEOUT = 200L // ms
+
+/**
+ * These classes, [Expectable] and [TestableCallback], are tools designed to simplify the testing
+ * of asynchronous callbacks in your code.
+ *
+ * A **callback** is a piece of code that gets executed when a specific event happens (e.g., data
+ * received, network disconnected). These utilities help you define, record, and then assert the
+ * occurrence or non-occurrence of these events in your tests.
+ *
+ * To use these tools, your test class typically needs to:
+ * 1. Define a **sealed class** for all possible events that your callback can produce. Each
+ * specific event should be a `data class` subclass of this sealed event type. This ensures type
+ * safety and clear event definitions.
+ *   Note : if there is only one event you can skip the sealed class and only have one data class
+ *   representing that event.
+ * 2. Subclass [TestableCallback] and have your subclass implement the callback interface. If you
+ * cannot subclass [TestableCallback] because the callback is not an interface, your subclass
+ * will instead compose a [TestableCallback] which will allow for implementing [Expectable]
+ * with no additional work.
+ *
+ *
+ * ## How to Use: Two Main Scenarios
+ *
+ * ### Scenario 1: Testing an Interface callback (Recommended)
+ *
+ * If the callback you are testing is an **interface** (e.g., `NetworkOfferCallback`), then
+ * your test callback class should **inherit directly from [TestableCallback]**. This gives you
+ * all the `expect` and `assertNo` family of methods for free.
+ *
+ * **Example:** Testing a `TestedServiceCallback` interface with `onFirstAction` and
+ * `onSecondAction` methods.
+ * ```kotlin
+ * // The interface you want to test
+ * interface TestedServiceCallback {
+ *   fun onFirstAction(data: String)
+ *   fun onSecondAction(value: Int)
+ * }
+ *
+ * class MyTestServiceCallback : TestableCallback<Event>(), TestedServiceCallback {
+ *   // Define all the possible events that can occur from this callback
+ *   sealed class Event {
+ *     data class FirstAction(val data: String) : ServiceEvent()
+ *     data class SecondAction(val value: Int) : ServiceEvent()
+ *   }
+ *
+ *   // Implement the interface methods and record the events into the history
+ *   override fun onFirstAction(data: String) = history.add(FirstAction(data))
+ *   override fun onSecondAction(value: Int) = history.add(SecondAction(value))
+ *
+ *   // You can add custom helper methods here if you want more functionality than the default
+ *   // expect/assertNo methods offer.
+ * }
+ * ```
+ *
+ * **In your test code, you can then:**
+ * // Wait for a `FirstAction` event where the argument starts with "foo" to happen within the
+ * // default timeout.
+ * `myTestServiceCallback.expect<FirstAction>() { it.data.startsWith("foo") }`
+ * // Wait for any `SecondAction` event for up to 500 milliseconds.
+ * `myTestServiceCallback.expect<SecondAction>(timeoutMs = 500)`
+ * // Make sure no `SecondAction` event has fired so far.
+ * `myTestServiceCallback.assertNo<SecondAction>()
+ * etc.
+ *
+ * ### Scenario 2: Testing a class callback (Only do this when inheritance isn't possible)
+ *
+ * If the callback you need to test is a **class** (not an interface), direct inheritance from
+ * [TestableCallback] isn't possible. In this case, you will:
+ * 1. **Embed** an instance of [TestableCallback] inside your test class.
+ * 2. Declare that your test class **implements [Expectable] by delegating** to this embedded
+ * [TestableCallback] instance. This means your class will use the embedded `TestableCallback`'s
+ * functionality for event tracking.
+ * ```kotlin
+ * MyTestServiceCallback(internalEventTracker: TestableCallback<Event>)
+ *   : TestedServiceCallback, Expectable<Event> by internalEventTracker { ...
+ * ```
+ * 3. **Proxy** the `expect`, `eventuallyExpect`, and `assertNo` methods. This makes your test code
+ * simpler by allowing you to write `expect<MySpecificEvent>()` instead of
+ * `expect<_, MySpecificEvent>()`.
+ *
+ * **Example:** Testing a `TestedServiceCallback` class with `onFirstAction` and `onSecondAction`
+ * methods.
+ * ```kotlin
+ * import com.android.net.module.util.assertNo
+ * import com.android.net.module.util.expect
+ * import com.android.net.module.util.eventuallyExpect
+ *
+ * // The class you want to test
+ * open class TestedServiceCallback {
+ *   open fun onFirstAction(data: String)
+ *   open fun onSecondAction(value: Int)
+ * }
+ *
+ * class MyTestServiceCallback(
+ * // Embed a TestableCallback to handle the actual event tracking
+ *   private val internalEventTracker: TestableCallback<Event> = TestableCallback()
+ * ) : TestedServiceCallback(), Expectable<Event> by internalEventTracker {
+ *
+ *   // Define all the possible events that can occur from this callback
+ *   sealed class Event {
+ *     data class FirstAction(val data: String) : ServiceEvent()
+ *     data class SecondAction(val value: Int) : ServiceEvent()
+ *   }
+ *
+ *   // Implement the interface methods and record the events into the history
+ *   override fun onFirstAction(data: String) = history.add(FirstAction(data))
+ *   override fun onSecondAction(value: Int) = history.add(SecondAction(value))
+ *
+ *   // Proxy methods: These make it simpler to call expect/assertNo, avoiding 'expect<_, T>'
+ *   // They simply forward the call to the embedded internalEventTracker.
+ *   inline fun <reified T : Event> expect(
+ *     timeoutMs: Long = defaultTimeoutMs,
+ *     errorMsg: String? = null,
+ *     noinline predicate: (T) -> Boolean = { true }
+ *   ) = expect<_, T>(timeoutMs, errorMsg, predicate)
+ *
+ *   inline fun <reified T : Event> eventuallyExpect(
+ *     timeoutMs: Long = defaultTimeoutMs,
+ *     errorMsg: String? = null,
+ *     noinline predicate: (T) -> Boolean = { true }
+ *   ) = eventuallyExpect<_, T>(timeoutMs, errorMsg, predicate)
+ *
+ *   inline fun <reified T : Event> assertNo(
+ *     timeoutMs: Long = defaultTimeoutMs,
+ *     errorMsg: String? = null,
+ *     noinline predicate: (T) -> Boolean = { true }
+ *   ) = assertNo<_, T>(timeoutMs, errorMsg, predicate)
+ * }
+ * ```
+ *
+ *
+ * ### Explanation of proxy methods (for the curious)
+ *
+ * The `expect`, `eventuallyExpect`, and `assertNo` methods typically reside on
+ * `TestableCallback<Event>`. When you inherit from `TestableCallback`, the type `Event` is
+ * directly known, making calls like `expect<MySpecificEvent>()` straightforward.
+ *
+ * However, `Expectable` is an interface, and as such it cannot have member methods. The
+ * `Expectable.expect*` family of methods are therefore extension methods with two type arguments :
+ * one for the type argument of the receiver (`Event`), one for the concrete event type
+ * (`FirstAction`) ; the former is required to provide the upper bound for the latter (otherwise
+ * you could call `expect<String>()`).
+ * For syntactic reasons, Kotlin's compiler will refuse to call a 2-argument method with only one
+ * argument, even if it can infer the first type argument. The proxy methods (like the
+ * `inline fun <reified T : Event> expect(...)`) solve this by providing a single-argument version
+ * that calls the 2-type argument version instructing the compiler to infer the first argument
+ * (`expect<_, T>` infers `_`). This lets you write `expect<MySpecificEvent>()`.
+ */
+
+/**
+ * An interface for classes on which the expect* and assertNo* family of methods can be called.
+ */
+// TODO : why do we have to specify `: Any` here ? Is that not the default ? If you remove
+// it then `KClass<T>` complains that T is not within its `Any` bounds,
+interface Expectable<E : Any> {
+    val history: ArrayTrackRecord<E>.ReadHead
+    val defaultTimeoutMs: Long
+    val defaultNoEventTimeoutMs: Long
+
+    /*****
+     * Expect an event immediately
+     *
+     * This method fetches the next callback and assert it matches the conditions : type,
+     * passed predicate. If no callback is received within the timeout, this method fails.
+     */
+    fun <T : E> expect(
+        type: KClass<T>,
+        timeoutMs: Long = defaultTimeoutMs,
+        errorMsg: String? = null,
+        predicate: (T) -> Boolean = { true }
+    ): T
+
+    /*****
+     * Expect that some event is received eventually.
+     *
+     * This method makes sure a callback that matches the type/predicate is received eventually.
+     * Any callback of the wrong type, or doesn't match the optional predicate, is ignored.
+     * It fails if no callback matching the predicate is received within the timeout.
+     */
+    fun <T : E> eventuallyExpect(
+        type: KClass<T>,
+        timeoutMs: Long = defaultTimeoutMs,
+        errorMsg: String? = null,
+        predicate: (T) -> Boolean = { true }
+    ): T
+
+    /*****
+     * Assert no event matching a predicate was received.
+     *
+     * This method makes sure that no callback that matches the predicate was received.
+     * If no predicate is given, it makes sure that no callback at all was received.
+     */
+    fun <T : E> assertNo(
+        type: KClass<T>,
+        timeoutMs: Long = defaultNoEventTimeoutMs,
+        errorMsg: String? = null,
+        predicate: (T) -> Boolean = { true }
+    )
+
+    fun assertNoCallback(
+        timeoutMs: Long = defaultNoEventTimeoutMs,
+        errorMsg: String? = null,
+        predicate: (E) -> Boolean = { true }
+    )
+}
+
+inline fun <E : Any, reified T : E> Expectable<E>.expect(
+    timeoutMs: Long = defaultTimeoutMs,
+    errorMsg: String? = null,
+    noinline predicate: (T) -> Boolean = { true }
+) = expect(T::class, timeoutMs, errorMsg, predicate)
+
+inline fun <E : Any, reified T : E> Expectable<E>.eventuallyExpect(
+    timeoutMs: Long = defaultTimeoutMs,
+    errorMsg: String? = null,
+    noinline predicate: (T) -> Boolean = { true }
+) = eventuallyExpect(T::class, timeoutMs, errorMsg, predicate)
+
+inline fun <E : Any, reified T : E> Expectable<E>.assertNo(
+    timeoutMs: Long = defaultTimeoutMs,
+    errorMsg: String? = null,
+    noinline predicate: (T) -> Boolean = { true }
+) = assertNo(T::class, timeoutMs, errorMsg, predicate)
+
+/**
+ * A base class for connectivity testable callbacks.
+ */
+open class TestableCallback<E : Any>(
+    override val defaultTimeoutMs: Long = DEFAULT_TIMEOUT,
+    override val defaultNoEventTimeoutMs: Long = DEFAULT_NO_EVENT_TIMEOUT
+) : Expectable<E> {
+    override val history = ArrayTrackRecord<E>().newReadHead()
+    val mark get() = history.mark
+
+    /**
+     * Implementation of the expect<> family of methods. All other
+     * methods eventually call this. They implement the Expectable<E>
+     * interface.
+     */
+    override fun <T : E> expect(
+        type: KClass<T>,
+        timeoutMs: Long,
+        errorMsg: String?,
+        predicate: (T) -> Boolean
+    ): T {
+        val event = history.poll(timeoutMs)
+        if (null == event) {
+            failWithErrorReason(
+                errorMsg,
+                "Did not receive ${type.simpleName} after ${timeoutMs}ms"
+            )
+        }
+        if (!type.isInstance(event)) {
+            failWithErrorReason(
+                errorMsg,
+                "Expected callback ${type.simpleName}, got $event"
+            )
+        }
+        event as T
+        if (!predicate(event)) {
+            failWithErrorReason(errorMsg, "Callback doesn't match predicate : $event")
+        }
+        return event
+    }
+
+    override fun <T : E> eventuallyExpect(
+        type: KClass<T>,
+        timeoutMs: Long,
+        errorMsg: String?,
+        predicate: (T) -> Boolean,
+    ): T {
+        val event = history.poll(timeoutMs) { type.isInstance(it) && predicate(it as T) }
+        if (null == event) {
+            failWithErrorReason(
+                errorMsg,
+                "Callback ${type.simpleName} not received within ${timeoutMs}ms. " +
+                        "Got ${history.backtrace()}"
+            )
+        }
+        return event as T
+    }
+
+    override fun assertNoCallback(
+        timeoutMs: Long,
+        errorMsg: String?,
+        predicate: (E) -> Boolean,
+    ) {
+        val mark = history.mark
+        try {
+            val event = history.poll(timeoutMs) { predicate(it) }
+            if (null != event) {
+                failWithErrorReason(
+                    errorMsg,
+                    "Expected no such callback but found $event"
+                )
+            }
+        } finally {
+            // Rewind so callers can expect a failure and continue later. For example, a caller
+            // might want to assert no callback { interfaceName == "wlan1" } but then go on
+            // to test that some other event took place, which would not be possible without this
+            // rewind because it would have been skipped by the `poll` call above.
+            history.rewind(mark)
+        }
+    }
+
+    override fun <T : E> assertNo(
+        type: KClass<T>,
+        timeoutMs: Long,
+        errorMsg: String?,
+        predicate: (T) -> Boolean,
+    ) = assertNoCallback(timeoutMs, errorMsg) { type.isInstance(it) && predicate(it as T) }
+
+    /**
+     * Proxy methods to avoid having to write expect<_, T>, see comment at the top of this file.
+     */
+    inline fun <reified T : E> expect(
+        timeoutMs: Long = defaultTimeoutMs,
+        errorMsg: String? = null,
+        noinline predicate: (T) -> Boolean = { true }
+    ) = expect<_, T>(timeoutMs, errorMsg, predicate)
+
+    inline fun <reified T : E> eventuallyExpect(
+        timeoutMs: Long = defaultTimeoutMs,
+        errorMsg: String? = null,
+        noinline predicate: (T) -> Boolean = { true }
+    ) = eventuallyExpect<_, T>(timeoutMs, errorMsg, predicate)
+
+    inline fun <reified T : E> assertNo(
+        timeoutMs: Long = defaultTimeoutMs,
+        errorMsg: String? = null,
+        noinline predicate: (T) -> Boolean = { true }
+    ) = assertNo<_, T>(timeoutMs, errorMsg, predicate)
+}
diff --git a/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java b/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
index a758b57b6c..e25eddb63d 100644
--- a/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
+++ b/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
@@ -318,7 +318,7 @@ public class ConnectivityManagerTest {
     private static final int MAX_KEEPALIVE_RETRY_COUNT = 3;
     private static final int MIN_KEEPALIVE_INTERVAL = 10;
 
-    private static final int NETWORK_CALLBACK_TIMEOUT_MS = 30_000;
+    private static final long NETWORK_CALLBACK_TIMEOUT_MS = 30_000;
     // Timeout for waiting network to be validated.
     private static final int LISTEN_ACTIVITY_TIMEOUT_MS = 30_000;
     private static final int NO_CALLBACK_TIMEOUT_MS = 100;
@@ -481,11 +481,9 @@ public class ConnectivityManagerTest {
             // networkCallbackRule is the outer rule and will be cleaned up after this method.
             final TestableNetworkCallback callback =
                     networkCallbackRule.registerDefaultNetworkCallback();
-            assertNotNull("Couldn't restore Internet connectivity",
-                    callback.eventuallyExpect(Event.NETWORK_CAPS_UPDATED,
-                            NETWORK_CALLBACK_TIMEOUT_MS,
-                            entry -> ((Event.CapabilitiesChanged) entry)
-                                    .getCaps().hasCapability(NET_CAPABILITY_VALIDATED)));
+            callback.eventuallyExpect(Event.NETWORK_CAPS_UPDATED,
+                    NETWORK_CALLBACK_TIMEOUT_MS,
+                    entry -> entry.getCaps().hasCapability(NET_CAPABILITY_VALIDATED));
         });
     }
 
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSL2capProviderTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSL2capProviderTest.kt
index 98e7ff44ae..c2bacbac21 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSL2capProviderTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSL2capProviderTest.kt
@@ -49,7 +49,7 @@ import com.android.testutils.TestableNetworkCallback
 import com.android.testutils.TestableNetworkCallback.Event.Lost
 import com.android.testutils.TestableNetworkCallback.Event.Reserved
 import com.android.testutils.TestableNetworkCallback.Event.Unavailable
-import com.android.testutils.anyNetwork
+import com.android.testutils.AnyNetwork
 import com.android.testutils.waitForIdle
 import java.io.IOException
 import java.util.Optional
@@ -306,7 +306,7 @@ class CSL2capProviderTest : CSTest() {
         doReturn(true).`when`(btSocket).isConnected()
         acceptQueue.put(Optional.of(btSocket))
 
-        cb.expectAvailableCallbacks(anyNetwork(), validated = false)
+        cb.expectAvailableCallbacks(AnyNetwork(), validated = false)
         cb.assertNoCallback()
         // Verify that packet forwarding was started.
         // TODO: stop mocking L2capPacketForwarder.
@@ -355,7 +355,7 @@ class CSL2capProviderTest : CSTest() {
                 .build()
         val nr = REQUEST.copyWithSpecifier(specifier)
         val cb = requestNetwork(nr)
-        cb.expectAvailableCallbacks(anyNetwork(), validated = false)
+        cb.expectAvailableCallbacks(AnyNetwork(), validated = false)
     }
 
     @Test
@@ -368,7 +368,7 @@ class CSL2capProviderTest : CSTest() {
                 .build()
         var nr = REQUEST.copyWithSpecifier(specifier)
         val cb = requestNetwork(nr)
-        cb.expectAvailableCallbacks(anyNetwork(), validated = false)
+        cb.expectAvailableCallbacks(AnyNetwork(), validated = false)
 
         specifier = L2capNetworkSpecifier.Builder()
                 .setRole(ROLE_CLIENT)
@@ -391,10 +391,10 @@ class CSL2capProviderTest : CSTest() {
                 .build()
         val nr = REQUEST.copyWithSpecifier(specifier)
         val cb = requestNetwork(nr)
-        cb.expectAvailableCallbacks(anyNetwork(), validated = false)
+        cb.expectAvailableCallbacks(AnyNetwork(), validated = false)
 
         val cb2 = requestNetwork(nr)
-        cb2.expectAvailableCallbacks(anyNetwork(), validated = false)
+        cb2.expectAvailableCallbacks(AnyNetwork(), validated = false)
     }
 
     /** Test to ensure onLost() is sent before onUnavailable() when the network is torn down. */
@@ -409,7 +409,7 @@ class CSL2capProviderTest : CSTest() {
 
         val nr = REQUEST.copyWithSpecifier(specifier)
         val cb = requestNetwork(nr)
-        cb.expectAvailableCallbacks(anyNetwork(), validated = false)
+        cb.expectAvailableCallbacks(AnyNetwork(), validated = false)
 
         // Capture the L2capPacketForwarder callback object to tear down the network.
         val handlerCaptor = ArgumentCaptor.forClass(Handler::class.java)

From 827aa58224eec20c0169f84f4dc4c15a6e97db00 Mon Sep 17 00:00:00 2001
From: "Priyanka Advani (xWF)" <padvani@google.com>
Date: Thu, 5 Jun 2025 11:35:49 -0700
Subject: [PATCH 357/377] Revert "Make a base class for testable callbacks"

This reverts commit a77d5ac1268d82337a779a702c88268d0544665e.

Reason for revert: Droidmonitor created revert due to b/422782308. Will be verifying through ABTD before submission.

Fix: 422782308
Change-Id: I00825e0f17a9a9e0d152ac8ebe767da3f267fbb1
---
 .../testutils/TestableNetworkCallbackTest.kt  |  35 +-
 .../TestableNetworkCallbackTestJava.java      |  22 +-
 .../ConnectivityCheckTest.kt                  |   2 +-
 .../testutils/TestableNetworkCallback.kt      | 233 ++++++------
 .../net/module/util/TestableCallback.kt       | 358 ------------------
 .../net/cts/ConnectivityManagerTest.java      |  10 +-
 .../CSL2capProviderTest.kt                    |  14 +-
 7 files changed, 152 insertions(+), 522 deletions(-)
 delete mode 100644 staticlibs/testutils/hostdevice/com/android/net/module/util/TestableCallback.kt

diff --git a/staticlibs/tests/unit/src/com/android/testutils/TestableNetworkCallbackTest.kt b/staticlibs/tests/unit/src/com/android/testutils/TestableNetworkCallbackTest.kt
index c7661d49bc..c35013da86 100644
--- a/staticlibs/tests/unit/src/com/android/testutils/TestableNetworkCallbackTest.kt
+++ b/staticlibs/tests/unit/src/com/android/testutils/TestableNetworkCallbackTest.kt
@@ -122,7 +122,6 @@ class TestableNetworkCallbackTest {
         mCallback.assertNoCallback(SHORT_TIMEOUT_MS)
         mCallback.onAvailable(Network(100))
         assertFails { mCallback.assertNoCallback(SHORT_TIMEOUT_MS) }
-        mCallback.expect<Available>()
         val net = Network(101)
         mCallback.assertNoCallback { it is Available }
         mCallback.onAvailable(net)
@@ -278,33 +277,33 @@ class TestableNetworkCallbackTest {
     fun testAllExpectOverloads() {
         // This test should never run, it only checks that all overloads exist and build
         assumeTrue(false)
-        val hn = object : TestableNetworkCallback.HasNetwork { override val network = AnyNetwork }
+        val hn = object : TestableNetworkCallback.HasNetwork { override val network = ANY_NETWORK }
 
         // Method with all arguments (version that takes a Network)
-        mCallback.expect(AVAILABLE, AnyNetwork, 10, "error") { true }
+        mCallback.expect(AVAILABLE, ANY_NETWORK, 10, "error") { true }
 
         // Java overloads omitting one argument. One line for omitting each argument, in positional
         // order. Versions that take a Network.
         mCallback.expect(AVAILABLE, 10, "error") { true }
-        mCallback.expect(AVAILABLE, AnyNetwork, "error") { true }
-        mCallback.expect(AVAILABLE, AnyNetwork, 10) { true }
-        mCallback.expect(AVAILABLE, AnyNetwork, 10, "error")
+        mCallback.expect(AVAILABLE, ANY_NETWORK, "error") { true }
+        mCallback.expect(AVAILABLE, ANY_NETWORK, 10) { true }
+        mCallback.expect(AVAILABLE, ANY_NETWORK, 10, "error")
 
         // Java overloads for omitting two arguments. One line for omitting each pair of arguments.
         // Versions that take a Network.
         mCallback.expect(AVAILABLE, "error") { true }
         mCallback.expect(AVAILABLE, 10) { true }
         mCallback.expect(AVAILABLE, 10, "error")
-        mCallback.expect(AVAILABLE, AnyNetwork) { true }
-        mCallback.expect(AVAILABLE, AnyNetwork, "error")
-        mCallback.expect(AVAILABLE, AnyNetwork, 10)
+        mCallback.expect(AVAILABLE, ANY_NETWORK) { true }
+        mCallback.expect(AVAILABLE, ANY_NETWORK, "error")
+        mCallback.expect(AVAILABLE, ANY_NETWORK, 10)
 
         // Java overloads for omitting three arguments. One line for each remaining argument.
         // Versions that take a Network.
         mCallback.expect(AVAILABLE) { true }
         mCallback.expect(AVAILABLE, "error")
         mCallback.expect(AVAILABLE, 10)
-        mCallback.expect(AVAILABLE, AnyNetwork)
+        mCallback.expect(AVAILABLE, ANY_NETWORK)
 
         // Java overload for omitting all four arguments.
         mCallback.expect(AVAILABLE)
@@ -323,23 +322,23 @@ class TestableNetworkCallbackTest {
         mCallback.expect(AVAILABLE, hn)
 
         // Same as above but for reified versions.
-        mCallback.expect<Available>(AnyNetwork, 10, "error") { true }
+        mCallback.expect<Available>(ANY_NETWORK, 10, "error") { true }
         mCallback.expect<Available>(timeoutMs = 10, errorMsg = "error") { true }
-        mCallback.expect<Available>(network = AnyNetwork, errorMsg = "error") { true }
-        mCallback.expect<Available>(network = AnyNetwork, timeoutMs = 10) { true }
-        mCallback.expect<Available>(network = AnyNetwork, timeoutMs = 10, errorMsg = "error")
+        mCallback.expect<Available>(network = ANY_NETWORK, errorMsg = "error") { true }
+        mCallback.expect<Available>(network = ANY_NETWORK, timeoutMs = 10) { true }
+        mCallback.expect<Available>(network = ANY_NETWORK, timeoutMs = 10, errorMsg = "error")
 
         mCallback.expect<Available>(errorMsg = "error") { true }
         mCallback.expect<Available>(timeoutMs = 10) { true }
         mCallback.expect<Available>(timeoutMs = 10, errorMsg = "error")
-        mCallback.expect<Available>(network = AnyNetwork) { true }
-        mCallback.expect<Available>(network = AnyNetwork, errorMsg = "error")
-        mCallback.expect<Available>(network = AnyNetwork, timeoutMs = 10)
+        mCallback.expect<Available>(network = ANY_NETWORK) { true }
+        mCallback.expect<Available>(network = ANY_NETWORK, errorMsg = "error")
+        mCallback.expect<Available>(network = ANY_NETWORK, timeoutMs = 10)
 
         mCallback.expect<Available> { true }
         mCallback.expect<Available>(errorMsg = "error")
         mCallback.expect<Available>(timeoutMs = 10)
-        mCallback.expect<Available>(network = AnyNetwork)
+        mCallback.expect<Available>(network = ANY_NETWORK)
         mCallback.expect<Available>()
 
         mCallback.expect<Available>(hn, 10, "error") { true }
diff --git a/staticlibs/tests/unit/src/com/android/testutils/TestableNetworkCallbackTestJava.java b/staticlibs/tests/unit/src/com/android/testutils/TestableNetworkCallbackTestJava.java
index 8f29628068..da1cbe4dc0 100644
--- a/staticlibs/tests/unit/src/com/android/testutils/TestableNetworkCallbackTestJava.java
+++ b/staticlibs/tests/unit/src/com/android/testutils/TestableNetworkCallbackTestJava.java
@@ -17,7 +17,7 @@
 package com.android.testutils;
 
 import static com.android.testutils.TestableNetworkCallback.Event.AVAILABLE;
-import static com.android.testutils.TestableNetworkCallbackKt.AnyNetwork;
+import static com.android.testutils.TestableNetworkCallbackKt.anyNetwork;
 
 import static org.junit.Assume.assumeTrue;
 
@@ -25,37 +25,37 @@ import org.junit.Test;
 
 public class TestableNetworkCallbackTestJava {
     @Test
-    public void testAllExpectOverloads() {
+    void testAllExpectOverloads() {
         // This test should never run, it only checks that all overloads exist and build
         assumeTrue(false);
         final TestableNetworkCallback callback = new TestableNetworkCallback();
-        TestableNetworkCallback.HasNetwork hn = TestableNetworkCallbackKt::AnyNetwork;
+        TestableNetworkCallback.HasNetwork hn = TestableNetworkCallbackKt::anyNetwork;
 
         // Method with all arguments (version that takes a Network)
-        callback.expect(AVAILABLE, AnyNetwork(), 10, "error", cb -> true);
+        callback.expect(AVAILABLE, anyNetwork(), 10, "error", cb -> true);
 
         // Overloads omitting one argument. One line for omitting each argument, in positional
         // order. Versions that take a Network.
         callback.expect(AVAILABLE, 10, "error", cb -> true);
-        callback.expect(AVAILABLE, AnyNetwork(), "error", cb -> true);
-        callback.expect(AVAILABLE, AnyNetwork(), 10, cb -> true);
-        callback.expect(AVAILABLE, AnyNetwork(), 10, "error");
+        callback.expect(AVAILABLE, anyNetwork(), "error", cb -> true);
+        callback.expect(AVAILABLE, anyNetwork(), 10, cb -> true);
+        callback.expect(AVAILABLE, anyNetwork(), 10, "error");
 
         // Overloads for omitting two arguments. One line for omitting each pair of arguments.
         // Versions that take a Network.
         callback.expect(AVAILABLE, "error", cb -> true);
         callback.expect(AVAILABLE, 10, cb -> true);
         callback.expect(AVAILABLE, 10, "error");
-        callback.expect(AVAILABLE, AnyNetwork(), cb -> true);
-        callback.expect(AVAILABLE, AnyNetwork(), "error");
-        callback.expect(AVAILABLE, AnyNetwork(), 10);
+        callback.expect(AVAILABLE, anyNetwork(), cb -> true);
+        callback.expect(AVAILABLE, anyNetwork(), "error");
+        callback.expect(AVAILABLE, anyNetwork(), 10);
 
         // Overloads for omitting three arguments. One line for each remaining argument.
         // Versions that take a Network.
         callback.expect(AVAILABLE, cb -> true);
         callback.expect(AVAILABLE, "error");
         callback.expect(AVAILABLE, 10);
-        callback.expect(AVAILABLE, AnyNetwork());
+        callback.expect(AVAILABLE, anyNetwork());
 
         // Java overload for omitting all four arguments.
         callback.expect(AVAILABLE);
diff --git a/staticlibs/testutils/app/connectivitychecker/src/com/android/testutils/connectivitypreparer/ConnectivityCheckTest.kt b/staticlibs/testutils/app/connectivitychecker/src/com/android/testutils/connectivitypreparer/ConnectivityCheckTest.kt
index a784b8a0d8..de175ce15d 100644
--- a/staticlibs/testutils/app/connectivitychecker/src/com/android/testutils/connectivitypreparer/ConnectivityCheckTest.kt
+++ b/staticlibs/testutils/app/connectivitychecker/src/com/android/testutils/connectivitypreparer/ConnectivityCheckTest.kt
@@ -81,7 +81,7 @@ class ConnectivityCheckTest {
                     .addCapability(NET_CAPABILITY_INTERNET)
                     .build()
             )
-            val capChanged = cb.eventuallyExpect<CapabilitiesChanged>()
+            val capChanged = cb.eventuallyExpect<CapabilitiesChanged>(from = 0)
             val network = capChanged.network
             val ssid = capChanged.caps.ssid
             assertFalse(ssid.isNullOrEmpty(), "No SSID for wifi network $network")
diff --git a/staticlibs/testutils/devicetests/com/android/testutils/TestableNetworkCallback.kt b/staticlibs/testutils/devicetests/com/android/testutils/TestableNetworkCallback.kt
index 3a15278429..ccf72c8a7d 100644
--- a/staticlibs/testutils/devicetests/com/android/testutils/TestableNetworkCallback.kt
+++ b/staticlibs/testutils/devicetests/com/android/testutils/TestableNetworkCallback.kt
@@ -23,12 +23,7 @@ import android.net.Network
 import android.net.NetworkCapabilities
 import android.net.NetworkCapabilities.NET_CAPABILITY_VALIDATED
 import android.util.Log
-import com.android.net.module.util.Expectable
-import com.android.net.module.util.TestableCallback
-import com.android.net.module.util.assertNo
-import com.android.net.module.util.eventuallyExpect
-import com.android.net.module.util.expect
-import com.android.testutils.TestableNetworkCallback.Event
+import com.android.net.module.util.ArrayTrackRecord
 import com.android.testutils.TestableNetworkCallback.Event.Available
 import com.android.testutils.TestableNetworkCallback.Event.BlockedStatus
 import com.android.testutils.TestableNetworkCallback.Event.BlockedStatusInt
@@ -43,11 +38,12 @@ import com.android.testutils.TestableNetworkCallback.Event.Suspended
 import com.android.testutils.TestableNetworkCallback.Event.Unavailable
 import kotlin.reflect.KClass
 import kotlin.test.assertEquals
+import kotlin.test.assertNotNull
 import kotlin.test.fail
 
-object NullNetwork : Network(-1)
-object AnyNetwork : Network(-2)
-fun AnyNetwork() = AnyNetwork
+object NULL_NETWORK : Network(-1)
+object ANY_NETWORK : Network(-2)
+fun anyNetwork() = ANY_NETWORK
 
 private val DEFAULT_TAG = TestableNetworkCallback::class.simpleName
     ?: fail("Could not determine class name")
@@ -60,15 +56,15 @@ private val NOOP = Runnable {}
  * See comments on the public constructor below for a description of the arguments.
  */
 open class TestableNetworkCallback private constructor(
-    defaultCallbackTimeoutMs: Long,
-    defaultCallbackNoEventTimeoutMs: Long,
+    src: TestableNetworkCallback?,
+    val defaultTimeoutMs: Long,
+    private val defaultNoCallbackTimeoutMs: Long,
     private val waiterFunc: Runnable,
-    private val logTag: String,
-    val callbackTracker: TestableCallback<Event> = TestableCallback(
-        defaultCallbackTimeoutMs,
-        defaultCallbackNoEventTimeoutMs
-    )
-) : NetworkCallback(), Expectable<Event> by callbackTracker {
+    private val logTag: String
+) : NetworkCallback() {
+    private val backingRecord: ArrayTrackRecord<Event> =
+        src?.backingRecord ?: ArrayTrackRecord()
+    val history: ArrayTrackRecord<Event>.ReadHead = backingRecord.newReadHead()
     val mark get() = history.mark
 
     sealed class Event {
@@ -84,7 +80,7 @@ open class TestableNetworkCallback private constructor(
             override val network: Network,
             val caps: NetworkCapabilities
         ) : Event() {
-            constructor(caps: NetworkCapabilities) : this(NullNetwork, caps)
+            constructor(caps: NetworkCapabilities) : this(NULL_NETWORK, caps)
         }
         data class Available(override val network: Network) : Event()
         data class CapabilitiesChanged(
@@ -106,7 +102,7 @@ open class TestableNetworkCallback private constructor(
         data class Unavailable(
             override val network: Network
         ) : Event() {
-            constructor() : this(NullNetwork)
+            constructor() : this(NULL_NETWORK)
         }
         data class BlockedStatus(
             override val network: Network,
@@ -230,25 +226,18 @@ open class TestableNetworkCallback private constructor(
         noCallbackTimeoutMs: Long = DEFAULT_NO_CALLBACK_TIMEOUT,
         waiterFunc: Runnable = NOOP, // "() -> Unit" would forbid calling with a void func from Java
         logTag: String = DEFAULT_TAG
-    ) : this(
-        timeoutMs,
-        noCallbackTimeoutMs,
-        waiterFunc,
-        logTag,
-        TestableCallback(timeoutMs, noCallbackTimeoutMs)
-    )
+    ) : this(null, timeoutMs, noCallbackTimeoutMs, waiterFunc, logTag)
 
     fun createLinkedCopy() = TestableNetworkCallback(
+        this,
         defaultTimeoutMs,
-        defaultNoEventTimeoutMs,
+        defaultNoCallbackTimeoutMs,
         waiterFunc,
-        logTag,
-        callbackTracker
+        logTag
     )
 
     // The last available network, or null if any network was lost since the last call to
     // onAvailable. TODO : fix this by fixing the tests that rely on this behavior
-    // DO NOT ADD CALLS TO THIS METHOD. USE THE RETURN VALUE OF expect<> INSTEAD.
     val lastAvailableNetwork: Network?
         get() = when (val it = history.lastOrNull { it is Available || it is Lost }) {
             is Available -> it.network
@@ -265,56 +254,25 @@ open class TestableNetworkCallback private constructor(
     fun poll(timeoutMs: Long = defaultTimeoutMs, predicate: (Event) -> Boolean = { true }) =
             history.poll(timeoutMs, predicate)
 
-    // Proxy methods to avoid having to write expect<_, T>, see TestableCallback.kt
-    inline fun <reified T : Event> expect(
-        timeoutMs: Long = defaultTimeoutMs,
-        errorMsg: String? = null,
-        noinline predicate: (T) -> Boolean = { true }
-    ) = expect<_, T>(timeoutMs, errorMsg, predicate)
-
-    inline fun <reified T : Event> eventuallyExpect(
-        timeoutMs: Long = defaultTimeoutMs,
-        errorMsg: String? = null,
-        noinline predicate: (T) -> Boolean = { true }
-    ) = eventuallyExpect<_, T>(timeoutMs, errorMsg, predicate)
-
-    inline fun <reified T : Event> assertNo(
-        timeoutMs: Long = defaultTimeoutMs,
-        errorMsg: String? = null,
-        noinline predicate: (T) -> Boolean = { true }
-    ) = assertNo<_, T>(timeoutMs, errorMsg, predicate)
-
     /*****
-     * expect family of methods, to support Java code
-     *
-     * See Expectable#expect
+     * expect family of methods.
+     * These methods fetch the next callback and assert it matches the conditions : type,
+     * passed predicate. If no callback is received within the timeout, these methods fail.
      */
-    @Suppress("SuspiciousEqualsCombination") // === and == combination is legit here
     @JvmOverloads
     fun <T : Event> expect(
         type: KClass<T>,
-        network: Network = AnyNetwork,
+        network: Network = ANY_NETWORK,
         timeoutMs: Long = defaultTimeoutMs,
         errorMsg: String? = null,
         test: (T) -> Boolean = { true }
-    ): T = callbackTracker.expect(type, timeoutMs, errorMsg) {
-        (network === AnyNetwork || it.network == network) && test(it)
-    }
-
-    // Add a version of the standard expect method that takes a network.
-    inline fun <reified T : Event> expect(
-        network: Network = AnyNetwork,
-        timeoutMs: Long = defaultTimeoutMs,
-        errorMsg: String? = null,
-        noinline test: (T) -> Boolean = { true }
-    ) = expect(T::class, network, timeoutMs, errorMsg, test)
-
-    inline fun <reified T : Event> expect(
-        network: HasNetwork,
-        timeoutMs: Long = defaultTimeoutMs,
-        errorMsg: String? = null,
-        noinline test: (T) -> Boolean = { true }
-    ) = expect(T::class, network.network, timeoutMs, errorMsg, test)
+    ) = expect<Event>(network, timeoutMs, errorMsg) {
+        if (type.isInstance(it)) {
+            test(it as T) // Cast can't fail since type.isInstance(it) and type: KClass<T>
+        } else {
+            fail("Expected callback ${type.simpleName}, got $it")
+        }
+    } as T
 
     @JvmOverloads
     fun <T : Event> expect(
@@ -329,11 +287,13 @@ open class TestableNetworkCallback private constructor(
     // here. Note that @JvmOverloads give us the versions without the last arguments too, so
     // there is no need to explicitly define versions without the test predicate.
     // Without |network|
+    @JvmOverloads
     fun <T : Event> expect(
         type: KClass<T>,
         timeoutMs: Long,
         errorMsg: String?,
-    ) = expect(type, AnyNetwork, timeoutMs, errorMsg)
+        test: (T) -> Boolean = { true }
+    ) = expect(type, ANY_NETWORK, timeoutMs, errorMsg, test)
 
     // Without |timeout|, in Network and HasNetwork versions
     @JvmOverloads
@@ -373,7 +333,7 @@ open class TestableNetworkCallback private constructor(
         type: KClass<T>,
         errorMsg: String?,
         test: (T) -> Boolean = { true }
-    ) = expect(type, AnyNetwork, defaultTimeoutMs, errorMsg, test)
+    ) = expect(type, ANY_NETWORK, defaultTimeoutMs, errorMsg, test)
 
     // Without |network| or |errorMsg|
     @JvmOverloads
@@ -381,7 +341,7 @@ open class TestableNetworkCallback private constructor(
         type: KClass<T>,
         timeoutMs: Long,
         test: (T) -> Boolean = { true }
-    ) = expect(type, AnyNetwork, timeoutMs, null, test)
+    ) = expect(type, ANY_NETWORK, timeoutMs, null, test)
 
     // Without |timeout| or |errorMsg|, in Network and HasNetwork versions
     fun <T : Event> expect(
@@ -400,54 +360,37 @@ open class TestableNetworkCallback private constructor(
     fun <T : Event> expect(
         type: KClass<T>,
         test: (T) -> Boolean
-    ) = expect(type, AnyNetwork, defaultTimeoutMs, null, test)
+    ) = expect(type, ANY_NETWORK, defaultTimeoutMs, null, test)
 
-    /*****
-     * eventuallyExpect family of methods, to support Java code
-     *
-     * See Expectable#eventuallyExpect
-     */
-    @JvmOverloads
-    fun <T : Event> eventuallyExpect(
-        type: KClass<T>,
+    // Kotlin reified versions. Don't call methods above, or the predicate would need to be noinline
+    inline fun <reified T : Event> expect(
+        network: Network = ANY_NETWORK,
         timeoutMs: Long = defaultTimeoutMs,
-        predicate: (cb: T) -> Boolean = { true }
-    ) = callbackTracker.eventuallyExpect(type, timeoutMs, errorMsg = null, predicate)
+        errorMsg: String? = null,
+        test: (T) -> Boolean = { true }
+    ) = (poll(timeoutMs) ?: failWithErrorReason(errorMsg,
+        "Did not receive ${T::class.simpleName} after ${timeoutMs}ms"))
+            .also {
+                if (it !is T) {
+                    failWithErrorReason(
+                        errorMsg,
+                        "Expected callback ${T::class.simpleName}, got $it"
+                    )
+                }
+                if (ANY_NETWORK !== network && it.network != network) {
+                    failWithErrorReason(errorMsg, "Expected network $network for callback : $it")
+                }
+                if (!test(it)) {
+                    failWithErrorReason(errorMsg, "Callback doesn't match predicate : $it")
+                }
+            } as T
 
-    // eventuallyExpect with a starting point.
-    // TODO : remove these method, their interface is not easy to use ; instead, use an
-    // explicit out-of-order checking mechanism.
-    @Suppress("UNCHECKED_CAST")
-    fun <T : Event> eventuallyExpect(
-        type: KClass<T>,
-        timeoutMs: Long,
-        from: Int,
-        predicate: (T) -> Boolean
-    ): T {
-        val event = history.poll(timeoutMs, pos = from) {
-            type.isInstance(it) && predicate(it as T)
-        }
-        if (null == event) {
-            failWithErrorReason(
-                null,
-                "Callback ${type.simpleName} not received within ${timeoutMs}ms. " +
-                        "Got ${history.backtrace()}"
-            )
-        }
-        return event as T
-    }
-
-    fun <T : Event> eventuallyExpect(
-        type: KClass<T>,
-        from: Int,
-        predicate: (T) -> Boolean
-    ): T = eventuallyExpect(type, timeoutMs = defaultTimeoutMs, from, predicate)
-
-    inline fun <reified T : Event> eventuallyExpect(
+    inline fun <reified T : Event> expect(
+        network: HasNetwork,
         timeoutMs: Long = defaultTimeoutMs,
-        from: Int,
-        noinline predicate: (T) -> Boolean = { true }
-    ) = eventuallyExpect(T::class, timeoutMs, from, predicate)
+        errorMsg: String? = null,
+        test: (T) -> Boolean = { true }
+    ) = expect(network.network, timeoutMs, errorMsg, test)
 
     /*****
      * assertNoCallback family of methods.
@@ -457,15 +400,59 @@ open class TestableNetworkCallback private constructor(
      */
     @JvmOverloads
     fun assertNoCallback(
-        timeoutMs: Long = defaultNoEventTimeoutMs,
+        timeoutMs: Long = defaultNoCallbackTimeoutMs,
         valid: (Event) -> Boolean = { true }
     ) {
         waiterFunc.run()
-        callbackTracker.assertNoCallback(timeoutMs, errorMsg = null, valid)
+        history.poll(timeoutMs) { valid(it) }?.let { fail("Expected no callback but got $it") }
     }
 
     fun assertNoCallback(valid: (Event) -> Boolean) =
-            assertNoCallback(defaultNoEventTimeoutMs, valid)
+            assertNoCallback(defaultNoCallbackTimeoutMs, valid)
+
+    /*****
+     * eventuallyExpect family of methods.
+     * These methods make sure a callback that matches the type/predicate is received eventually.
+     * Any callback of the wrong type, or doesn't match the optional predicate, is ignored.
+     * They fail if no callback matching the predicate is received within the timeout.
+     */
+    inline fun <reified T : Event> eventuallyExpect(
+        timeoutMs: Long = defaultTimeoutMs,
+        from: Int = mark,
+        crossinline predicate: (T) -> Boolean = { true }
+    ): T = history.poll(timeoutMs, from) { it is T && predicate(it) }.also {
+        assertNotNull(
+            it,
+            "Callback ${T::class} not received within ${timeoutMs}ms. " +
+                "Got ${history.backtrace()}"
+        )
+    } as T
+
+    @JvmOverloads
+    fun <T : Event> eventuallyExpect(
+        type: KClass<T>,
+        timeoutMs: Long = defaultTimeoutMs,
+        predicate: (cb: T) -> Boolean = { true }
+    ) = history.poll(timeoutMs) { type.java.isInstance(it) && predicate(it as T) }.also {
+        assertNotNull(
+            it,
+            "Callback ${type.java} not received within ${timeoutMs}ms. " +
+                "Got ${history.backtrace()}"
+        )
+    } as T
+
+    fun <T : Event> eventuallyExpect(
+        type: KClass<T>,
+        timeoutMs: Long = defaultTimeoutMs,
+        from: Int = mark,
+        predicate: (cb: T) -> Boolean = { true }
+    ) = history.poll(timeoutMs, from) { type.java.isInstance(it) && predicate(it as T) }.also {
+        assertNotNull(
+            it,
+            "Callback ${type.java} not received within ${timeoutMs}ms. " +
+                "Got ${history.backtrace()}"
+        )
+    } as T
 
     // Expects onAvailable and the callbacks that follow it. These are:
     // - onSuspended, iff the network was suspended when the callbacks fire.
@@ -652,5 +639,5 @@ open class TestableNetworkCallback private constructor(
     fun expectCaps(
         tmt: Long,
         valid: (NetworkCapabilities) -> Boolean
-    ) = expect<CapabilitiesChanged>(AnyNetwork, tmt) { valid(it.caps) }.caps
+    ) = expect<CapabilitiesChanged>(ANY_NETWORK, tmt) { valid(it.caps) }.caps
 }
diff --git a/staticlibs/testutils/hostdevice/com/android/net/module/util/TestableCallback.kt b/staticlibs/testutils/hostdevice/com/android/net/module/util/TestableCallback.kt
deleted file mode 100644
index 09350d0e76..0000000000
--- a/staticlibs/testutils/hostdevice/com/android/net/module/util/TestableCallback.kt
+++ /dev/null
@@ -1,358 +0,0 @@
-/*
- * Copyright (C) 2025 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-@file:Suppress("UNCHECKED_CAST") // cast is checked by type.isInstance throughout the file
-
-package com.android.net.module.util
-
-import com.android.testutils.failWithErrorReason
-import kotlin.reflect.KClass
-
-private const val DEFAULT_TIMEOUT = 30_000L // ms
-private const val DEFAULT_NO_EVENT_TIMEOUT = 200L // ms
-
-/**
- * These classes, [Expectable] and [TestableCallback], are tools designed to simplify the testing
- * of asynchronous callbacks in your code.
- *
- * A **callback** is a piece of code that gets executed when a specific event happens (e.g., data
- * received, network disconnected). These utilities help you define, record, and then assert the
- * occurrence or non-occurrence of these events in your tests.
- *
- * To use these tools, your test class typically needs to:
- * 1. Define a **sealed class** for all possible events that your callback can produce. Each
- * specific event should be a `data class` subclass of this sealed event type. This ensures type
- * safety and clear event definitions.
- *   Note : if there is only one event you can skip the sealed class and only have one data class
- *   representing that event.
- * 2. Subclass [TestableCallback] and have your subclass implement the callback interface. If you
- * cannot subclass [TestableCallback] because the callback is not an interface, your subclass
- * will instead compose a [TestableCallback] which will allow for implementing [Expectable]
- * with no additional work.
- *
- *
- * ## How to Use: Two Main Scenarios
- *
- * ### Scenario 1: Testing an Interface callback (Recommended)
- *
- * If the callback you are testing is an **interface** (e.g., `NetworkOfferCallback`), then
- * your test callback class should **inherit directly from [TestableCallback]**. This gives you
- * all the `expect` and `assertNo` family of methods for free.
- *
- * **Example:** Testing a `TestedServiceCallback` interface with `onFirstAction` and
- * `onSecondAction` methods.
- * ```kotlin
- * // The interface you want to test
- * interface TestedServiceCallback {
- *   fun onFirstAction(data: String)
- *   fun onSecondAction(value: Int)
- * }
- *
- * class MyTestServiceCallback : TestableCallback<Event>(), TestedServiceCallback {
- *   // Define all the possible events that can occur from this callback
- *   sealed class Event {
- *     data class FirstAction(val data: String) : ServiceEvent()
- *     data class SecondAction(val value: Int) : ServiceEvent()
- *   }
- *
- *   // Implement the interface methods and record the events into the history
- *   override fun onFirstAction(data: String) = history.add(FirstAction(data))
- *   override fun onSecondAction(value: Int) = history.add(SecondAction(value))
- *
- *   // You can add custom helper methods here if you want more functionality than the default
- *   // expect/assertNo methods offer.
- * }
- * ```
- *
- * **In your test code, you can then:**
- * // Wait for a `FirstAction` event where the argument starts with "foo" to happen within the
- * // default timeout.
- * `myTestServiceCallback.expect<FirstAction>() { it.data.startsWith("foo") }`
- * // Wait for any `SecondAction` event for up to 500 milliseconds.
- * `myTestServiceCallback.expect<SecondAction>(timeoutMs = 500)`
- * // Make sure no `SecondAction` event has fired so far.
- * `myTestServiceCallback.assertNo<SecondAction>()
- * etc.
- *
- * ### Scenario 2: Testing a class callback (Only do this when inheritance isn't possible)
- *
- * If the callback you need to test is a **class** (not an interface), direct inheritance from
- * [TestableCallback] isn't possible. In this case, you will:
- * 1. **Embed** an instance of [TestableCallback] inside your test class.
- * 2. Declare that your test class **implements [Expectable] by delegating** to this embedded
- * [TestableCallback] instance. This means your class will use the embedded `TestableCallback`'s
- * functionality for event tracking.
- * ```kotlin
- * MyTestServiceCallback(internalEventTracker: TestableCallback<Event>)
- *   : TestedServiceCallback, Expectable<Event> by internalEventTracker { ...
- * ```
- * 3. **Proxy** the `expect`, `eventuallyExpect`, and `assertNo` methods. This makes your test code
- * simpler by allowing you to write `expect<MySpecificEvent>()` instead of
- * `expect<_, MySpecificEvent>()`.
- *
- * **Example:** Testing a `TestedServiceCallback` class with `onFirstAction` and `onSecondAction`
- * methods.
- * ```kotlin
- * import com.android.net.module.util.assertNo
- * import com.android.net.module.util.expect
- * import com.android.net.module.util.eventuallyExpect
- *
- * // The class you want to test
- * open class TestedServiceCallback {
- *   open fun onFirstAction(data: String)
- *   open fun onSecondAction(value: Int)
- * }
- *
- * class MyTestServiceCallback(
- * // Embed a TestableCallback to handle the actual event tracking
- *   private val internalEventTracker: TestableCallback<Event> = TestableCallback()
- * ) : TestedServiceCallback(), Expectable<Event> by internalEventTracker {
- *
- *   // Define all the possible events that can occur from this callback
- *   sealed class Event {
- *     data class FirstAction(val data: String) : ServiceEvent()
- *     data class SecondAction(val value: Int) : ServiceEvent()
- *   }
- *
- *   // Implement the interface methods and record the events into the history
- *   override fun onFirstAction(data: String) = history.add(FirstAction(data))
- *   override fun onSecondAction(value: Int) = history.add(SecondAction(value))
- *
- *   // Proxy methods: These make it simpler to call expect/assertNo, avoiding 'expect<_, T>'
- *   // They simply forward the call to the embedded internalEventTracker.
- *   inline fun <reified T : Event> expect(
- *     timeoutMs: Long = defaultTimeoutMs,
- *     errorMsg: String? = null,
- *     noinline predicate: (T) -> Boolean = { true }
- *   ) = expect<_, T>(timeoutMs, errorMsg, predicate)
- *
- *   inline fun <reified T : Event> eventuallyExpect(
- *     timeoutMs: Long = defaultTimeoutMs,
- *     errorMsg: String? = null,
- *     noinline predicate: (T) -> Boolean = { true }
- *   ) = eventuallyExpect<_, T>(timeoutMs, errorMsg, predicate)
- *
- *   inline fun <reified T : Event> assertNo(
- *     timeoutMs: Long = defaultTimeoutMs,
- *     errorMsg: String? = null,
- *     noinline predicate: (T) -> Boolean = { true }
- *   ) = assertNo<_, T>(timeoutMs, errorMsg, predicate)
- * }
- * ```
- *
- *
- * ### Explanation of proxy methods (for the curious)
- *
- * The `expect`, `eventuallyExpect`, and `assertNo` methods typically reside on
- * `TestableCallback<Event>`. When you inherit from `TestableCallback`, the type `Event` is
- * directly known, making calls like `expect<MySpecificEvent>()` straightforward.
- *
- * However, `Expectable` is an interface, and as such it cannot have member methods. The
- * `Expectable.expect*` family of methods are therefore extension methods with two type arguments :
- * one for the type argument of the receiver (`Event`), one for the concrete event type
- * (`FirstAction`) ; the former is required to provide the upper bound for the latter (otherwise
- * you could call `expect<String>()`).
- * For syntactic reasons, Kotlin's compiler will refuse to call a 2-argument method with only one
- * argument, even if it can infer the first type argument. The proxy methods (like the
- * `inline fun <reified T : Event> expect(...)`) solve this by providing a single-argument version
- * that calls the 2-type argument version instructing the compiler to infer the first argument
- * (`expect<_, T>` infers `_`). This lets you write `expect<MySpecificEvent>()`.
- */
-
-/**
- * An interface for classes on which the expect* and assertNo* family of methods can be called.
- */
-// TODO : why do we have to specify `: Any` here ? Is that not the default ? If you remove
-// it then `KClass<T>` complains that T is not within its `Any` bounds,
-interface Expectable<E : Any> {
-    val history: ArrayTrackRecord<E>.ReadHead
-    val defaultTimeoutMs: Long
-    val defaultNoEventTimeoutMs: Long
-
-    /*****
-     * Expect an event immediately
-     *
-     * This method fetches the next callback and assert it matches the conditions : type,
-     * passed predicate. If no callback is received within the timeout, this method fails.
-     */
-    fun <T : E> expect(
-        type: KClass<T>,
-        timeoutMs: Long = defaultTimeoutMs,
-        errorMsg: String? = null,
-        predicate: (T) -> Boolean = { true }
-    ): T
-
-    /*****
-     * Expect that some event is received eventually.
-     *
-     * This method makes sure a callback that matches the type/predicate is received eventually.
-     * Any callback of the wrong type, or doesn't match the optional predicate, is ignored.
-     * It fails if no callback matching the predicate is received within the timeout.
-     */
-    fun <T : E> eventuallyExpect(
-        type: KClass<T>,
-        timeoutMs: Long = defaultTimeoutMs,
-        errorMsg: String? = null,
-        predicate: (T) -> Boolean = { true }
-    ): T
-
-    /*****
-     * Assert no event matching a predicate was received.
-     *
-     * This method makes sure that no callback that matches the predicate was received.
-     * If no predicate is given, it makes sure that no callback at all was received.
-     */
-    fun <T : E> assertNo(
-        type: KClass<T>,
-        timeoutMs: Long = defaultNoEventTimeoutMs,
-        errorMsg: String? = null,
-        predicate: (T) -> Boolean = { true }
-    )
-
-    fun assertNoCallback(
-        timeoutMs: Long = defaultNoEventTimeoutMs,
-        errorMsg: String? = null,
-        predicate: (E) -> Boolean = { true }
-    )
-}
-
-inline fun <E : Any, reified T : E> Expectable<E>.expect(
-    timeoutMs: Long = defaultTimeoutMs,
-    errorMsg: String? = null,
-    noinline predicate: (T) -> Boolean = { true }
-) = expect(T::class, timeoutMs, errorMsg, predicate)
-
-inline fun <E : Any, reified T : E> Expectable<E>.eventuallyExpect(
-    timeoutMs: Long = defaultTimeoutMs,
-    errorMsg: String? = null,
-    noinline predicate: (T) -> Boolean = { true }
-) = eventuallyExpect(T::class, timeoutMs, errorMsg, predicate)
-
-inline fun <E : Any, reified T : E> Expectable<E>.assertNo(
-    timeoutMs: Long = defaultTimeoutMs,
-    errorMsg: String? = null,
-    noinline predicate: (T) -> Boolean = { true }
-) = assertNo(T::class, timeoutMs, errorMsg, predicate)
-
-/**
- * A base class for connectivity testable callbacks.
- */
-open class TestableCallback<E : Any>(
-    override val defaultTimeoutMs: Long = DEFAULT_TIMEOUT,
-    override val defaultNoEventTimeoutMs: Long = DEFAULT_NO_EVENT_TIMEOUT
-) : Expectable<E> {
-    override val history = ArrayTrackRecord<E>().newReadHead()
-    val mark get() = history.mark
-
-    /**
-     * Implementation of the expect<> family of methods. All other
-     * methods eventually call this. They implement the Expectable<E>
-     * interface.
-     */
-    override fun <T : E> expect(
-        type: KClass<T>,
-        timeoutMs: Long,
-        errorMsg: String?,
-        predicate: (T) -> Boolean
-    ): T {
-        val event = history.poll(timeoutMs)
-        if (null == event) {
-            failWithErrorReason(
-                errorMsg,
-                "Did not receive ${type.simpleName} after ${timeoutMs}ms"
-            )
-        }
-        if (!type.isInstance(event)) {
-            failWithErrorReason(
-                errorMsg,
-                "Expected callback ${type.simpleName}, got $event"
-            )
-        }
-        event as T
-        if (!predicate(event)) {
-            failWithErrorReason(errorMsg, "Callback doesn't match predicate : $event")
-        }
-        return event
-    }
-
-    override fun <T : E> eventuallyExpect(
-        type: KClass<T>,
-        timeoutMs: Long,
-        errorMsg: String?,
-        predicate: (T) -> Boolean,
-    ): T {
-        val event = history.poll(timeoutMs) { type.isInstance(it) && predicate(it as T) }
-        if (null == event) {
-            failWithErrorReason(
-                errorMsg,
-                "Callback ${type.simpleName} not received within ${timeoutMs}ms. " +
-                        "Got ${history.backtrace()}"
-            )
-        }
-        return event as T
-    }
-
-    override fun assertNoCallback(
-        timeoutMs: Long,
-        errorMsg: String?,
-        predicate: (E) -> Boolean,
-    ) {
-        val mark = history.mark
-        try {
-            val event = history.poll(timeoutMs) { predicate(it) }
-            if (null != event) {
-                failWithErrorReason(
-                    errorMsg,
-                    "Expected no such callback but found $event"
-                )
-            }
-        } finally {
-            // Rewind so callers can expect a failure and continue later. For example, a caller
-            // might want to assert no callback { interfaceName == "wlan1" } but then go on
-            // to test that some other event took place, which would not be possible without this
-            // rewind because it would have been skipped by the `poll` call above.
-            history.rewind(mark)
-        }
-    }
-
-    override fun <T : E> assertNo(
-        type: KClass<T>,
-        timeoutMs: Long,
-        errorMsg: String?,
-        predicate: (T) -> Boolean,
-    ) = assertNoCallback(timeoutMs, errorMsg) { type.isInstance(it) && predicate(it as T) }
-
-    /**
-     * Proxy methods to avoid having to write expect<_, T>, see comment at the top of this file.
-     */
-    inline fun <reified T : E> expect(
-        timeoutMs: Long = defaultTimeoutMs,
-        errorMsg: String? = null,
-        noinline predicate: (T) -> Boolean = { true }
-    ) = expect<_, T>(timeoutMs, errorMsg, predicate)
-
-    inline fun <reified T : E> eventuallyExpect(
-        timeoutMs: Long = defaultTimeoutMs,
-        errorMsg: String? = null,
-        noinline predicate: (T) -> Boolean = { true }
-    ) = eventuallyExpect<_, T>(timeoutMs, errorMsg, predicate)
-
-    inline fun <reified T : E> assertNo(
-        timeoutMs: Long = defaultTimeoutMs,
-        errorMsg: String? = null,
-        noinline predicate: (T) -> Boolean = { true }
-    ) = assertNo<_, T>(timeoutMs, errorMsg, predicate)
-}
diff --git a/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java b/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
index e25eddb63d..a758b57b6c 100644
--- a/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
+++ b/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
@@ -318,7 +318,7 @@ public class ConnectivityManagerTest {
     private static final int MAX_KEEPALIVE_RETRY_COUNT = 3;
     private static final int MIN_KEEPALIVE_INTERVAL = 10;
 
-    private static final long NETWORK_CALLBACK_TIMEOUT_MS = 30_000;
+    private static final int NETWORK_CALLBACK_TIMEOUT_MS = 30_000;
     // Timeout for waiting network to be validated.
     private static final int LISTEN_ACTIVITY_TIMEOUT_MS = 30_000;
     private static final int NO_CALLBACK_TIMEOUT_MS = 100;
@@ -481,9 +481,11 @@ public class ConnectivityManagerTest {
             // networkCallbackRule is the outer rule and will be cleaned up after this method.
             final TestableNetworkCallback callback =
                     networkCallbackRule.registerDefaultNetworkCallback();
-            callback.eventuallyExpect(Event.NETWORK_CAPS_UPDATED,
-                    NETWORK_CALLBACK_TIMEOUT_MS,
-                    entry -> entry.getCaps().hasCapability(NET_CAPABILITY_VALIDATED));
+            assertNotNull("Couldn't restore Internet connectivity",
+                    callback.eventuallyExpect(Event.NETWORK_CAPS_UPDATED,
+                            NETWORK_CALLBACK_TIMEOUT_MS,
+                            entry -> ((Event.CapabilitiesChanged) entry)
+                                    .getCaps().hasCapability(NET_CAPABILITY_VALIDATED)));
         });
     }
 
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSL2capProviderTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSL2capProviderTest.kt
index c2bacbac21..98e7ff44ae 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSL2capProviderTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSL2capProviderTest.kt
@@ -49,7 +49,7 @@ import com.android.testutils.TestableNetworkCallback
 import com.android.testutils.TestableNetworkCallback.Event.Lost
 import com.android.testutils.TestableNetworkCallback.Event.Reserved
 import com.android.testutils.TestableNetworkCallback.Event.Unavailable
-import com.android.testutils.AnyNetwork
+import com.android.testutils.anyNetwork
 import com.android.testutils.waitForIdle
 import java.io.IOException
 import java.util.Optional
@@ -306,7 +306,7 @@ class CSL2capProviderTest : CSTest() {
         doReturn(true).`when`(btSocket).isConnected()
         acceptQueue.put(Optional.of(btSocket))
 
-        cb.expectAvailableCallbacks(AnyNetwork(), validated = false)
+        cb.expectAvailableCallbacks(anyNetwork(), validated = false)
         cb.assertNoCallback()
         // Verify that packet forwarding was started.
         // TODO: stop mocking L2capPacketForwarder.
@@ -355,7 +355,7 @@ class CSL2capProviderTest : CSTest() {
                 .build()
         val nr = REQUEST.copyWithSpecifier(specifier)
         val cb = requestNetwork(nr)
-        cb.expectAvailableCallbacks(AnyNetwork(), validated = false)
+        cb.expectAvailableCallbacks(anyNetwork(), validated = false)
     }
 
     @Test
@@ -368,7 +368,7 @@ class CSL2capProviderTest : CSTest() {
                 .build()
         var nr = REQUEST.copyWithSpecifier(specifier)
         val cb = requestNetwork(nr)
-        cb.expectAvailableCallbacks(AnyNetwork(), validated = false)
+        cb.expectAvailableCallbacks(anyNetwork(), validated = false)
 
         specifier = L2capNetworkSpecifier.Builder()
                 .setRole(ROLE_CLIENT)
@@ -391,10 +391,10 @@ class CSL2capProviderTest : CSTest() {
                 .build()
         val nr = REQUEST.copyWithSpecifier(specifier)
         val cb = requestNetwork(nr)
-        cb.expectAvailableCallbacks(AnyNetwork(), validated = false)
+        cb.expectAvailableCallbacks(anyNetwork(), validated = false)
 
         val cb2 = requestNetwork(nr)
-        cb2.expectAvailableCallbacks(AnyNetwork(), validated = false)
+        cb2.expectAvailableCallbacks(anyNetwork(), validated = false)
     }
 
     /** Test to ensure onLost() is sent before onUnavailable() when the network is torn down. */
@@ -409,7 +409,7 @@ class CSL2capProviderTest : CSTest() {
 
         val nr = REQUEST.copyWithSpecifier(specifier)
         val cb = requestNetwork(nr)
-        cb.expectAvailableCallbacks(AnyNetwork(), validated = false)
+        cb.expectAvailableCallbacks(anyNetwork(), validated = false)
 
         // Capture the L2capPacketForwarder callback object to tear down the network.
         val handlerCaptor = ArgumentCaptor.forClass(Handler::class.java)

From 37edbb51059e6655e58f36e0e1a7f0d915bcbbbc Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Thu, 29 May 2025 15:15:29 -0700
Subject: [PATCH 358/377] Change tethering interface to EthernetPort

Note that the comparison is still solely based on interface name.

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: Ifbeb11872dc503957e08af0d8c18c3dfebb31703
---
 .../server/ethernet/EthernetTracker.java      | 36 +++++++++----------
 1 file changed, 17 insertions(+), 19 deletions(-)

diff --git a/service-t/src/com/android/server/ethernet/EthernetTracker.java b/service-t/src/com/android/server/ethernet/EthernetTracker.java
index 6d3ca04692..68a810623e 100644
--- a/service-t/src/com/android/server/ethernet/EthernetTracker.java
+++ b/service-t/src/com/android/server/ethernet/EthernetTracker.java
@@ -160,7 +160,7 @@ public class EthernetTracker {
     // The first interface discovered is set as the mTetheringInterface. It is the interface that is
     // returned when a tethered interface is requested; until then, it remains in client mode. Its
     // current mode is reflected in mTetheringInterfaceMode.
-    private String mTetheringInterface;
+    private EthernetPort mTetheringInterface;
     // If the tethering interface is in server mode, it is not tracked by factory. The HW address
     // must be maintained by the EthernetTracker. Its current mode is reflected in
     // mTetheringInterfaceMode.
@@ -462,7 +462,7 @@ public class EthernetTracker {
                 List.of(mFactory.getAvailableInterfaces(/* includeRestricted */ true)));
 
         if (mTetheringInterfaceMode == INTERFACE_MODE_SERVER && mTetheringInterface != null) {
-            interfaces.add(mTetheringInterface);
+            interfaces.add(mTetheringInterface.getInterfaceName());
         }
         return interfaces;
     }
@@ -515,7 +515,7 @@ public class EthernetTracker {
                 unicastInterfaceStateChange(listener, iface);
             }
             if (mTetheringInterface != null && mTetheringInterfaceMode == INTERFACE_MODE_SERVER) {
-                unicastInterfaceStateChange(listener, mTetheringInterface);
+                unicastInterfaceStateChange(listener, mTetheringInterface.getInterfaceName());
             }
 
             unicastEthernetStateChange(listener, mIsEthernetEnabled);
@@ -562,16 +562,14 @@ public class EthernetTracker {
         mNetworkCapabilities.keySet().removeIf(iface -> iface.matches(TEST_IFACE_REGEXP));
     }
 
-    public void requestTetheredInterface(ITetheredInterfaceCallback callback) {
+    public void requestTetheredInterface(ITetheredInterfaceCallback cb) {
         mHandler.post(() -> {
-            if (!mTetheredInterfaceRequests.register(callback)) {
+            if (!mTetheredInterfaceRequests.register(cb)) {
                 // Remote process has already died
                 return;
             }
-            if (mTetheringInterfaceMode == INTERFACE_MODE_SERVER) {
-                if (mTetheredInterfaceWasAvailable) {
-                    notifyTetheredInterfaceAvailable(callback, mTetheringInterface);
-                }
+            if (mTetheringInterfaceMode == INTERFACE_MODE_SERVER && mTetheringInterface != null) {
+                notifyTetheredInterfaceAvailable(cb, mTetheringInterface.getInterfaceName());
                 return;
             }
 
@@ -612,11 +610,11 @@ public class EthernetTracker {
         Log.d(TAG, "Setting tethering interface mode to " + mode);
         mTetheringInterfaceMode = mode;
         if (mTetheringInterface != null) {
-            removeInterface(mTetheringInterface);
-            addInterface(mTetheringInterface);
+            removeInterface(mTetheringInterface.getInterfaceName());
+            addInterface(mTetheringInterface.getInterfaceName());
             // when this broadcast is sent, any calls to notifyTetheredInterfaceAvailable or
             // notifyTetheredInterfaceUnavailable have already happened
-            broadcastInterfaceStateChange(mTetheringInterface);
+            broadcastInterfaceStateChange(mTetheringInterface.getInterfaceName());
         }
     }
 
@@ -645,7 +643,7 @@ public class EthernetTracker {
     }
 
     private int getInterfaceMode(final String iface) {
-        if (iface.equals(mTetheringInterface)) {
+        if (mTetheringInterface != null && iface.equals(mTetheringInterface.getInterfaceName())) {
             return mTetheringInterfaceMode;
         }
         return INTERFACE_MODE_CLIENT;
@@ -658,7 +656,7 @@ public class EthernetTracker {
 
     private void stopTrackingInterface(String iface) {
         removeInterface(iface);
-        if (iface.equals(mTetheringInterface)) {
+        if (mTetheringInterface != null && iface.equals(mTetheringInterface.getInterfaceName())) {
             mTetheringInterface = null;
             mTetheringInterfaceHwAddr = null;
         }
@@ -750,9 +748,9 @@ public class EthernetTracker {
     }
 
     private void maybeUpdateServerModeInterfaceState(String iface, boolean available) {
-        if (available == mTetheredInterfaceWasAvailable || !iface.equals(mTetheringInterface)) {
-            return;
-        }
+        if (mTetheringInterface == null) return;
+        if (!iface.equals(mTetheringInterface.getInterfaceName())) return;
+        if (available == mTetheredInterfaceWasAvailable) return;
 
         Log.d(TAG, (available ? "Tracking" : "No longer tracking")
                 + " interface in server mode: " + iface);
@@ -774,7 +772,7 @@ public class EthernetTracker {
         final String iface = port.getInterfaceName();
         // If we don't already track this interface, and if this interface matches
         // our regex, start tracking it.
-        if (mFactory.hasInterface(iface) || iface.equals(mTetheringInterface)) {
+        if (mFactory.hasInterface(iface) || (getInterfaceMode(iface) == INTERFACE_MODE_SERVER)) {
             if (DBG) Log.w(TAG, "Ignoring already-tracked " + port);
             return;
         }
@@ -782,7 +780,7 @@ public class EthernetTracker {
 
         // Do not use an interface for tethering if it has configured NetworkCapabilities.
         if (mTetheringInterface == null && !mNetworkCapabilities.containsKey(iface)) {
-            mTetheringInterface = iface;
+            mTetheringInterface = port;
         }
 
         addInterface(iface);

From 78956b3abb59b312e85867fc3e379e29aa32b955 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Thu, 29 May 2025 15:22:12 -0700
Subject: [PATCH 359/377] Pass EthernetPort to addInterface

The netd dependency can be removed in a follow up change. Since the only
entrypoint to addInterface() is now EthernetNetlinkMonitor which calls
both addInterface() and updateInterfaceState(), the "IF_FLAG_RUNNING"
check inside addInterface() is no longer needed.

Also note that this change relies on the representation of
getMacAddress().toString() to match what netd returns. Configuration by
MacAddress is almost solely used by automotive devices which do not take
mainline, so making this change is relatively low-risk. In the unlikely
case automotive OEMs are broken by this, they have time to fix their
config overlays.

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I9a57bb8693568a1bbb1ade86c06613134b40532c
---
 .../src/com/android/server/ethernet/EthernetTracker.java | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/service-t/src/com/android/server/ethernet/EthernetTracker.java b/service-t/src/com/android/server/ethernet/EthernetTracker.java
index 68a810623e..672b146f4e 100644
--- a/service-t/src/com/android/server/ethernet/EthernetTracker.java
+++ b/service-t/src/com/android/server/ethernet/EthernetTracker.java
@@ -611,7 +611,7 @@ public class EthernetTracker {
         mTetheringInterfaceMode = mode;
         if (mTetheringInterface != null) {
             removeInterface(mTetheringInterface.getInterfaceName());
-            addInterface(mTetheringInterface.getInterfaceName());
+            addInterface(mTetheringInterface);
             // when this broadcast is sent, any calls to notifyTetheredInterfaceAvailable or
             // notifyTetheredInterfaceUnavailable have already happened
             broadcastInterfaceStateChange(mTetheringInterface.getInterfaceName());
@@ -663,7 +663,8 @@ public class EthernetTracker {
         broadcastInterfaceStateChange(iface);
     }
 
-    private void addInterface(String iface) {
+    private void addInterface(EthernetPort port) {
+        final String iface = port.getInterfaceName();
         final InterfaceConfigurationParcel config;
         // Bring up the interface so we get link status indications.
         try {
@@ -682,7 +683,7 @@ public class EthernetTracker {
         // Only bring the interface up when ethernet is enabled, otherwise set interface down.
         setInterfaceUpState(iface, mIsEthernetEnabled);
 
-        final String hwAddress = config.hwAddr;
+        final String hwAddress = port.getMacAddress().toString();
 
         if (getInterfaceMode(iface) == INTERFACE_MODE_SERVER) {
             maybeUpdateServerModeInterfaceState(iface, true);
@@ -783,7 +784,7 @@ public class EthernetTracker {
             mTetheringInterface = port;
         }
 
-        addInterface(iface);
+        addInterface(port);
 
         broadcastInterfaceStateChange(iface);
     }

From a129f4c5cd0b803513a41939468914ab98aebff7 Mon Sep 17 00:00:00 2001
From: Xiao Ma <xiaom@google.com>
Date: Thu, 5 Jun 2025 19:30:11 +0900
Subject: [PATCH 360/377] DHCPv6 addr reg: parse IA Address option.

Flag: EXEMPT guarded by an legacy experiment flag
Bug: 293393743
Test: TH
Change-Id: I29d201a69af220af00deb9e1b1d0c1253faa6200
---
 .../net/module/util/dhcp6/Dhcp6Packet.java    | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java
index ee70dbbc11..d93c1a2071 100644
--- a/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java
+++ b/staticlibs/device/com/android/net/module/util/dhcp6/Dhcp6Packet.java
@@ -473,6 +473,7 @@ public class Dhcp6Packet {
     private static Dhcp6Packet decode(@NonNull final ByteBuffer packet) throws ParseException {
         int elapsedTime = 0;
         byte[] iapd = null;
+        byte[] iaAddress = null;
         byte[] serverDuid = null;
         byte[] clientDuid = null;
         short statusCode = STATUS_SUCCESS;
@@ -544,6 +545,20 @@ public class Dhcp6Packet {
                             skipOption(packet, optionLen - 2);
                         }
                         break;
+                    case DHCP6_IA_ADDR:
+                        expectedLen = optionLen;
+                        final byte[] iaAddressBytes = new byte[16];
+                        packet.get(iaAddressBytes, 0 /* offset */, 16);
+                        iaAddress = iaAddressBytes;
+                        // TODO: support parsing preferred and valid lifetime.
+                        packet.getInt(); // preferred lifetime
+                        packet.getInt(); // valid lifetime
+                        // IAaddr-options are currently unsupported, skip over them.
+                        final int remainingBytesLength = optionLen - 16 - 8;
+                        if (remainingBytesLength > 0) {
+                            skipOption(packet, remainingBytesLength);
+                        }
+                        break;
                     case DHCP6_SOL_MAX_RT:
                         expectedLen = 4;
                         solMaxRt = packet.getInt();
@@ -593,6 +608,10 @@ public class Dhcp6Packet {
             case DHCP6_MESSAGE_TYPE_REBIND:
                 newPacket = new Dhcp6RebindPacket(transId, elapsedTime, clientDuid, iapd);
                 break;
+            case DHCP6_MESSAGE_TYPE_ADDR_REG_INFORM:
+                newPacket = new Dhcp6AddrRegInformPacket(transId, elapsedTime, clientDuid,
+                        iaAddress);
+                break;
             default:
                 throw new ParseException("Unimplemented DHCP6 message type %d" + messageType);
         }

From 1ff0c98745ed446cdca3af8fae636ffc365e9ec0 Mon Sep 17 00:00:00 2001
From: Junyu Lai <junyulai@google.com>
Date: Tue, 3 Jun 2025 18:18:55 +0800
Subject: [PATCH 361/377] Fix SatisfiedTime initialization

mSatisfiedTime now initializes with the current time upon NRI
creation, or copied when the copy constructor is called.

Test: atest ConnectivityCoverageTests --test-filter 'NetworkRequestInfo*' --update-device
Flag: EXEMPT controlled by kill switch
Bug: 419123367
Change-Id: If707b96bf6ce5c6cb0287d5c2d6056591dd6769f
---
 .../android/server/ConnectivityService.java   |  12 +-
 .../CSNetworkRequestInfoTest.kt               | 105 ++++++++++++++++++
 .../server/connectivityservice/base/CSTest.kt |   8 ++
 3 files changed, 122 insertions(+), 3 deletions(-)
 create mode 100644 tests/unit/java/com/android/server/connectivityservice/CSNetworkRequestInfoTest.kt

diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index f00233e422..2646be0e48 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -1549,6 +1549,11 @@ public class ConnectivityService extends IConnectivityManager.Stub
             return SdkLevel.isAtLeastB();
         }
 
+        /** Get SystemClock.elapsedRealtime() */
+        public long getElapsedRealtime() {
+            return SystemClock.elapsedRealtime();
+        }
+
         /**
          * Get system properties to use in ConnectivityService.
          */
@@ -8121,7 +8126,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
                 @Nullable final NetworkRequest activeRequest) {
             mSatisfier = satisfier;
             mActiveRequest = activeRequest;
-            mSatisfiedTime = SystemClock.elapsedRealtime();
+            mSatisfiedTime = mDeps.getElapsedRealtime();
         }
 
         // The network currently satisfying this NRI. Only one request in an NRI can have a
@@ -8132,10 +8137,10 @@ public class ConnectivityService extends IConnectivityManager.Stub
             return mSatisfier;
         }
 
-        private long mSatisfiedTime = 0;
+        private long mSatisfiedTime = mDeps.getElapsedRealtime();
 
         /**
-         * Get timestamp (SystemClock.elapsedRealtime()) when the satisfier is set for this NRI.
+         * Get timestamp (SystemClock.elapsedRealtime()) when is set or removed.
          * Resets when the satisfier changes.
          */
         public long getSatisfiedTime() {
@@ -8318,6 +8323,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
                 }
                 setSatisfier(satisfier, activeRequest);
             }
+            mSatisfiedTime = nri.mSatisfiedTime;
             mMatchedNetIdWhenFrozen = nri.mMatchedNetIdWhenFrozen;
             mQueuedCallbacks = nri.mQueuedCallbacks;
             mMessenger = nri.mMessenger;
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSNetworkRequestInfoTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSNetworkRequestInfoTest.kt
new file mode 100644
index 0000000000..d8b5138f2c
--- /dev/null
+++ b/tests/unit/java/com/android/server/connectivityservice/CSNetworkRequestInfoTest.kt
@@ -0,0 +1,105 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.server
+
+import android.net.ConnectivityManager
+import android.net.NetworkCapabilities
+import android.net.NetworkCapabilities.NET_CAPABILITY_INTERNET
+import android.net.NetworkRequest
+import android.os.Build
+import com.android.server.connectivity.NetworkAgentInfo
+import com.android.testutils.DevSdkIgnoreRule
+import com.android.testutils.DevSdkIgnoreRunner
+import java.util.Collections
+import kotlin.test.assertEquals
+import org.junit.Test
+import org.junit.runner.RunWith
+
+private const val TEST_UID = 1234
+
+@RunWith(DevSdkIgnoreRunner::class)
+@DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.TIRAMISU)
+class CSNetworkRequestInfoTest : CSTest() {
+    /**
+     * Helper function to create a NetworkRequestInfo for internal system usage.
+     * This simplifies NRI creation within the test.
+     */
+    private fun createNri(request: NetworkRequest): ConnectivityService.NetworkRequestInfo {
+        // This uses the internal constructor to create an NRI as the system would.
+        return service.NetworkRequestInfo(
+                TEST_UID,
+                Collections.singletonList(request),
+                0 // preferenceOrder
+        )
+    }
+
+    @Test
+    fun testGetSatisfiedTime() {
+        // Setup: Create a basic NetworkRequestInfo and mock a network.
+        val t0 = 50L
+        deps.elapsedRealtime = t0
+        val capabilities = NetworkCapabilities.Builder()
+                .addCapability(NET_CAPABILITY_INTERNET)
+                .build()
+        val request = NetworkRequest(
+                capabilities,
+                ConnectivityManager.TYPE_NONE,
+                1 /* requestId */,
+                NetworkRequest.Type.REQUEST
+        )
+        val nri = createNri(request)
+        val nai = mock<NetworkAgentInfo>()
+
+        // Initially, satisfiedTime should be the created time, which is the "null" start
+        // to satisfying the request.
+        assertEquals(t0, nri.satisfiedTime)
+
+        // When a network satisfies the request at t=100, verify the satisfiedTime updates.
+        val t1 = 100L
+        deps.elapsedRealtime = t1
+        nri.setSatisfier(nai, request)
+        assertEquals(t1, nri.satisfiedTime)
+
+        // When the request becomes unsatisfied at t=250, verify the satisfiedTime updates.
+        val t2 = 250L
+        deps.elapsedRealtime = t2
+        nri.setSatisfier(null, null)
+        assertEquals(t2, nri.satisfiedTime)
+    }
+
+    @Test
+    fun testCopyConstructorPreservesSatisfiedTime() {
+        val capabilities = NetworkCapabilities.Builder()
+                .addCapability(NET_CAPABILITY_INTERNET)
+                .build()
+        val request = NetworkRequest(
+                capabilities,
+                ConnectivityManager.TYPE_NONE,
+                1 /* requestId */,
+                NetworkRequest.Type.REQUEST
+        )
+        val t1 = 100L
+        deps.elapsedRealtime = t1
+        val originalNri = createNri(request)
+
+        // Change time, and verify it is not used by copy constructor.
+        val t2 = 12345L
+        deps.elapsedRealtime = t2
+        val newNri = service.NetworkRequestInfo(originalNri, Collections.singletonList(request))
+        assertEquals(t1, newNri.satisfiedTime)
+    }
+}
diff --git a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
index 1d05e4ad20..1a97e3a9c0 100644
--- a/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/base/CSTest.kt
@@ -447,6 +447,14 @@ open class CSTest {
         override fun getCallingUid() =
                 if (callingUid == CALLING_UID_UNMOCKED) super.getCallingUid() else callingUid
 
+        private var mockedElapsedTime = 0L
+
+        override fun getElapsedRealtime() = mockedElapsedTime
+
+        fun setElapsedRealtime(time: Long) {
+            visibleOnHandlerThread(csHandler) { mockedElapsedTime = time }
+        }
+
         override fun destroyLiveTcpSocketsByOwnerUids(ownerUids: Set<Int>) {
             // Call mocked destroyLiveTcpSocketsByOwnerUids so that test can verify this method call
             destroySocketsWrapper.destroyLiveTcpSocketsByOwnerUids(ownerUids)

From d4c521ab43f2778b4ef0971b2efa2f3308c50b57 Mon Sep 17 00:00:00 2001
From: Junyu Lai <junyulai@google.com>
Date: Wed, 4 Jun 2025 23:26:10 +0800
Subject: [PATCH 362/377] Test refactoring of DefaultNetworkRematchMetrics

This change includes:
 1. addEvent Parameter Update: Added satisfied duration to
    addEvent, making duration testable in CSTest.
 2. CSDefaultNetworkRematchMetricsTest Refactor: Tests now use
    expectAddEvent with argThat and InOrder for more deterministic
    verification.
 3. New Unit Test: Added a test to demonstrate a metrics reporting
    issue during per-app default network request updates.

Test: atest ConnectivityCoverageTests --test-filter 'DefaultNetworkRematch*' \
      --update-device
Flag: EXEMPT Test only refactoring
Bug: 419123367
Change-Id: I3c73b445674991f85e37b3f980fa80fb918713ac
---
 .../metrics/DefaultNetworkRematchMetrics.java |  18 +-
 .../android/server/ConnectivityService.java   |   6 +-
 .../DefaultNetworkRematchMetricsTest.kt       |  23 +--
 .../CSDefaultNetworkRematchMetricsTest.kt     | 178 +++++++++++++-----
 4 files changed, 148 insertions(+), 77 deletions(-)

diff --git a/service/src/com/android/metrics/DefaultNetworkRematchMetrics.java b/service/src/com/android/metrics/DefaultNetworkRematchMetrics.java
index df32044b58..cced96c3c5 100644
--- a/service/src/com/android/metrics/DefaultNetworkRematchMetrics.java
+++ b/service/src/com/android/metrics/DefaultNetworkRematchMetrics.java
@@ -30,7 +30,6 @@ import static com.android.server.ConnectivityStatsLog.DEFAULT_NETWORK_REMATCH__R
 import android.annotation.NonNull;
 import android.annotation.Nullable;
 import android.net.NetworkCapabilities;
-import android.os.SystemClock;
 import android.stats.connectivity.MeteredState;
 import android.stats.connectivity.ValidatedState;
 
@@ -73,13 +72,6 @@ public class DefaultNetworkRematchMetrics {
             ConnectivityStatsLog.write(DEFAULT_NETWORK_REMATCH, sessionId, rematchReason,
                     list.toByteArray());
         }
-
-        /**
-         * Returns SystemClock.elapsedRealtime()
-         */
-        public long getElapsedRealtime() {
-            return SystemClock.elapsedRealtime();
-        }
     }
 
     /**
@@ -91,7 +83,8 @@ public class DefaultNetworkRematchMetrics {
      */
     public void addEvent(@NonNull ConnectivityService.NetworkRequestInfo nri,
             @Nullable NetworkAgentInfo oldNetwork,
-            @Nullable NetworkAgentInfo newNetwork) {
+            @Nullable NetworkAgentInfo newNetwork,
+            long satisfiedDurationMs) {
         // TODO: Record event for network other than satellite after figuring out
         //  how to deal with the amount of data single device reports.
         // Only logs for satellite multilayer requests.
@@ -103,7 +96,7 @@ public class DefaultNetworkRematchMetrics {
             return;
         }
         mBuilder.addDefaultNetworkRematchInfo(
-                getDefaultNetworkRematchInfo(nri, oldNetwork, newNetwork));
+                getDefaultNetworkRematchInfo(nri, oldNetwork, newNetwork, satisfiedDurationMs));
     }
 
     /**
@@ -125,13 +118,14 @@ public class DefaultNetworkRematchMetrics {
     @NonNull
     private DefaultNetworkRematchInfo getDefaultNetworkRematchInfo(
             @NonNull ConnectivityService.NetworkRequestInfo nri,
-            @Nullable NetworkAgentInfo oldNetwork, @Nullable NetworkAgentInfo newNetwork) {
+            @Nullable NetworkAgentInfo oldNetwork, @Nullable NetworkAgentInfo newNetwork,
+            long satisfiedDurationMs) {
         final DefaultNetworkRematchInfo.Builder infoBuilder =
                 DefaultNetworkRematchInfo.newBuilder();
         if (oldNetwork != null) {
             infoBuilder.setOldNetwork(getNetworkDescription(oldNetwork));
             infoBuilder.setTimeDurationOnOldNetworkSec(
-                    (int) ((mDeps.getElapsedRealtime() - nri.getSatisfiedTime()) / 1000));
+                    (int) (satisfiedDurationMs / 1000));
         }
         if (newNetwork != null) {
             infoBuilder.setNewNetwork(getNetworkDescription(newNetwork));
diff --git a/service/src/com/android/server/ConnectivityService.java b/service/src/com/android/server/ConnectivityService.java
index 2646be0e48..ccda9c503e 100644
--- a/service/src/com/android/server/ConnectivityService.java
+++ b/service/src/com/android/server/ConnectivityService.java
@@ -5821,7 +5821,8 @@ public class ConnectivityService extends IConnectivityManager.Stub
                 if (mConstrainedDataSatelliteMetrics && mDefaultNetworkRequests.contains(nri)) {
                     // Must be called before satisfier changes to get satisfied time.
                     // See NRI#getSatisfiedTime().
-                    mDefaultNetworkRematchMetrics.addEvent(nri, currentNetwork, null);
+                    mDefaultNetworkRematchMetrics.addEvent(nri, currentNetwork, null,
+                            mDeps.getElapsedRealtime() - nri.getSatisfiedTime());
                 }
                 nri.setSatisfier(null, null);
 
@@ -11703,7 +11704,8 @@ public class ConnectivityService extends IConnectivityManager.Stub
                 continue;
             }
             mDefaultNetworkRematchMetrics.addEvent(defaultRequestInfo,
-                    reassignment.mOldNetwork, reassignment.mNewNetwork);
+                    reassignment.mOldNetwork, reassignment.mNewNetwork,
+                    mDeps.getElapsedRealtime() - defaultRequestInfo.getSatisfiedTime());
         }
         // TODO: fill rematch reason.
         mDefaultNetworkRematchMetrics.writeStatsAndClear();
diff --git a/tests/unit/java/com/android/metrics/DefaultNetworkRematchMetricsTest.kt b/tests/unit/java/com/android/metrics/DefaultNetworkRematchMetricsTest.kt
index 9595be297a..967a59be00 100644
--- a/tests/unit/java/com/android/metrics/DefaultNetworkRematchMetricsTest.kt
+++ b/tests/unit/java/com/android/metrics/DefaultNetworkRematchMetricsTest.kt
@@ -94,7 +94,7 @@ class DefaultNetworkRematchMetricsTest {
     fun testAddEvent_wrongPreference_isIgnored() {
         doReturn(PREFERENCE_ORDER_NONE).`when`(nri).preferenceOrderForNetd
 
-        metrics.addEvent(nri, oldNai, newNai)
+        metrics.addEvent(nri, oldNai, newNai, 0L)
         metrics.writeStatsAndClear()
 
         verify(deps, never()).writeStats(anyLong(), anyInt(), any())
@@ -109,7 +109,7 @@ class DefaultNetworkRematchMetricsTest {
         doReturn(nonSatelliteCaps).`when`(oldNai).capsNoCopy
 
         // Action: Attempt to add the event and write stats.
-        metrics.addEvent(nri, oldNai, newNai)
+        metrics.addEvent(nri, oldNai, newNai, 0L)
         metrics.writeStatsAndClear()
 
         // Verification: The event should be ignored, so writeStats should never be called.
@@ -118,7 +118,7 @@ class DefaultNetworkRematchMetricsTest {
 
     @Test
     fun testAddEvent_validRequest_isAdded() {
-        metrics.addEvent(nri, oldNai, newNai)
+        metrics.addEvent(nri, oldNai, newNai, 0L)
         metrics.writeStatsAndClear()
 
         verify(deps, times(1)).writeStats(anyLong(), anyInt(), any())
@@ -133,26 +133,17 @@ class DefaultNetworkRematchMetricsTest {
     @Test
     fun testWriteStats_withEvents_writesAndClears() {
         // Setup: Define the time the network satisfied time and the current time.
-        val satisfiedTimeMs = 100_000L
-        val currentTimeMs = 220_000L // 120 seconds after satisfied
-        val expectedDurationSec = ((currentTimeMs - satisfiedTimeMs) / 1000).toInt()
-
-        // Mock the dependencies to return the defined times.
-        doReturn(satisfiedTimeMs).`when`(oldNai).connectedTime
-        doReturn(currentTimeMs).`when`(deps).elapsedRealtime
-
-        // Mock the dependencies to return the defined times.
-        doReturn(satisfiedTimeMs).`when`(nri).satisfiedTime
+        val satisfiedDurationMs = 120_000L
 
         // First call: Add event and write
-        metrics.addEvent(nri, oldNai, newNai)
+        metrics.addEvent(nri, oldNai, newNai, satisfiedDurationMs)
         metrics.writeStatsAndClear()
 
         verify(deps, times(1)).writeStats(anyLong(), anyInt(), infoListCaptor.capture())
         val capturedList = infoListCaptor.value
         assertEquals(1, capturedList.defaultNetworkRematchInfoList.size)
         val info = capturedList.defaultNetworkRematchInfoList[0]
-        assertEquals(expectedDurationSec, info.timeDurationOnOldNetworkSec)
+        assertEquals((satisfiedDurationMs / 1000).toInt(), info.timeDurationOnOldNetworkSec)
 
         // Second call: Should do nothing as events are cleared
         clearInvocations(deps)
@@ -214,7 +205,7 @@ class DefaultNetworkRematchMetricsTest {
         val uids = setOf(UidRange(1000, 1000), UidRange(2000, 3000))
         doReturn(uids).`when`(nri).uids
 
-        metrics.addEvent(nri, oldNai, null)
+        metrics.addEvent(nri, oldNai, null, 0L)
         metrics.writeStatsAndClear()
 
         verify(deps).writeStats(anyLong(), anyInt(), infoListCaptor.capture())
diff --git a/tests/unit/java/com/android/server/connectivityservice/CSDefaultNetworkRematchMetricsTest.kt b/tests/unit/java/com/android/server/connectivityservice/CSDefaultNetworkRematchMetricsTest.kt
index 80b78836bd..d95fdf42f2 100644
--- a/tests/unit/java/com/android/server/connectivityservice/CSDefaultNetworkRematchMetricsTest.kt
+++ b/tests/unit/java/com/android/server/connectivityservice/CSDefaultNetworkRematchMetricsTest.kt
@@ -16,106 +16,190 @@
 
 package com.android.server
 
+import android.net.INetd
 import android.net.Network
 import android.net.NetworkCapabilities.NET_CAPABILITY_INTERNET
 import android.net.NetworkCapabilities.TRANSPORT_CELLULAR
 import android.net.NetworkCapabilities.TRANSPORT_WIFI
+import android.net.UidRange
 import android.os.Build
-import com.android.server.ConnectivityService.NetworkRequestInfo
+import com.android.server.ConnectivityService.PREFERENCE_ORDER_SATELLITE_FALLBACK
 import com.android.server.ConnectivityStatsLog.DEFAULT_NETWORK_REMATCH__REMATCH_REASON__RMR_NETWORK_DISCONNECTED
-import com.android.server.connectivity.NetworkAgentInfo
 import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo
 import com.android.testutils.DevSdkIgnoreRunner
-import org.junit.Assert.fail
+import com.android.testutils.postAndWait
 import org.junit.Test
 import org.junit.runner.RunWith
-import org.mockito.ArgumentCaptor
+import org.mockito.ArgumentMatchers.argThat
+import org.mockito.ArgumentMatchers.eq
+import org.mockito.InOrder
 import org.mockito.Mockito.atLeastOnce
-import org.mockito.Mockito.reset
+import org.mockito.Mockito.inOrder
 import org.mockito.Mockito.verify
 
 private const val DEFAULT_REQUEST_ID = 1
-private inline fun <reified T> argumentCaptor() = ArgumentCaptor.forClass(T::class.java)
+private const val TEST_UID = 1234
+private const val TEST_UID2 = 5678
+
+// Timestamp constants. They need to be chosen to prevent a difference between
+// any two of them from being equal to a difference between another two
+// (or more) of them. This ensures that wrong duration calculations won't pass
+// the tests accidentally.
+private const val t0 = 0L
+private const val t1 = 11L
+private const val t2 = 23L
+private const val t3 = 38L
+private const val t4 = 56L
 
 @IgnoreUpTo(Build.VERSION_CODES.TIRAMISU)
 @RunWith(DevSdkIgnoreRunner::class)
 class CSDefaultNetworkRematchMetricsTest : CSTest() {
+    companion object {
+        private val NO_SERVICE_NETWORK = Network(INetd.UNREACHABLE_NET_ID)
+    }
+
     @Test
     fun testRematchWritesStats() {
-        waitForIdle()
-        reset(defaultNetworkRematchMetrics)
+        val inOrder = inOrder(defaultNetworkRematchMetrics)
 
         // 1. Connect a cellular network. It becomes the default.
+        deps.elapsedRealtime = t1
         val naiCell = Agent(nc = nc(TRANSPORT_CELLULAR, NET_CAPABILITY_INTERNET))
         naiCell.connect(true)
-        waitForIdle()
-        eventuallyExpectAddEvent(DEFAULT_REQUEST_ID, null, naiCell.network)
-        verify(defaultNetworkRematchMetrics, atLeastOnce()).writeStatsAndClear()
-        reset(defaultNetworkRematchMetrics)
+        expectAddEvent(inOrder, DEFAULT_REQUEST_ID, null, naiCell.network, t1 - t0)
+        inOrder.verify(defaultNetworkRematchMetrics, atLeastOnce()).writeStatsAndClear()
 
         // 2. Connect a WiFi network. It has a higher score and will cause a rematch.
+        deps.elapsedRealtime = t2
         val naiWifi = Agent(nc = nc(TRANSPORT_WIFI, NET_CAPABILITY_INTERNET))
         naiWifi.connect(true)
-        waitForIdle()
 
         // 3. Verify: The rematch should trigger writing the stats.
-        eventuallyExpectAddEvent(DEFAULT_REQUEST_ID, naiCell.network, naiWifi.network)
-        verify(defaultNetworkRematchMetrics, atLeastOnce()).writeStatsAndClear()
+        expectAddEvent(inOrder, DEFAULT_REQUEST_ID, naiCell.network, naiWifi.network, t2 - t1)
+        inOrder.verify(defaultNetworkRematchMetrics, atLeastOnce()).writeStatsAndClear()
+        inOrder.verifyNoMoreInteractions()
     }
 
     @Test
     fun testDisconnectWritesStats() {
-        waitForIdle()
-        reset(defaultNetworkRematchMetrics)
+        val inOrder = inOrder(defaultNetworkRematchMetrics)
 
         // 1. Connect a cellular network. It becomes the default.
+        deps.elapsedRealtime = t1
         val naiCell = Agent(nc = nc(TRANSPORT_CELLULAR, NET_CAPABILITY_INTERNET))
         naiCell.connect(true)
-        waitForIdle()
-        eventuallyExpectAddEvent(DEFAULT_REQUEST_ID, null, naiCell.network)
-        verify(defaultNetworkRematchMetrics, atLeastOnce()).writeStatsAndClear()
-        reset(defaultNetworkRematchMetrics)
+        expectAddEvent(inOrder, DEFAULT_REQUEST_ID, null, naiCell.network, t1 - t0)
+        inOrder.verify(defaultNetworkRematchMetrics).writeStatsAndClear()
+        inOrder.verifyNoMoreInteractions()
 
         // 2. Disconnect the cellular network.
+        deps.elapsedRealtime = t2
         naiCell.disconnect()
         waitForIdle()
 
         // 3. Verify: Disconnecting the default network should trigger writing the stats.
-        eventuallyExpectAddEvent(DEFAULT_REQUEST_ID, naiCell.network, null)
-        verify(defaultNetworkRematchMetrics, atLeastOnce()).writeStatsAndClear(
+        expectAddEvent(inOrder, DEFAULT_REQUEST_ID, naiCell.network, null, t2 - t1)
+        inOrder.verify(defaultNetworkRematchMetrics).writeStatsAndClear(
                 DEFAULT_NETWORK_REMATCH__REMATCH_REASON__RMR_NETWORK_DISCONNECTED
         )
+        // Caused by rematch.
+        inOrder.verify(defaultNetworkRematchMetrics).writeStatsAndClear()
+        inOrder.verifyNoMoreInteractions()
     }
 
-    private fun eventuallyExpectAddEvent(
-            expectedRequestId: Int,
-            expectedOldNetwork: Network?,
-            expectedNewNetwork: Network?
+    private fun expectAddEvent(
+            inOrder: InOrder,
+            requestId: Int,
+            oldNetwork: Network?,
+            newNetwork: Network?,
+            satisfiedDurationMs: Long
     ) {
-        val nriCaptor = argumentCaptor<NetworkRequestInfo>()
-        val oldNetworkCaptor = argumentCaptor<NetworkAgentInfo?>()
-        val newNetworkCaptor = argumentCaptor<NetworkAgentInfo?>()
-        verify(defaultNetworkRematchMetrics, atLeastOnce()).addEvent(
-                nriCaptor.capture(),
-                oldNetworkCaptor.capture(),
-                newNetworkCaptor.capture()
+        inOrder.verify(defaultNetworkRematchMetrics).addEvent(
+                argThat { it.mRequests.firstOrNull()?.requestId == requestId },
+                argThat { it?.network == oldNetwork },
+                argThat { it?.network == newNetwork },
+                eq(satisfiedDurationMs)
         )
+    }
 
-        // TODO: Support checking multilayer requests.
-        val capturedEvents = nriCaptor.allValues.indices.map { i ->
-            val requestId = nriCaptor.allValues[i].mRequests[0].requestId
-            val oldNetwork = oldNetworkCaptor.allValues[i]
-            val newNetwork = newNetworkCaptor.allValues[i]
-            if (requestId == expectedRequestId && oldNetwork?.network == expectedOldNetwork &&
-                    newNetwork?.network == expectedNewNetwork) {
-                        return
-                    }
-            Triple(requestId, oldNetwork?.network, newNetwork?.network)
+    private fun expectAddSatelliteEvent(
+            inOrder: InOrder,
+            expectedUid: Int,
+            oldNetwork: Network?,
+            newNetwork: Network?,
+            expectedSatisfiedDuration: Long
+    ) {
+        inOrder.verify(defaultNetworkRematchMetrics).addEvent(
+                argThat {
+                    it.preferenceOrderForNetd == PREFERENCE_ORDER_SATELLITE_FALLBACK &&
+                            it.uids.contains(UidRange(expectedUid, expectedUid))
+                },
+                argThat { it?.network == oldNetwork },
+                argThat { it?.network == newNetwork },
+                eq(expectedSatisfiedDuration)
+        )
+    }
+
+    private fun updateSatelliteNetworkFallbackUids(messagingUids: Set<Int>, optinUids: Set<Int>) {
+        csHandler.postAndWait {
+            deps.satelliteNetworkFallbackUidUpdate!!.accept(messagingUids, optinUids)
         }
+    }
 
-        fail(
-                "Expecting ($expectedRequestId, $expectedOldNetwork, $expectedNewNetwork) " +
-                        "but got $capturedEvents"
+    @Test
+    fun testReplaceSatelliteRequestWritesStats() {
+        val inOrder = inOrder(defaultNetworkRematchMetrics)
+
+        // Trigger CS to add the SATELLITE_FALLBACK multilayer network request.
+        // Only an opt-in UID multilayer request is created since there is no
+        // role-sms UID.
+        // The satellite request is created and immediately satisfied by NO_SERVICE_NETWORK
+        // if it rematches when no network is available.
+        deps.elapsedRealtime = t1
+        updateSatelliteNetworkFallbackUids(setOf(), setOf(TEST_UID))
+        // The request created and rematched immediately so it satisfied by null with no time.
+        expectAddSatelliteEvent(inOrder, TEST_UID, null, NO_SERVICE_NETWORK, 0)
+
+        // Connect a cellular network. Expect an event indicating the NO_SERVICE_NETWORK
+        // was satisfied for the duration t2 - t1.
+        deps.elapsedRealtime = t2
+        val naiCell = Agent(nc = nc(TRANSPORT_CELLULAR, NET_CAPABILITY_INTERNET))
+        naiCell.connect(true)
+        expectAddEvent(inOrder, DEFAULT_REQUEST_ID, null, naiCell.network, t2 - t0)
+        expectAddSatelliteEvent(inOrder, TEST_UID, NO_SERVICE_NETWORK, naiCell.network, t2 - t1)
+        verify(defaultNetworkRematchMetrics, atLeastOnce()).writeStatsAndClear()
+
+        // Make a UID list update to trigger the multilayer requests replacement:
+        //  1. Remove opt-in UID request for TEST_UID.
+        //  2. Create opt-in UID request for TEST_UID + TEST_UID2.
+        deps.elapsedRealtime = t3
+        updateSatelliteNetworkFallbackUids(setOf(), setOf(TEST_UID, TEST_UID2))
+        // The removed request reports nothing.
+        // TODO: Consider reports another event when the request is being removed.
+        //  Uncomment expectAddSatelliteEvent(inOrder, TEST_UID, naiCell.network, null, t3 - t2)
+        //  Or alternatively copy the satisfiedTime from the removed requests.
+        // The just created request satisfied by cell immediately.
+        expectAddSatelliteEvent(inOrder, TEST_UID, null, naiCell.network, 0)
+        inOrder.verify(defaultNetworkRematchMetrics, atLeastOnce()).writeStatsAndClear()
+        inOrder.verifyNoMoreInteractions()
+
+        deps.elapsedRealtime = t4
+        naiCell.disconnect()
+        // Wait for idle is needed to keep this test stable after disconnection because
+        // networkCallback<LOST> fired before addEvent.
+        waitForIdle()
+        // Verify: Disconnecting the default network should trigger writing the stats.
+        // The device reports cell satisfied for t4 - t3, with a transition null -> no service.
+        // This is because the original request is removed when updating the uid list and the
+        // duration is only calculated for the newly created request at t3.
+        expectAddEvent(inOrder, DEFAULT_REQUEST_ID, naiCell.network, null, t4 - t2)
+        expectAddSatelliteEvent(inOrder, TEST_UID, naiCell.network, null, t4 - t3)
+        inOrder.verify(defaultNetworkRematchMetrics).writeStatsAndClear(
+                DEFAULT_NETWORK_REMATCH__REMATCH_REASON__RMR_NETWORK_DISCONNECTED
         )
+        // Caused by rematch.
+        expectAddSatelliteEvent(inOrder, TEST_UID, null, NO_SERVICE_NETWORK, 0)
+        inOrder.verify(defaultNetworkRematchMetrics).writeStatsAndClear()
+        inOrder.verifyNoMoreInteractions()
     }
 }

From 2474cc54e30188d9fcc9067ed356df27a020a93b Mon Sep 17 00:00:00 2001
From: Jimi Chen <jimictw@google.com>
Date: Wed, 4 Jun 2025 13:54:44 +0000
Subject: [PATCH 363/377] Use multicast socket for group membership

Replace `ip addr` command with `multicastSocket` to join multicast groups.
This change improves robustness and directly leverages Java's networking capabilities for multicast management.

Flag: EXEMPT mainline
Bug: 419423721
Test: atest CtsConnectivityMultiDevicesTestCases:ApfV6Test
Change-Id: I2c941594985d98f86a4a91c9c9cd425eb75e8e97
---
 tests/cts/multidevices/apfv6_test.py          | 18 ++-----
 .../ConnectivityMultiDevicesSnippet.kt        | 51 +++++++++++++++++++
 2 files changed, 55 insertions(+), 14 deletions(-)

diff --git a/tests/cts/multidevices/apfv6_test.py b/tests/cts/multidevices/apfv6_test.py
index 6b71c48bd3..4512c2d3fe 100644
--- a/tests/cts/multidevices/apfv6_test.py
+++ b/tests/cts/multidevices/apfv6_test.py
@@ -147,14 +147,8 @@ class ApfV6Test(apf_test_base.ApfTestBase):
         expected_echo_reply,
     )
 
-  def is_running_as_root(self):
-    uid = adb_utils.adb_shell(self.clientDevice, 'id -u')
-    return uid == '0'
-
   @apf_utils.at_least_B()
   def test_igmpv3_general_query_offload(self):
-    if not self.is_running_as_root():
-      return
     # use unicast to replace multicast ether dst to prevent flaky due to DTIM skip
     ether = Ether(src=self.server_mac_address, dst=self.client_mac_address)
     ip = IP(
@@ -167,11 +161,9 @@ class ApfV6Test(apf_test_base.ApfTestBase):
 
     mcast_addrs = ['239.0.0.1', '239.0.0.2', '239.0.0.3']
 
+    self.client.createMulticastSocket(self.client_iface_name)
     for addr in mcast_addrs:
-      adb_utils.adb_shell(
-          self.clientDevice,
-          f'ip addr add {addr}/32 dev {self.client_iface_name} autojoin',
-      )
+      self.client.joinMulticastGroup(addr)
 
     ether = Ether(src=self.client_mac_address, dst='01:00:5e:00:00:16')
     ip = IP(
@@ -196,10 +188,8 @@ class ApfV6Test(apf_test_base.ApfTestBase):
       )
     finally:
       for addr in mcast_addrs:
-        adb_utils.adb_shell(
-            self.clientDevice,
-            f'ip addr del {addr}/32 dev {self.client_iface_name}',
-        )
+        self.client.leaveMulticastGroup(addr)
+      self.client.destroyMulticastSocket()
 
   @apf_utils.at_least_B()
   @apf_utils.apf_ram_at_least(3000)
diff --git a/tests/cts/multidevices/snippet/ConnectivityMultiDevicesSnippet.kt b/tests/cts/multidevices/snippet/ConnectivityMultiDevicesSnippet.kt
index feea1247fd..9f01abaf4f 100644
--- a/tests/cts/multidevices/snippet/ConnectivityMultiDevicesSnippet.kt
+++ b/tests/cts/multidevices/snippet/ConnectivityMultiDevicesSnippet.kt
@@ -47,6 +47,10 @@ import com.android.testutils.TestableNetworkCallback.Event.CapabilitiesChanged
 import com.android.testutils.runAsShell
 import com.google.android.mobly.snippet.Snippet
 import com.google.android.mobly.snippet.rpc.Rpc
+import java.net.InetAddress
+import java.net.InetSocketAddress
+import java.net.MulticastSocket
+import java.net.NetworkInterface
 import org.junit.Rule
 
 class ConnectivityMultiDevicesSnippet : Snippet {
@@ -60,6 +64,7 @@ class ConnectivityMultiDevicesSnippet : Snippet {
     private val cbHelper = NetworkCallbackHelper()
     private val ctsTetheringUtils = CtsTetheringUtils(context)
     private var oldSoftApConfig: SoftApConfiguration? = null
+    private var multicastSocket: MulticastSocket? = null
 
     override fun shutdown() {
         cbHelper.unregisterAll()
@@ -215,4 +220,50 @@ class ConnectivityMultiDevicesSnippet : Snippet {
             }
         }
     }
+
+    @Rpc(description = "Create multicast socket")
+    fun createMulticastSocket(ifname: String) {
+        if (multicastSocket != null) {
+            throw IllegalStateException("multicast socket is not null")
+        }
+
+        multicastSocket = MulticastSocket()
+        multicastSocket?.networkInterface = NetworkInterface.getByName(ifname)
+    }
+
+    @Rpc(description = "Destroy multicast socket")
+    fun destroyMulticastSocket() {
+        if (multicastSocket == null) {
+            throw IllegalStateException("multicast socket is null")
+        }
+
+        multicastSocket?.close()
+        multicastSocket = null
+    }
+
+    @Rpc(description = "Join multicast group")
+    fun joinMulticastGroup(multicastGroup: String) {
+        if (multicastSocket == null) {
+            throw IllegalStateException("multicast socket is null")
+        }
+
+        val groupToJoin = InetAddress.getByName(multicastGroup)
+        multicastSocket?.joinGroup(
+            InetSocketAddress(groupToJoin, 0),
+            multicastSocket?.networkInterface
+        )
+    }
+
+    @Rpc(description = "Leave multicast group")
+    fun leaveMulticastGroup(multicastGroup: String) {
+        if (multicastSocket == null) {
+            throw IllegalStateException("multicast socket is null")
+        }
+
+        val groupToLeave = InetAddress.getByName(multicastGroup)
+        multicastSocket?.leaveGroup(
+            InetSocketAddress(groupToLeave, 0),
+            multicastSocket?.networkInterface
+        )
+    }
 }

From f19ff514be05f2f5d05f0480a3713e831d69f8ff Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Wed, 4 Jun 2025 14:51:09 -0700
Subject: [PATCH 364/377] Pass EthernetPort into
 EthernetNetworkFactory#addInterface

Also removes @NonNull annotations (implied) and unnecessary final
specifier.

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I290ee07d63e224d45d744f1f00671e0ca4f57a1e
---
 .../ethernet/EthernetNetworkFactory.java      |  8 +-
 .../server/ethernet/EthernetTracker.java      |  2 +-
 .../ethernet/EthernetNetworkFactoryTest.java  | 78 +++++++++----------
 3 files changed, 43 insertions(+), 45 deletions(-)

diff --git a/service-t/src/com/android/server/ethernet/EthernetNetworkFactory.java b/service-t/src/com/android/server/ethernet/EthernetNetworkFactory.java
index 1ac99e4649..0f4f0e9261 100644
--- a/service-t/src/com/android/server/ethernet/EthernetNetworkFactory.java
+++ b/service-t/src/com/android/server/ethernet/EthernetNetworkFactory.java
@@ -144,9 +144,11 @@ public class EthernetNetworkFactory {
     }
 
     @VisibleForTesting(visibility = VisibleForTesting.Visibility.PACKAGE)
-    protected void addInterface(@NonNull final String ifaceName, @NonNull final String hwAddress,
-            @NonNull final IpConfiguration ipConfig,
-            @NonNull final NetworkCapabilities capabilities) {
+    protected void addInterface(EthernetPort port, IpConfiguration ipConfig,
+            NetworkCapabilities capabilities) {
+        final String ifaceName = port.getInterfaceName();
+        final String hwAddress = port.getMacAddress().toString();
+
         if (mTrackingInterfaces.containsKey(ifaceName)) {
             Log.e(TAG, "Interface with name " + ifaceName + " already exists.");
             return;
diff --git a/service-t/src/com/android/server/ethernet/EthernetTracker.java b/service-t/src/com/android/server/ethernet/EthernetTracker.java
index 672b146f4e..2151ae033a 100644
--- a/service-t/src/com/android/server/ethernet/EthernetTracker.java
+++ b/service-t/src/com/android/server/ethernet/EthernetTracker.java
@@ -703,7 +703,7 @@ public class EthernetTracker {
 
         IpConfiguration ipConfiguration = getOrCreateIpConfiguration(iface);
         Log.d(TAG, "Tracking interface in client mode: " + iface);
-        mFactory.addInterface(iface, hwAddress, ipConfiguration, nc);
+        mFactory.addInterface(port, ipConfiguration, nc);
 
         // Note: if the interface already has link (e.g., if we crashed and got
         // restarted while it was running), we need to fake a link up notification so we
diff --git a/tests/unit/java/com/android/server/ethernet/EthernetNetworkFactoryTest.java b/tests/unit/java/com/android/server/ethernet/EthernetNetworkFactoryTest.java
index 70d4ad8ce4..843e194a9d 100644
--- a/tests/unit/java/com/android/server/ethernet/EthernetNetworkFactoryTest.java
+++ b/tests/unit/java/com/android/server/ethernet/EthernetNetworkFactoryTest.java
@@ -40,6 +40,7 @@ import android.net.EthernetNetworkSpecifier;
 import android.net.IpConfiguration;
 import android.net.LinkAddress;
 import android.net.LinkProperties;
+import android.net.MacAddress;
 import android.net.Network;
 import android.net.NetworkAgentConfig;
 import android.net.NetworkCapabilities;
@@ -75,10 +76,11 @@ import java.util.Objects;
 @DevSdkIgnoreRule.IgnoreUpTo(Build.VERSION_CODES.S_V2)
 public class EthernetNetworkFactoryTest {
     private static final int TIMEOUT_MS = 2_000;
-    private static final String TEST_IFACE = "test123";
+    private static final String HW_ADDR = "01:02:03:04:05:06";
+    private static final EthernetPort TEST_IFACE =
+            new EthernetPort("test123", MacAddress.fromString(HW_ADDR), 42);
     private static final String IP_ADDR = "192.0.2.2/25";
     private static final LinkAddress LINK_ADDR = new LinkAddress(IP_ADDR);
-    private static final String HW_ADDR = "01:02:03:04:05:06";
     private TestLooper mLooper;
     private Handler mHandler;
     private EthernetNetworkFactory mNetFactory = null;
@@ -222,17 +224,17 @@ public class EthernetNetworkFactoryTest {
 
     // creates an interface with provisioning in progress (since updating the interface link state
     // automatically starts the provisioning process)
-    private void createInterfaceUndergoingProvisioning(String iface) {
+    private void createInterfaceUndergoingProvisioning(EthernetPort port) {
         // Default to the ethernet transport type.
-        createInterfaceUndergoingProvisioning(iface, NetworkCapabilities.TRANSPORT_ETHERNET);
+        createInterfaceUndergoingProvisioning(port, NetworkCapabilities.TRANSPORT_ETHERNET);
     }
 
     private void createInterfaceUndergoingProvisioning(
-            @NonNull final String iface, final int transportType) {
+            EthernetPort port, final int transportType) {
         final IpConfiguration ipConfig = createDefaultIpConfig();
-        mNetFactory.addInterface(iface, HW_ADDR, ipConfig,
+        mNetFactory.addInterface(port, ipConfig,
                 createInterfaceCapsBuilder(transportType).build());
-        assertTrue(mNetFactory.updateInterfaceLinkState(iface, true));
+        assertTrue(mNetFactory.updateInterfaceLinkState(port.getInterfaceName(), true));
 
         ArgumentCaptor<NetworkOfferCallback> captor = ArgumentCaptor.forClass(
                 NetworkOfferCallback.class);
@@ -248,9 +250,9 @@ public class EthernetNetworkFactoryTest {
     }
 
     // creates a provisioned interface
-    private void createAndVerifyProvisionedInterface(String iface) throws Exception {
+    private void createAndVerifyProvisionedInterface(EthernetPort port) throws Exception {
         // Default to the ethernet transport type.
-        createAndVerifyProvisionedInterface(iface, NetworkCapabilities.TRANSPORT_ETHERNET,
+        createAndVerifyProvisionedInterface(port, NetworkCapabilities.TRANSPORT_ETHERNET,
                 ConnectivityManager.TYPE_ETHERNET);
     }
 
@@ -258,13 +260,13 @@ public class EthernetNetworkFactoryTest {
             final int expectedLegacyType) throws Exception {
         createAndVerifyProvisionedInterface(TEST_IFACE, transportType,
                 expectedLegacyType);
-        mNetFactory.removeInterface(TEST_IFACE);
+        mNetFactory.removeInterface(TEST_IFACE.getInterfaceName());
     }
 
     private void createAndVerifyProvisionedInterface(
-            @NonNull final String iface, final int transportType, final int expectedLegacyType)
+            EthernetPort port, final int transportType, final int expectedLegacyType)
             throws Exception {
-        createInterfaceUndergoingProvisioning(iface, transportType);
+        createInterfaceUndergoingProvisioning(port, transportType);
         triggerOnProvisioningSuccess();
         // provisioning succeeded, verify that the network agent is created, registered, marked
         // as connected and legacy type are correctly set.
@@ -272,33 +274,21 @@ public class EthernetNetworkFactoryTest {
                 NetworkCapabilities.class);
         verify(mDeps).makeEthernetNetworkAgent(any(), any(), ncCaptor.capture(), any(),
                 argThat(x -> x.getLegacyType() == expectedLegacyType), any(), any());
-        assertEquals(
-                new EthernetNetworkSpecifier(iface), ncCaptor.getValue().getNetworkSpecifier());
+        assertEquals(new EthernetNetworkSpecifier(port.getInterfaceName()),
+                ncCaptor.getValue().getNetworkSpecifier());
         verifyNetworkAgentRegistersAndConnects();
         clearInvocations(mDeps);
         clearInvocations(mNetworkAgent);
     }
 
-    // creates an unprovisioned interface
-    private void createUnprovisionedInterface(String iface) throws Exception {
-        // To create an unprovisioned interface, provision and then "stop" it, i.e. stop its
-        // NetworkAgent and IpClient. One way this can be done is by provisioning an interface and
-        // then calling onNetworkUnwanted.
-        mNetFactory.addInterface(iface, HW_ADDR, createDefaultIpConfig(),
-                createInterfaceCapsBuilder(NetworkCapabilities.TRANSPORT_ETHERNET).build());
-        assertTrue(mNetFactory.updateInterfaceLinkState(iface, true));
-
-        clearInvocations(mIpClient);
-        clearInvocations(mNetworkAgent);
-    }
-
     @Test
     public void testUpdateInterfaceLinkStateForActiveProvisioningInterface() throws Exception {
         initEthernetNetworkFactory();
         createInterfaceUndergoingProvisioning(TEST_IFACE);
 
         // verify that the IpClient gets shut down when interface state changes to down.
-        final boolean ret = mNetFactory.updateInterfaceLinkState(TEST_IFACE, false /* up */);
+        final boolean ret =
+                mNetFactory.updateInterfaceLinkState(TEST_IFACE.getInterfaceName(), false /* up */);
 
         assertTrue(ret);
         verify(mIpClient).shutdown();
@@ -309,7 +299,8 @@ public class EthernetNetworkFactoryTest {
         initEthernetNetworkFactory();
 
         // if interface was never added, link state cannot be updated.
-        final boolean ret = mNetFactory.updateInterfaceLinkState(TEST_IFACE, true /* up */);
+        final boolean ret =
+                mNetFactory.updateInterfaceLinkState(TEST_IFACE.getInterfaceName(), true /* up */);
 
         assertFalse(ret);
         verifyNoStopOrStart();
@@ -318,7 +309,8 @@ public class EthernetNetworkFactoryTest {
     @Test
     public void testProvisioningLoss() throws Exception {
         initEthernetNetworkFactory();
-        when(mDeps.getNetworkInterfaceByName(TEST_IFACE)).thenReturn(mInterfaceParams);
+        when(mDeps.getNetworkInterfaceByName(TEST_IFACE.getInterfaceName()))
+                .thenReturn(mInterfaceParams);
         createAndVerifyProvisionedInterface(TEST_IFACE);
 
         triggerOnProvisioningFailure();
@@ -331,7 +323,7 @@ public class EthernetNetworkFactoryTest {
     public void testProvisioningLossForDisappearedInterface() throws Exception {
         initEthernetNetworkFactory();
         // mocked method returns null by default, but just to be explicit in the test:
-        when(mDeps.getNetworkInterfaceByName(eq(TEST_IFACE))).thenReturn(null);
+        when(mDeps.getNetworkInterfaceByName(eq(TEST_IFACE.getInterfaceName()))).thenReturn(null);
 
         createAndVerifyProvisionedInterface(TEST_IFACE);
         triggerOnProvisioningFailure();
@@ -362,7 +354,8 @@ public class EthernetNetworkFactoryTest {
     public void testNetworkUnwantedWithStaleNetworkAgent() throws Exception {
         initEthernetNetworkFactory();
         // ensures provisioning is restarted after provisioning loss
-        when(mDeps.getNetworkInterfaceByName(TEST_IFACE)).thenReturn(mInterfaceParams);
+        when(mDeps.getNetworkInterfaceByName(TEST_IFACE.getInterfaceName()))
+                .thenReturn(mInterfaceParams);
         createAndVerifyProvisionedInterface(TEST_IFACE);
 
         EthernetNetworkAgent.Callbacks oldCbs = mNetworkAgent.getCallbacks();
@@ -417,7 +410,7 @@ public class EthernetNetworkFactoryTest {
     private IpClientCallbacks getStaleIpClientCallbacks() throws Exception {
         createAndVerifyProvisionedInterface(TEST_IFACE);
         final IpClientCallbacks staleIpClientCallbacks = mIpClientCallbacks;
-        mNetFactory.removeInterface(TEST_IFACE);
+        mNetFactory.removeInterface(TEST_IFACE.getInterfaceName());
         verifyStop();
         assertNotSame(mIpClientCallbacks, staleIpClientCallbacks);
         return staleIpClientCallbacks;
@@ -438,7 +431,8 @@ public class EthernetNetworkFactoryTest {
     @Test
     public void testIgnoreOnIpLayerStoppedCallbackForStaleCallback() throws Exception {
         initEthernetNetworkFactory();
-        when(mDeps.getNetworkInterfaceByName(TEST_IFACE)).thenReturn(mInterfaceParams);
+        when(mDeps.getNetworkInterfaceByName(TEST_IFACE.getInterfaceName()))
+                .thenReturn(mInterfaceParams);
         final IpClientCallbacks staleIpClientCallbacks = getStaleIpClientCallbacks();
 
         staleIpClientCallbacks.onProvisioningFailure(new LinkProperties());
@@ -500,7 +494,7 @@ public class EthernetNetworkFactoryTest {
         final NetworkCapabilities capabilities = createDefaultFilterCaps();
         final IpConfiguration ipConfiguration = createStaticIpConfig();
 
-        mNetFactory.updateInterface(TEST_IFACE, ipConfiguration, capabilities);
+        mNetFactory.updateInterface(TEST_IFACE.getInterfaceName(), ipConfiguration, capabilities);
         triggerOnProvisioningSuccess();
 
         verify(mDeps).makeEthernetNetworkAgent(any(), any(),
@@ -515,7 +509,7 @@ public class EthernetNetworkFactoryTest {
         final NetworkCapabilities capabilities = createDefaultFilterCaps();
         final IpConfiguration ipConfiguration = createStaticIpConfig();
 
-        mNetFactory.updateInterface(TEST_IFACE, ipConfiguration, capabilities);
+        mNetFactory.updateInterface(TEST_IFACE.getInterfaceName(), ipConfiguration, capabilities);
 
         verifyNoStopOrStart();
     }
@@ -526,7 +520,8 @@ public class EthernetNetworkFactoryTest {
         createAndVerifyProvisionedInterface(TEST_IFACE);
 
         final IpConfiguration initialIpConfig = createStaticIpConfig();
-        mNetFactory.updateInterface(TEST_IFACE, initialIpConfig, null /*capabilities*/);
+        mNetFactory.updateInterface(TEST_IFACE.getInterfaceName(), initialIpConfig,
+                null /*capabilities*/);
 
         triggerOnProvisioningSuccess();
         verifyRestart(initialIpConfig);
@@ -538,7 +533,8 @@ public class EthernetNetworkFactoryTest {
 
 
         // verify that sending a null ipConfig does not update the current ipConfig.
-        mNetFactory.updateInterface(TEST_IFACE, null /*ipConfig*/, null /*capabilities*/);
+        mNetFactory.updateInterface(TEST_IFACE.getInterfaceName(), null /*ipConfig*/,
+                null /*capabilities*/);
         triggerOnProvisioningSuccess();
         verifyRestart(initialIpConfig);
     }
@@ -547,7 +543,7 @@ public class EthernetNetworkFactoryTest {
     public void testOnNetworkNeededOnStaleNetworkOffer() throws Exception {
         initEthernetNetworkFactory();
         createAndVerifyProvisionedInterface(TEST_IFACE);
-        mNetFactory.updateInterfaceLinkState(TEST_IFACE, false);
+        mNetFactory.updateInterfaceLinkState(TEST_IFACE.getInterfaceName(), false);
         verify(mNetworkProvider).unregisterNetworkOffer(mNetworkOfferCallback);
         // It is possible that even after a network offer is unregistered, CS still sends it
         // onNetworkNeeded() callbacks.
@@ -560,7 +556,7 @@ public class EthernetNetworkFactoryTest {
         initEthernetNetworkFactory();
         createAndVerifyProvisionedInterface(TEST_IFACE);
 
-        final String result = mNetFactory.getHwAddress(TEST_IFACE);
+        final String result = mNetFactory.getHwAddress(TEST_IFACE.getInterfaceName());
         assertEquals(HW_ADDR, result);
     }
 
@@ -568,7 +564,7 @@ public class EthernetNetworkFactoryTest {
     public void testGetMacAddressForNonExistingInterface() {
         initEthernetNetworkFactory();
 
-        final String result = mNetFactory.getHwAddress(TEST_IFACE);
+        final String result = mNetFactory.getHwAddress(TEST_IFACE.getInterfaceName());
         // No interface exists due to not calling createAndVerifyProvisionedInterface(...).
         assertNull(result);
     }

From d8f56bd60018c22f243c37331d749946753f2274 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Thu, 5 Jun 2025 11:40:16 -0700
Subject: [PATCH 365/377] Pass EthernetPort into NetworkInterfaceState

mPort replaces name and mHwAddress.

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: If1b887540c3f0b81cd071cc18ae950dd1f628ba6
---
 .../ethernet/EthernetNetworkFactory.java      | 49 ++++++++++---------
 1 file changed, 26 insertions(+), 23 deletions(-)

diff --git a/service-t/src/com/android/server/ethernet/EthernetNetworkFactory.java b/service-t/src/com/android/server/ethernet/EthernetNetworkFactory.java
index 0f4f0e9261..9939b1d1f4 100644
--- a/service-t/src/com/android/server/ethernet/EthernetNetworkFactory.java
+++ b/service-t/src/com/android/server/ethernet/EthernetNetworkFactory.java
@@ -136,10 +136,12 @@ public class EthernetNetworkFactory {
                 .stream()
                 .filter(iface -> !iface.isRestricted() || includeRestricted)
                 .sorted((iface1, iface2) -> {
-                    int r = Boolean.compare(iface1.isRestricted(), iface2.isRestricted());
-                    return r == 0 ? iface1.name.compareTo(iface2.name) : r;
+                    final int r = Boolean.compare(iface1.isRestricted(), iface2.isRestricted());
+                    final String ifname1 = iface1.getPort().getInterfaceName();
+                    final String ifname2 = iface2.getPort().getInterfaceName();
+                    return r == 0 ? ifname1.compareTo(ifname2) : r;
                 })
-                .map(iface -> iface.name)
+                .map(iface -> iface.getPort().getInterfaceName())
                 .toArray(String[]::new);
     }
 
@@ -163,7 +165,7 @@ public class EthernetNetworkFactory {
         }
 
         final NetworkInterfaceState iface = new NetworkInterfaceState(
-                ifaceName, hwAddress, mHandler, mContext, ipConfig, nc, mProvider, mDeps);
+                port, mHandler, mContext, ipConfig, nc, mProvider, mDeps);
         mTrackingInterfaces.put(ifaceName, iface);
     }
 
@@ -246,14 +248,12 @@ public class EthernetNetworkFactory {
         }
 
         NetworkInterfaceState iface = mTrackingInterfaces.get(ifaceName);
-        return iface.mHwAddress;
+        return iface.getPort().getMacAddress().toString();
     }
 
     @VisibleForTesting
     static class NetworkInterfaceState {
-        final String name;
-
-        private final String mHwAddress;
+        private final EthernetPort mPort;
         private final Handler mHandler;
         private final Context mContext;
         private final NetworkProvider mNetworkProvider;
@@ -365,7 +365,7 @@ public class EthernetNetworkFactory {
                     return;
                 }
                 if (DBG) {
-                    Log.d(TAG, String.format("%s: onNetworkNeeded for request: %s", name, request));
+                    Log.d(TAG, String.format("%s: onNetworkNeeded: %s", mPort, request));
                 }
                 // When the network offer is first registered, onNetworkNeeded is called with all
                 // existing requests.
@@ -382,8 +382,7 @@ public class EthernetNetworkFactory {
                     return;
                 }
                 if (DBG) {
-                    Log.d(TAG,
-                            String.format("%s: onNetworkUnneeded for request: %s", name, request));
+                    Log.d(TAG, String.format("%s: onNetworkUnneeded: %s", mPort, request));
                 }
                 if (!mRequestIds.remove(request.requestId)) {
                     // This can only happen if onNetworkNeeded was not called for a request or if
@@ -397,10 +396,10 @@ public class EthernetNetworkFactory {
             }
         }
 
-        NetworkInterfaceState(String ifaceName, String hwAddress, Handler handler, Context context,
+        NetworkInterfaceState(EthernetPort port, Handler handler, Context context,
                 @NonNull IpConfiguration ipConfig, @NonNull NetworkCapabilities capabilities,
                 NetworkProvider networkProvider, Dependencies deps) {
-            name = ifaceName;
+            mPort = port;
             mIpConfig = Objects.requireNonNull(ipConfig);
             mCapabilities = Objects.requireNonNull(capabilities);
             mLegacyType = getLegacyType(mCapabilities);
@@ -408,7 +407,11 @@ public class EthernetNetworkFactory {
             mContext = context;
             mNetworkProvider = networkProvider;
             mDeps = deps;
-            mHwAddress = hwAddress;
+        }
+
+        /** Returns the EthernetPort object */
+        public EthernetPort getPort() {
+            return mPort;
         }
 
         /**
@@ -448,7 +451,7 @@ public class EthernetNetworkFactory {
         void updateInterface(@Nullable final IpConfiguration ipConfig,
                 @Nullable final NetworkCapabilities capabilities) {
             if (DBG) {
-                Log.d(TAG, "updateInterface, iface: " + name
+                Log.d(TAG, "updateInterface, port: " + mPort
                         + ", ipConfig: " + ipConfig + ", old ipConfig: " + mIpConfig
                         + ", capabilities: " + capabilities + ", old capabilities: " + mCapabilities
                 );
@@ -476,11 +479,11 @@ public class EthernetNetworkFactory {
                 return;
             }
             if (DBG) {
-                Log.d(TAG, String.format("Starting Ethernet IpClient(%s)", name));
+                Log.d(TAG, String.format("Starting Ethernet IpClient(%s)", mPort));
             }
 
             mIpClientCallback = new EthernetIpClientCallback();
-            mDeps.makeIpClient(mContext, name, mIpClientCallback);
+            mDeps.makeIpClient(mContext, mPort.getInterfaceName(), mIpClientCallback);
             mIpClientCallback.awaitIpClientStart();
 
             if (mIpConfig.getProxySettings() == ProxySettings.STATIC
@@ -510,7 +513,7 @@ public class EthernetNetworkFactory {
             final NetworkAgentConfig config = new NetworkAgentConfig.Builder()
                     .setLegacyType(mLegacyType)
                     .setLegacyTypeName(NETWORK_TYPE)
-                    .setLegacyExtraInfo(mHwAddress)
+                    .setLegacyExtraInfo(mPort.getMacAddress().toString())
                     .build();
             mNetworkAgent = mDeps.makeEthernetNetworkAgent(mContext, mHandler.getLooper(),
                     mCapabilities, mLinkProperties, config, mNetworkProvider,
@@ -536,8 +539,9 @@ public class EthernetNetworkFactory {
             // There is no point in continuing if the interface is gone as stop() will be triggered
             // by removeInterface() when processed on the handler thread and start() won't
             // work for a non-existent interface.
-            if (null == mDeps.getNetworkInterfaceByName(name)) {
-                if (DBG) Log.d(TAG, name + " is no longer available.");
+            // TODO: consider removing this functionality entirely and maybeRestart() regardless.
+            if (null == mDeps.getNetworkInterfaceByName(mPort.getInterfaceName())) {
+                if (DBG) Log.d(TAG, mPort + " is no longer available.");
                 // Send a callback in case a provisioning request was in progress.
                 return;
             }
@@ -646,7 +650,7 @@ public class EthernetNetworkFactory {
                 // possible that link disappeared in the meantime. In that
                 // case, stop() has already been called and IpClient should not
                 // get restarted to prevent a provisioning failure loop.
-                Log.i(TAG, String.format("maybeRestart() called on stopped interface %s", name));
+                Log.i(TAG, String.format("maybeRestart() called on stopped interface %s", mPort));
                 return;
             }
             if (DBG) Log.d(TAG, "restart IpClient");
@@ -657,9 +661,8 @@ public class EthernetNetworkFactory {
         @Override
         public String toString() {
             return getClass().getSimpleName() + "{ "
-                    + "iface: " + name + ", "
+                    + "port: " + mPort + ", "
                     + "up: " + mLinkUp + ", "
-                    + "hwAddress: " + mHwAddress + ", "
                     + "networkCapabilities: " + mCapabilities + ", "
                     + "networkAgent: " + mNetworkAgent + ", "
                     + "ipClient: " + mIpClient + ","

From 30b9d147807aa08d602facd58887a85a79d6cf7a Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Thu, 5 Jun 2025 12:30:02 -0700
Subject: [PATCH 366/377] Rename getAvailableInterfaces to getInterfacesSorted

The next change will add a getInterfaces() method which returns the
interfaces in any order.

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: Ic1a6e60d8a7e74a6d46e569f0d9045849fd0f8ed
---
 .../com/android/server/ethernet/EthernetNetworkFactory.java   | 3 +--
 .../src/com/android/server/ethernet/EthernetTracker.java      | 4 ++--
 .../java/com/android/server/ethernet/EthernetTrackerTest.java | 2 +-
 3 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/service-t/src/com/android/server/ethernet/EthernetNetworkFactory.java b/service-t/src/com/android/server/ethernet/EthernetNetworkFactory.java
index 9939b1d1f4..1b9f720210 100644
--- a/service-t/src/com/android/server/ethernet/EthernetNetworkFactory.java
+++ b/service-t/src/com/android/server/ethernet/EthernetNetworkFactory.java
@@ -130,8 +130,7 @@ public class EthernetNetworkFactory {
      * Returns an array of available interface names. The array is sorted: unrestricted interfaces
      * goes first, then sorted by name.
      */
-    @VisibleForTesting(visibility = VisibleForTesting.Visibility.PACKAGE)
-    protected String[] getAvailableInterfaces(boolean includeRestricted) {
+    public String[] getInterfacesSorted(boolean includeRestricted) {
         return mTrackingInterfaces.values()
                 .stream()
                 .filter(iface -> !iface.isRestricted() || includeRestricted)
diff --git a/service-t/src/com/android/server/ethernet/EthernetTracker.java b/service-t/src/com/android/server/ethernet/EthernetTracker.java
index 2151ae033a..44197f7427 100644
--- a/service-t/src/com/android/server/ethernet/EthernetTracker.java
+++ b/service-t/src/com/android/server/ethernet/EthernetTracker.java
@@ -459,7 +459,7 @@ public class EthernetTracker {
 
     private List<String> getAllInterfaces() {
         final ArrayList<String> interfaces = new ArrayList<>(
-                List.of(mFactory.getAvailableInterfaces(/* includeRestricted */ true)));
+                List.of(mFactory.getInterfacesSorted(/* includeRestricted */ true)));
 
         if (mTetheringInterfaceMode == INTERFACE_MODE_SERVER && mTetheringInterface != null) {
             interfaces.add(mTetheringInterface.getInterfaceName());
@@ -468,7 +468,7 @@ public class EthernetTracker {
     }
 
     String[] getClientModeInterfaces(boolean includeRestricted) {
-        return mFactory.getAvailableInterfaces(includeRestricted);
+        return mFactory.getInterfacesSorted(includeRestricted);
     }
 
     List<String> getEthernetInterfaceList() {
diff --git a/tests/unit/java/com/android/server/ethernet/EthernetTrackerTest.java b/tests/unit/java/com/android/server/ethernet/EthernetTrackerTest.java
index def064a03f..5013d78c31 100644
--- a/tests/unit/java/com/android/server/ethernet/EthernetTrackerTest.java
+++ b/tests/unit/java/com/android/server/ethernet/EthernetTrackerTest.java
@@ -79,7 +79,7 @@ public class EthernetTrackerTest {
         initMockResources();
         doReturn(false).when(mFactory).updateInterfaceLinkState(anyString(), anyBoolean());
         doReturn(new String[0]).when(mNetd).interfaceGetList();
-        doReturn(new String[0]).when(mFactory).getAvailableInterfaces(anyBoolean());
+        doReturn(new String[0]).when(mFactory).getInterfacesSorted(anyBoolean());
         mHandlerThread = new HandlerThread(THREAD_NAME);
         mHandlerThread.start();
         tracker = new EthernetTracker(mContext, mHandlerThread.getThreadHandler(), mFactory, mNetd,

From 33782457b625e9587fcb7d850b6a2e6449b11c4c Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Thu, 5 Jun 2025 12:36:03 -0700
Subject: [PATCH 367/377] Rename getClientModeInterfaces to
 getClientModeInterfacesSorted

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: Id33fb7200bc5927e05dfdd9926c392e973c1e58b
---
 .../src/com/android/server/ethernet/EthernetServiceImpl.java  | 2 +-
 .../src/com/android/server/ethernet/EthernetTracker.java      | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/service-t/src/com/android/server/ethernet/EthernetServiceImpl.java b/service-t/src/com/android/server/ethernet/EthernetServiceImpl.java
index 21b9b1d850..3126e48afe 100644
--- a/service-t/src/com/android/server/ethernet/EthernetServiceImpl.java
+++ b/service-t/src/com/android/server/ethernet/EthernetServiceImpl.java
@@ -94,7 +94,7 @@ public class EthernetServiceImpl extends IEthernetManager.Stub {
     @Override
     public String[] getAvailableInterfaces() throws RemoteException {
         PermissionUtils.enforceAccessNetworkStatePermission(mContext, TAG);
-        return mTracker.getClientModeInterfaces(hasUseRestrictedNetworksPermission());
+        return mTracker.getClientModeInterfacesSorted(hasUseRestrictedNetworksPermission());
     }
 
     /**
diff --git a/service-t/src/com/android/server/ethernet/EthernetTracker.java b/service-t/src/com/android/server/ethernet/EthernetTracker.java
index 44197f7427..11912eaa0b 100644
--- a/service-t/src/com/android/server/ethernet/EthernetTracker.java
+++ b/service-t/src/com/android/server/ethernet/EthernetTracker.java
@@ -467,7 +467,7 @@ public class EthernetTracker {
         return interfaces;
     }
 
-    String[] getClientModeInterfaces(boolean includeRestricted) {
+    String[] getClientModeInterfacesSorted(boolean includeRestricted) {
         return mFactory.getInterfacesSorted(includeRestricted);
     }
 
@@ -511,7 +511,7 @@ public class EthernetTracker {
                 // Remote process has already died
                 return;
             }
-            for (String iface : getClientModeInterfaces(canUseRestrictedNetworks)) {
+            for (String iface : getClientModeInterfacesSorted(canUseRestrictedNetworks)) {
                 unicastInterfaceStateChange(listener, iface);
             }
             if (mTetheringInterface != null && mTetheringInterfaceMode == INTERFACE_MODE_SERVER) {

From 92077d1530112f7af0330ca70148c96e36047b08 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Thu, 5 Jun 2025 14:02:07 -0700
Subject: [PATCH 368/377] Add getEthernetPorts and use it in getAllInterfaces

This CL adds getEthernetPorts() to EthernetNetworkFactory which returns
an unsorted list of EthernetPorts tracked by the factory (including
restricted interfaces).

This method is then used inside getAllInterfaces(), which in turn is
called by setIncludeTestInterfaces() and setEthernetEnabled().
setIncludeTestInterfaces() is not used in production code, so the
interface order should not matter. However, with this change
setEthernetEnabled() will update the administrative state of the network
interfaces in unspecified order. It is hard to conceive that this could
break anything, given that when tracking multiple interfaces, link state
changes (which trigger the same InterfaceStateCallback) can already
naturally occur in any order.

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: Iaf6810ec2fd784c16a9a09662282e81bc2070e37
---
 .../server/ethernet/EthernetNetworkFactory.java  | 13 +++++++++++++
 .../android/server/ethernet/EthernetTracker.java | 16 ++++++++--------
 2 files changed, 21 insertions(+), 8 deletions(-)

diff --git a/service-t/src/com/android/server/ethernet/EthernetNetworkFactory.java b/service-t/src/com/android/server/ethernet/EthernetNetworkFactory.java
index 1b9f720210..14193dfd56 100644
--- a/service-t/src/com/android/server/ethernet/EthernetNetworkFactory.java
+++ b/service-t/src/com/android/server/ethernet/EthernetNetworkFactory.java
@@ -52,6 +52,8 @@ import com.android.net.module.util.InterfaceParams;
 import com.android.server.connectivity.ConnectivityResources;
 
 import java.io.FileDescriptor;
+import java.util.ArrayList;
+import java.util.List;
 import java.util.Objects;
 import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
@@ -126,6 +128,17 @@ public class EthernetNetworkFactory {
         mContext.getSystemService(ConnectivityManager.class).registerNetworkProvider(mProvider);
     }
 
+    /** Returns an unordered(!) list of EthernetPort objects tracked by this factory. */
+    public List<EthernetPort> getEthernetPorts() {
+        // Note that while mTrackingInterfaces is a ConcurrentHashMap, it is only ever modified on
+        // the handler thread.
+        final List<EthernetPort> ports = new ArrayList<>(mTrackingInterfaces.size());
+        for (NetworkInterfaceState iface : mTrackingInterfaces.values()) {
+            ports.add(iface.getPort());
+        }
+        return ports;
+    }
+
     /**
      * Returns an array of available interface names. The array is sorted: unrestricted interfaces
      * goes first, then sorted by name.
diff --git a/service-t/src/com/android/server/ethernet/EthernetTracker.java b/service-t/src/com/android/server/ethernet/EthernetTracker.java
index 11912eaa0b..1460b23512 100644
--- a/service-t/src/com/android/server/ethernet/EthernetTracker.java
+++ b/service-t/src/com/android/server/ethernet/EthernetTracker.java
@@ -457,12 +457,11 @@ public class EthernetTracker {
         return mFactory.hasInterface(iface);
     }
 
-    private List<String> getAllInterfaces() {
-        final ArrayList<String> interfaces = new ArrayList<>(
-                List.of(mFactory.getInterfacesSorted(/* includeRestricted */ true)));
-
+    /** Returns an unordered(!) list of tracked EthernetPort objects. */
+    private List<EthernetPort> getAllInterfaces() {
+        final List<EthernetPort> interfaces = new ArrayList<>(mFactory.getEthernetPorts());
         if (mTetheringInterfaceMode == INTERFACE_MODE_SERVER && mTetheringInterface != null) {
-            interfaces.add(mTetheringInterface.getInterfaceName());
+            interfaces.add(mTetheringInterface);
         }
         return interfaces;
     }
@@ -534,7 +533,8 @@ public class EthernetTracker {
             } else {
                 removeTestData();
                 // remove all test interfaces
-                for (String iface : getAllInterfaces()) {
+                for (EthernetPort port : getAllInterfaces()) {
+                    final String iface = port.getInterfaceName();
                     if (shouldTrackInterface(iface)) continue;
                     stopTrackingInterface(iface);
                 }
@@ -864,8 +864,8 @@ public class EthernetTracker {
             if (mIsEthernetEnabled == enabled) return;
 
             mIsEthernetEnabled = enabled;
-            for (String iface : getAllInterfaces()) {
-                setInterfaceUpState(iface, enabled);
+            for (EthernetPort port : getAllInterfaces()) {
+                setInterfaceUpState(port.getInterfaceName(), enabled);
             }
             broadcastEthernetStateChange(mIsEthernetEnabled);
         });

From 88fdbf3093add71eca307bc75eea7a2c54de04ec Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Thu, 5 Jun 2025 14:11:17 -0700
Subject: [PATCH 369/377] Pass EthernetPort to stopTrackingInterface

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: Ia96d35041cbfedb3fd4f67d43bb7238bfdd86d40
---
 .../src/com/android/server/ethernet/EthernetTracker.java   | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/service-t/src/com/android/server/ethernet/EthernetTracker.java b/service-t/src/com/android/server/ethernet/EthernetTracker.java
index 1460b23512..ab4396584a 100644
--- a/service-t/src/com/android/server/ethernet/EthernetTracker.java
+++ b/service-t/src/com/android/server/ethernet/EthernetTracker.java
@@ -238,7 +238,7 @@ public class EthernetTracker {
 
         private void onDelLink(EthernetPort port) {
             Log.i(TAG, "onInterfaceRemoved: " + port);
-            stopTrackingInterface(port.getInterfaceName());
+            stopTrackingInterface(port);
         }
 
         private void processRtNetlinkLinkMessage(RtNetlinkLinkMessage msg) {
@@ -536,7 +536,7 @@ public class EthernetTracker {
                 for (EthernetPort port : getAllInterfaces()) {
                     final String iface = port.getInterfaceName();
                     if (shouldTrackInterface(iface)) continue;
-                    stopTrackingInterface(iface);
+                    stopTrackingInterface(port);
                 }
             }
         });
@@ -654,7 +654,8 @@ public class EthernetTracker {
         maybeUpdateServerModeInterfaceState(iface, false);
     }
 
-    private void stopTrackingInterface(String iface) {
+    private void stopTrackingInterface(EthernetPort port) {
+        final String iface = port.getInterfaceName();
         removeInterface(iface);
         if (mTetheringInterface != null && iface.equals(mTetheringInterface.getInterfaceName())) {
             mTetheringInterface = null;

From d5159a9c5ffb57aef21e206b7a1df57b03ccb6a8 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Thu, 5 Jun 2025 14:14:08 -0700
Subject: [PATCH 370/377] Pass EthernetPort to removeInterface

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I4fd6658e95d65c65dad95b0a28f6878e4f5119fd
---
 .../src/com/android/server/ethernet/EthernetTracker.java   | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/service-t/src/com/android/server/ethernet/EthernetTracker.java b/service-t/src/com/android/server/ethernet/EthernetTracker.java
index ab4396584a..7d581f8697 100644
--- a/service-t/src/com/android/server/ethernet/EthernetTracker.java
+++ b/service-t/src/com/android/server/ethernet/EthernetTracker.java
@@ -610,7 +610,7 @@ public class EthernetTracker {
         Log.d(TAG, "Setting tethering interface mode to " + mode);
         mTetheringInterfaceMode = mode;
         if (mTetheringInterface != null) {
-            removeInterface(mTetheringInterface.getInterfaceName());
+            removeInterface(mTetheringInterface);
             addInterface(mTetheringInterface);
             // when this broadcast is sent, any calls to notifyTetheredInterfaceAvailable or
             // notifyTetheredInterfaceUnavailable have already happened
@@ -649,14 +649,15 @@ public class EthernetTracker {
         return INTERFACE_MODE_CLIENT;
     }
 
-    private void removeInterface(String iface) {
+    private void removeInterface(EthernetPort port) {
+        final String iface = port.getInterfaceName();
         mFactory.removeInterface(iface);
         maybeUpdateServerModeInterfaceState(iface, false);
     }
 
     private void stopTrackingInterface(EthernetPort port) {
+        removeInterface(port);
         final String iface = port.getInterfaceName();
-        removeInterface(iface);
         if (mTetheringInterface != null && iface.equals(mTetheringInterface.getInterfaceName())) {
             mTetheringInterface = null;
             mTetheringInterfaceHwAddr = null;

From 345876e1192eec418cd505e61620505b83944387 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Thu, 5 Jun 2025 14:17:22 -0700
Subject: [PATCH 371/377] Pass EthernetPort to
 EthernetNetworkFactory#removeInterface

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: Iba1dfdba7f249013da0946bfe9738f110f95391e
---
 .../android/server/ethernet/EthernetNetworkFactory.java   | 8 ++++----
 .../src/com/android/server/ethernet/EthernetTracker.java  | 5 ++---
 .../server/ethernet/EthernetNetworkFactoryTest.java       | 4 ++--
 3 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/service-t/src/com/android/server/ethernet/EthernetNetworkFactory.java b/service-t/src/com/android/server/ethernet/EthernetNetworkFactory.java
index 14193dfd56..16652ca291 100644
--- a/service-t/src/com/android/server/ethernet/EthernetNetworkFactory.java
+++ b/service-t/src/com/android/server/ethernet/EthernetNetworkFactory.java
@@ -218,9 +218,9 @@ public class EthernetNetworkFactory {
         return;
     }
 
-    @VisibleForTesting(visibility = VisibleForTesting.Visibility.PACKAGE)
-    protected boolean removeInterface(String interfaceName) {
-        NetworkInterfaceState iface = mTrackingInterfaces.remove(interfaceName);
+    /** Removes the interface from the factory and returns whether the interface was tracked */
+    public boolean removeInterface(EthernetPort port) {
+        NetworkInterfaceState iface = mTrackingInterfaces.remove(port.getInterfaceName());
         if (iface != null) {
             iface.unregisterNetworkOfferAndStop();
             return true;
@@ -228,7 +228,7 @@ public class EthernetNetworkFactory {
         // TODO(b/236892130): if an interface is currently in server mode, it may not be properly
         // removed.
         // TODO: when false is returned, do not send a STATE_ABSENT callback.
-        Log.w(TAG, interfaceName + " is not tracked and cannot be removed");
+        Log.w(TAG, "removeInterface() failed because port is not tracked " + port);
         return false;
     }
 
diff --git a/service-t/src/com/android/server/ethernet/EthernetTracker.java b/service-t/src/com/android/server/ethernet/EthernetTracker.java
index 7d581f8697..aeabc30780 100644
--- a/service-t/src/com/android/server/ethernet/EthernetTracker.java
+++ b/service-t/src/com/android/server/ethernet/EthernetTracker.java
@@ -650,9 +650,8 @@ public class EthernetTracker {
     }
 
     private void removeInterface(EthernetPort port) {
-        final String iface = port.getInterfaceName();
-        mFactory.removeInterface(iface);
-        maybeUpdateServerModeInterfaceState(iface, false);
+        mFactory.removeInterface(port);
+        maybeUpdateServerModeInterfaceState(port.getInterfaceName(), false);
     }
 
     private void stopTrackingInterface(EthernetPort port) {
diff --git a/tests/unit/java/com/android/server/ethernet/EthernetNetworkFactoryTest.java b/tests/unit/java/com/android/server/ethernet/EthernetNetworkFactoryTest.java
index 843e194a9d..292803183c 100644
--- a/tests/unit/java/com/android/server/ethernet/EthernetNetworkFactoryTest.java
+++ b/tests/unit/java/com/android/server/ethernet/EthernetNetworkFactoryTest.java
@@ -260,7 +260,7 @@ public class EthernetNetworkFactoryTest {
             final int expectedLegacyType) throws Exception {
         createAndVerifyProvisionedInterface(TEST_IFACE, transportType,
                 expectedLegacyType);
-        mNetFactory.removeInterface(TEST_IFACE.getInterfaceName());
+        mNetFactory.removeInterface(TEST_IFACE);
     }
 
     private void createAndVerifyProvisionedInterface(
@@ -410,7 +410,7 @@ public class EthernetNetworkFactoryTest {
     private IpClientCallbacks getStaleIpClientCallbacks() throws Exception {
         createAndVerifyProvisionedInterface(TEST_IFACE);
         final IpClientCallbacks staleIpClientCallbacks = mIpClientCallbacks;
-        mNetFactory.removeInterface(TEST_IFACE.getInterfaceName());
+        mNetFactory.removeInterface(TEST_IFACE);
         verifyStop();
         assertNotSame(mIpClientCallbacks, staleIpClientCallbacks);
         return staleIpClientCallbacks;

From 8191dd61c3ab91e4c66a337d31029511668ef5d5 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Thu, 5 Jun 2025 14:42:18 -0700
Subject: [PATCH 372/377] Remove spurious VisibleForTesting and change
 visibility to public

The visibility modifiers in this file are all over the place. In
general, I would like to get to private / public where possible so the
code becomes more readable.

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I2fb00abfd903083e0320fe33eeff2d40302440c7
---
 .../com/android/server/ethernet/EthernetNetworkFactory.java   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/service-t/src/com/android/server/ethernet/EthernetNetworkFactory.java b/service-t/src/com/android/server/ethernet/EthernetNetworkFactory.java
index 16652ca291..2c8fb895dc 100644
--- a/service-t/src/com/android/server/ethernet/EthernetNetworkFactory.java
+++ b/service-t/src/com/android/server/ethernet/EthernetNetworkFactory.java
@@ -157,8 +157,8 @@ public class EthernetNetworkFactory {
                 .toArray(String[]::new);
     }
 
-    @VisibleForTesting(visibility = VisibleForTesting.Visibility.PACKAGE)
-    protected void addInterface(EthernetPort port, IpConfiguration ipConfig,
+    /** Add an interface to the factory. */
+    public void addInterface(EthernetPort port, IpConfiguration ipConfig,
             NetworkCapabilities capabilities) {
         final String ifaceName = port.getInterfaceName();
         final String hwAddress = port.getMacAddress().toString();

From ff317e73efb28c08305154d482503e4dd40d446e Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Thu, 5 Jun 2025 14:47:19 -0700
Subject: [PATCH 373/377] Pass EthernetPort to updateInterfaceState

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: Id0c9cc4fd054f4e7096e0bf45ee3ffb5a9085698
---
 .../src/com/android/server/ethernet/EthernetTracker.java     | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/service-t/src/com/android/server/ethernet/EthernetTracker.java b/service-t/src/com/android/server/ethernet/EthernetTracker.java
index aeabc30780..419a09bfaf 100644
--- a/service-t/src/com/android/server/ethernet/EthernetTracker.java
+++ b/service-t/src/com/android/server/ethernet/EthernetTracker.java
@@ -233,7 +233,7 @@ public class EthernetTracker {
                 maybeTrackInterface(port);
             }
             Log.i(TAG, "interfaceLinkStateChanged: " + port + ", up: " + linkUp);
-            updateInterfaceState(ifname, linkUp);
+            updateInterfaceState(port, linkUp);
         }
 
         private void onDelLink(EthernetPort port) {
@@ -736,7 +736,8 @@ public class EthernetTracker {
         cb.onResult(iface);
     }
 
-    private void updateInterfaceState(String iface, boolean up) {
+    private void updateInterfaceState(EthernetPort port, boolean up) {
+        final String iface = port.getInterfaceName();
         final int mode = getInterfaceMode(iface);
         if (mode == INTERFACE_MODE_SERVER) {
             // TODO: support tracking link state for interfaces in server mode.

From db32c1bbdc548e79b04e658718350ff8bdf57e0f Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Thu, 5 Jun 2025 14:55:48 -0700
Subject: [PATCH 374/377] Pass EthernetPort to
 EthernetNetworkFactory#updateInterfaceLinkState

Test: TH
Flag: EXEMPT mainline
Bug: 1000001
Change-Id: I7e78be87824e29eab90074b1a2263e0cbd779021
---
 .../server/ethernet/EthernetNetworkFactory.java        |  4 ++--
 .../com/android/server/ethernet/EthernetTracker.java   |  4 ++--
 .../server/ethernet/EthernetNetworkFactoryTest.java    | 10 ++++------
 .../android/server/ethernet/EthernetTrackerTest.java   |  3 ++-
 4 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/service-t/src/com/android/server/ethernet/EthernetNetworkFactory.java b/service-t/src/com/android/server/ethernet/EthernetNetworkFactory.java
index 2c8fb895dc..c0ecc1a2b0 100644
--- a/service-t/src/com/android/server/ethernet/EthernetNetworkFactory.java
+++ b/service-t/src/com/android/server/ethernet/EthernetNetworkFactory.java
@@ -233,8 +233,8 @@ public class EthernetNetworkFactory {
     }
 
     /** Returns true if state has been modified */
-    @VisibleForTesting(visibility = VisibleForTesting.Visibility.PACKAGE)
-    protected boolean updateInterfaceLinkState(@NonNull final String ifaceName, final boolean up) {
+    public boolean updateInterfaceLinkState(EthernetPort port, boolean up) {
+        final String ifaceName = port.getInterfaceName();
         if (!hasInterface(ifaceName)) {
             return false;
         }
diff --git a/service-t/src/com/android/server/ethernet/EthernetTracker.java b/service-t/src/com/android/server/ethernet/EthernetTracker.java
index 419a09bfaf..b772d6f8ec 100644
--- a/service-t/src/com/android/server/ethernet/EthernetTracker.java
+++ b/service-t/src/com/android/server/ethernet/EthernetTracker.java
@@ -713,7 +713,7 @@ public class EthernetTracker {
             // no need to send an interface state change as this is not a true "state change". The
             // callers (maybeTrackInterface() and setTetheringInterfaceMode()) already broadcast the
             // state change.
-            mFactory.updateInterfaceLinkState(iface, true);
+            mFactory.updateInterfaceLinkState(port, true);
         }
     }
 
@@ -745,7 +745,7 @@ public class EthernetTracker {
         }
 
         // If updateInterfaceLinkState returns false, the interface is already in the correct state.
-        if (mFactory.updateInterfaceLinkState(iface, up)) {
+        if (mFactory.updateInterfaceLinkState(port, up)) {
             broadcastInterfaceStateChange(iface);
         }
     }
diff --git a/tests/unit/java/com/android/server/ethernet/EthernetNetworkFactoryTest.java b/tests/unit/java/com/android/server/ethernet/EthernetNetworkFactoryTest.java
index 292803183c..74b02367c0 100644
--- a/tests/unit/java/com/android/server/ethernet/EthernetNetworkFactoryTest.java
+++ b/tests/unit/java/com/android/server/ethernet/EthernetNetworkFactoryTest.java
@@ -234,7 +234,7 @@ public class EthernetNetworkFactoryTest {
         final IpConfiguration ipConfig = createDefaultIpConfig();
         mNetFactory.addInterface(port, ipConfig,
                 createInterfaceCapsBuilder(transportType).build());
-        assertTrue(mNetFactory.updateInterfaceLinkState(port.getInterfaceName(), true));
+        assertTrue(mNetFactory.updateInterfaceLinkState(port, true));
 
         ArgumentCaptor<NetworkOfferCallback> captor = ArgumentCaptor.forClass(
                 NetworkOfferCallback.class);
@@ -287,8 +287,7 @@ public class EthernetNetworkFactoryTest {
         createInterfaceUndergoingProvisioning(TEST_IFACE);
 
         // verify that the IpClient gets shut down when interface state changes to down.
-        final boolean ret =
-                mNetFactory.updateInterfaceLinkState(TEST_IFACE.getInterfaceName(), false /* up */);
+        final boolean ret = mNetFactory.updateInterfaceLinkState(TEST_IFACE, false /* up */);
 
         assertTrue(ret);
         verify(mIpClient).shutdown();
@@ -299,8 +298,7 @@ public class EthernetNetworkFactoryTest {
         initEthernetNetworkFactory();
 
         // if interface was never added, link state cannot be updated.
-        final boolean ret =
-                mNetFactory.updateInterfaceLinkState(TEST_IFACE.getInterfaceName(), true /* up */);
+        final boolean ret = mNetFactory.updateInterfaceLinkState(TEST_IFACE, true /* up */);
 
         assertFalse(ret);
         verifyNoStopOrStart();
@@ -543,7 +541,7 @@ public class EthernetNetworkFactoryTest {
     public void testOnNetworkNeededOnStaleNetworkOffer() throws Exception {
         initEthernetNetworkFactory();
         createAndVerifyProvisionedInterface(TEST_IFACE);
-        mNetFactory.updateInterfaceLinkState(TEST_IFACE.getInterfaceName(), false);
+        mNetFactory.updateInterfaceLinkState(TEST_IFACE, false);
         verify(mNetworkProvider).unregisterNetworkOffer(mNetworkOfferCallback);
         // It is possible that even after a network offer is unregistered, CS still sends it
         // onNetworkNeeded() callbacks.
diff --git a/tests/unit/java/com/android/server/ethernet/EthernetTrackerTest.java b/tests/unit/java/com/android/server/ethernet/EthernetTrackerTest.java
index 5013d78c31..7b6985e522 100644
--- a/tests/unit/java/com/android/server/ethernet/EthernetTrackerTest.java
+++ b/tests/unit/java/com/android/server/ethernet/EthernetTrackerTest.java
@@ -24,6 +24,7 @@ import static com.google.common.truth.Truth.assertThat;
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertThrows;
 import static org.junit.Assert.assertTrue;
+import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyBoolean;
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.ArgumentMatchers.eq;
@@ -77,7 +78,7 @@ public class EthernetTrackerTest {
     public void setUp() throws RemoteException {
         MockitoAnnotations.initMocks(this);
         initMockResources();
-        doReturn(false).when(mFactory).updateInterfaceLinkState(anyString(), anyBoolean());
+        doReturn(false).when(mFactory).updateInterfaceLinkState(any(), anyBoolean());
         doReturn(new String[0]).when(mNetd).interfaceGetList();
         doReturn(new String[0]).when(mFactory).getInterfacesSorted(anyBoolean());
         mHandlerThread = new HandlerThread(THREAD_NAME);

From dc7bfba12e0981b9d958c9f36487c91ff0a2f71b Mon Sep 17 00:00:00 2001
From: Junyu Lai <junyulai@google.com>
Date: Sat, 24 May 2025 10:46:43 +0800
Subject: [PATCH 375/377] Add NetworkTemplate get/set transport type methods

This is needed for counter-part modules to query data usage
with specified transport type.
This is kept hidden and will be exposed in follow-up
CLs.

Flag: EXEMPT controlled in the counter-part CL
Test: atest ConnectivityCoverageTests --test-filter \
'NetworkTemplate*' --update-device
Bug: 419123367
Bug: 420531377

Change-Id: I503b4d7307d008a64a14aa713d9714428e399809
---
 .../src/android/net/NetworkTemplate.java      | 148 ++++++++++--------
 .../SatelliteCoarseUsageMetricsCollector.java |   5 +-
 .../net/netstats/NetworkTemplateTest.kt       | 132 +++++-----------
 .../java/android/net/NetworkTemplateTest.kt   |  48 ++----
 .../server/net/NetworkStatsServiceTest.java   |  32 ++--
 5 files changed, 162 insertions(+), 203 deletions(-)

diff --git a/framework-t/src/android/net/NetworkTemplate.java b/framework-t/src/android/net/NetworkTemplate.java
index 8f62b4d151..af44cf7da5 100644
--- a/framework-t/src/android/net/NetworkTemplate.java
+++ b/framework-t/src/android/net/NetworkTemplate.java
@@ -24,12 +24,6 @@ import static android.net.ConnectivityManager.TYPE_PROXY;
 import static android.net.ConnectivityManager.TYPE_WIFI;
 import static android.net.ConnectivityManager.TYPE_WIFI_P2P;
 import static android.net.ConnectivityManager.TYPE_WIMAX;
-import static android.net.NetworkCapabilities.TRANSPORT_BLUETOOTH;
-import static android.net.NetworkCapabilities.TRANSPORT_CELLULAR;
-import static android.net.NetworkCapabilities.TRANSPORT_ETHERNET;
-import static android.net.NetworkCapabilities.TRANSPORT_SATELLITE;
-import static android.net.NetworkCapabilities.TRANSPORT_TEST;
-import static android.net.NetworkCapabilities.TRANSPORT_WIFI;
 import static android.net.NetworkIdentity.OEM_NONE;
 import static android.net.NetworkIdentity.OEM_PAID;
 import static android.net.NetworkIdentity.OEM_PRIVATE;
@@ -43,9 +37,10 @@ import static android.net.NetworkStats.ROAMING_ALL;
 import static android.net.NetworkStats.ROAMING_NO;
 import static android.net.NetworkStats.ROAMING_YES;
 
-import static com.android.net.module.util.CollectionUtils.toIntArray;
 import static com.android.net.module.util.NetworkCapabilitiesUtils.TYPE_TEST;
 
+import static java.util.Objects.requireNonNull;
+
 import android.annotation.IntDef;
 import android.annotation.NonNull;
 import android.annotation.Nullable;
@@ -97,6 +92,8 @@ public final class NetworkTemplate implements Parcelable {
             MATCH_BLUETOOTH,
             MATCH_PROXY,
             MATCH_CARRIER,
+            MATCH_TEST,
+            MATCH_ALL,
     })
     public @interface TemplateMatchRule{}
 
@@ -126,6 +123,13 @@ public final class NetworkTemplate implements Parcelable {
      */
     @VisibleForTesting
     public static final int MATCH_TEST = 11;
+    /**
+     * Match rule to match networks with other filters inside the template.
+     *
+     * Note that exactly one transport type is needed to build the template with this match rule.
+     * @hide
+     */
+    public static final int MATCH_ALL = 12;
 
     // TODO: Remove this and replace all callers with WIFI_NETWORK_KEY_ALL.
     /** @hide */
@@ -191,6 +195,7 @@ public final class NetworkTemplate implements Parcelable {
             case MATCH_PROXY:
             case MATCH_CARRIER:
             case MATCH_TEST:
+            case MATCH_ALL:
                 return true;
 
             default:
@@ -535,8 +540,8 @@ public final class NetworkTemplate implements Parcelable {
     public NetworkTemplate(int matchRule, String[] matchSubscriberIds,
             String[] matchWifiNetworkKeys, int metered, int roaming, int defaultNetwork,
             int ratType, int oemManaged, long transportTypesBits) {
-        Objects.requireNonNull(matchWifiNetworkKeys);
-        Objects.requireNonNull(matchSubscriberIds);
+        requireNonNull(matchWifiNetworkKeys);
+        requireNonNull(matchSubscriberIds);
         mMatchRule = matchRule;
         mMatchSubscriberIds = matchSubscriberIds;
         mMatchWifiNetworkKeys = matchWifiNetworkKeys;
@@ -657,8 +662,15 @@ public final class NetworkTemplate implements Parcelable {
 
     /**
      * Get match rule of the template. See {@code MATCH_*}.
+     *
+     * @throws IllegalStateException if the template is not built from constructors with
+     * match rule, which can occur if the template was created with the
+     * {@link Builder#Builder()} constructor.
      */
     public int getMatchRule() {
+        if (MATCH_ALL == mMatchRule) {
+            throw new IllegalStateException("Match rule is not set");
+        }
         return mMatchRule;
     }
 
@@ -731,6 +743,20 @@ public final class NetworkTemplate implements Parcelable {
         return mRatType;
     }
 
+    /**
+     * Get the transport type filter of the template.
+     *
+     * This is only valid when the template is constructed by using
+     * {@link NetworkTemplate.Builder}.
+     * @hide
+     */
+    public int getTransportType() {
+        if (mTransportTypesBits == TRANSPORT_TYPES_ALL) {
+            throw new IllegalStateException("Transport was not set");
+        }
+        return getTransportTypes()[0];
+    }
+
     /**
      * Get the transport types filter of the template.
      *
@@ -757,12 +783,11 @@ public final class NetworkTemplate implements Parcelable {
      */
     @SystemApi(client = MODULE_LIBRARIES)
     public boolean matches(@NonNull NetworkIdentity ident) {
-        Objects.requireNonNull(ident);
+        requireNonNull(ident);
         if (!matchesMetered(ident)) return false;
         if (!matchesRoaming(ident)) return false;
         if (!matchesDefaultNetwork(ident)) return false;
         if (!matchesOemNetwork(ident)) return false;
-        if (!matchesTransportTypes(ident)) return false;
 
         // TODO: Convert match rule handling into transport type matches and
         //  eliminate the need of legacy network types.
@@ -781,6 +806,8 @@ public final class NetworkTemplate implements Parcelable {
                 return matchesCarrier(ident);
             case MATCH_TEST:
                 return matchesTest(ident);
+            case MATCH_ALL:
+                return matchesTransportTypes(ident);
             default:
                 // We have no idea what kind of network template we are, so we
                 // just claim not to match anything.
@@ -952,6 +979,8 @@ public final class NetworkTemplate implements Parcelable {
                 return "CARRIER";
             case MATCH_TEST:
                 return "TEST";
+            case MATCH_ALL:
+                return "ALL";
             default:
                 return "UNKNOWN(" + matchRule + ")";
         }
@@ -1106,6 +1135,17 @@ public final class NetworkTemplate implements Parcelable {
             mTransportTypesBits = TRANSPORT_TYPES_ALL;
         }
 
+        /**
+         * Creates a new Builder to construct NetworkTemplate objects.
+         *
+         * Note that {@link #setTransportType} MUST be called to specify
+         * the transport type filter.
+         * @hide
+         */
+        public Builder() {
+            this(MATCH_ALL);
+        }
+
         /**
          * Set the Subscriber Ids. Calling this function with an empty set represents
          * the intention of matching any Subscriber Ids.
@@ -1115,7 +1155,7 @@ public final class NetworkTemplate implements Parcelable {
          */
         @NonNull
         public Builder setSubscriberIds(@NonNull Set<String> subscriberIds) {
-            Objects.requireNonNull(subscriberIds);
+            requireNonNull(subscriberIds);
             mMatchSubscriberIds.clear();
             mMatchSubscriberIds.addAll(subscriberIds);
             return this;
@@ -1136,7 +1176,7 @@ public final class NetworkTemplate implements Parcelable {
          */
         @NonNull
         public Builder setWifiNetworkKeys(@NonNull Set<String> wifiNetworkKeys) {
-            Objects.requireNonNull(wifiNetworkKeys);
+            requireNonNull(wifiNetworkKeys);
             for (String key : wifiNetworkKeys) {
                 if (key == null) {
                     throw new IllegalArgumentException("Null is not a valid key");
@@ -1198,6 +1238,25 @@ public final class NetworkTemplate implements Parcelable {
             return this;
         }
 
+        /**
+         * Sets the transport type filter for this template.
+         *
+         * This is only valid when the template is constructed by using
+         * {@link NetworkTemplate.Builder}.
+         *
+         * @param transportType {@code NetworkCapabilities#TRANSPORT_*} constant.
+         * @return This {@code Builder} for chaining.
+           @hide
+         */
+        @NonNull
+        public Builder setTransportType(int transportType) {
+            if (mMatchRule != MATCH_ALL) {
+                throw new IllegalArgumentException("setTransportType is only supported for builder"
+                        + " built by default constructor.");
+            }
+            return setTransportTypes(new int[] {transportType});
+        }
+
         /**
          * Sets the transport types filter for this template.
          *
@@ -1212,7 +1271,7 @@ public final class NetworkTemplate implements Parcelable {
          * @hide
          */
         @NonNull
-        public Builder setTransportTypes(int[] transportTypes) {
+        private Builder setTransportTypes(int[] transportTypes) {
             mTransportTypesBits = BitUtils.packBits(transportTypes);
             return this;
         }
@@ -1257,56 +1316,19 @@ public final class NetworkTemplate implements Parcelable {
             }
         }
 
-        // Validates if transport types are specified (i.e., mTransportTypesBits is not 0),
-        // they must be consistent with the template's mMatchRule. This means
-        // the specified transports must include at least one type that is
-        // deducible or expected for that matchRule.
-        // For example, if mMatchRule is MATCH_WIFI and transports are specified,
-        // TRANSPORT_WIFI must be among them.
+        /**
+         * Validates that:
+         * 1. For MATCH_ALL, exactly one transport type is specified.
+         * 2. For all other match rules, no transport type should be specified.
+         */
         private void validateTransportTypes() {
-            assertDeducedTransportTypes(mMatchRule, mTransportTypesBits);
-        }
-
-        /**
-         * Determines possible transport types for a match rule.
-         * @return Set of TRANSPORT_* constants.
-         * @throws IllegalArgumentException for unknown matchRule.
-         */
-        private static Set<Integer> getPossibleTransportsForMatchRule(int matchRule) {
-            return switch (matchRule) {
-                case MATCH_MOBILE -> Set.of(TRANSPORT_CELLULAR, TRANSPORT_SATELLITE);
-                case MATCH_WIFI -> Set.of(TRANSPORT_WIFI);
-                case MATCH_ETHERNET -> Set.of(TRANSPORT_ETHERNET);
-                // See NetworkCapabilitiesUtils#deduceTransportTypeForLegacyIdentity.
-                case MATCH_PROXY, MATCH_BLUETOOTH -> Set.of(TRANSPORT_BLUETOOTH);
-                // Carrier networks are identified by subscriberId and can be either cellular
-                // or carrier-provided Wi-Fi.
-                case MATCH_CARRIER -> Set.of(TRANSPORT_CELLULAR, TRANSPORT_WIFI);
-                case MATCH_TEST -> Set.of(TRANSPORT_TEST);
-                default -> throw new IllegalArgumentException(
-                        "Unexpected match rule: " + matchRule);
-            };
-        }
-
-        /**
-         * Asserts template's transport types are consistent with its match rule.
-         * Called during NetworkTemplate construction.
-         *
-         * @param matchRule The NetworkTemplate match rule.
-         * @param transportTypesBits Bitmask of transport types. No-op if 0.
-         * @throws IllegalArgumentException if transports are inconsistent with the rule.
-         */
-        private static void assertDeducedTransportTypes(int matchRule, long transportTypesBits) {
-            // No transports specified, nothing to check.
-            if (transportTypesBits == 0L) return;
-
-            Set<Integer> possibleTransportsSet = getPossibleTransportsForMatchRule(matchRule);
-            final long possibleTransportBitsForMatchRule =
-                    BitUtils.packBits(toIntArray(possibleTransportsSet));
-
-            // Template transports must overlap with possible transports for the rule.
-            if ((transportTypesBits & possibleTransportBitsForMatchRule) == 0L) {
-                throw new IllegalArgumentException("No deduced transport type: " + matchRule);
+            final int transportCount = Long.bitCount(mTransportTypesBits);
+            if (mMatchRule != MATCH_ALL && transportCount != 0) {
+                throw new IllegalArgumentException(
+                        "Transports type can't be set with a match rule.");
+            } else if (mMatchRule == MATCH_ALL && transportCount != 1) {
+                throw new IllegalArgumentException(
+                        "Transport type not set (use Builder#setTransportType).");
             }
         }
 
diff --git a/service/src/com/android/metrics/SatelliteCoarseUsageMetricsCollector.java b/service/src/com/android/metrics/SatelliteCoarseUsageMetricsCollector.java
index 79f2f1dc74..7e8e463389 100644
--- a/service/src/com/android/metrics/SatelliteCoarseUsageMetricsCollector.java
+++ b/service/src/com/android/metrics/SatelliteCoarseUsageMetricsCollector.java
@@ -18,7 +18,6 @@ package com.android.metrics;
 
 import static android.net.NetworkCapabilities.NET_CAPABILITY_INTERNET;
 import static android.net.NetworkCapabilities.TRANSPORT_SATELLITE;
-import static android.net.NetworkTemplate.MATCH_MOBILE;
 
 import static com.android.net.module.util.FrameworkConnectivityStatsLog.CORE_NETWORKING_CRITICAL_BYTES_EVENT_OCCURRED;
 import static com.android.net.module.util.FrameworkConnectivityStatsLog.CORE_NETWORKING_CRITICAL_BYTES_EVENT_OCCURRED__EVENT_TYPE__CRITICAL_BYTES_EVENT_TYPE_SATELLITE_COARSE_RX_USAGE;
@@ -63,8 +62,8 @@ public class SatelliteCoarseUsageMetricsCollector {
         // To prevent NetworkTemplate#Builder not found error when
         // initializing CSTest on S-based image.
         if (SdkLevel.isAtLeastU()) {
-            SATELLITE_TEMPLATE = new NetworkTemplate.Builder(MATCH_MOBILE)
-                    .setTransportTypes(new int[]{TRANSPORT_SATELLITE}).build();
+            SATELLITE_TEMPLATE = new NetworkTemplate.Builder()
+                    .setTransportType(TRANSPORT_SATELLITE).build();
         } else {
             SATELLITE_TEMPLATE = null;
         }
diff --git a/tests/common/java/android/net/netstats/NetworkTemplateTest.kt b/tests/common/java/android/net/netstats/NetworkTemplateTest.kt
index 90109d1430..0eb28afbf6 100644
--- a/tests/common/java/android/net/netstats/NetworkTemplateTest.kt
+++ b/tests/common/java/android/net/netstats/NetworkTemplateTest.kt
@@ -16,12 +16,7 @@
 
 package android.net.netstats
 
-import android.net.NetworkCapabilities.TRANSPORT_BLUETOOTH
 import android.net.NetworkCapabilities.TRANSPORT_CELLULAR
-import android.net.NetworkCapabilities.TRANSPORT_ETHERNET
-import android.net.NetworkCapabilities.TRANSPORT_SATELLITE
-import android.net.NetworkCapabilities.TRANSPORT_TEST
-import android.net.NetworkCapabilities.TRANSPORT_VPN
 import android.net.NetworkCapabilities.TRANSPORT_WIFI
 import android.net.NetworkStats.DEFAULT_NETWORK_ALL
 import android.net.NetworkStats.METERED_ALL
@@ -34,7 +29,6 @@ import android.net.NetworkTemplate.MATCH_CARRIER
 import android.net.NetworkTemplate.MATCH_ETHERNET
 import android.net.NetworkTemplate.MATCH_MOBILE
 import android.net.NetworkTemplate.MATCH_PROXY
-import android.net.NetworkTemplate.MATCH_TEST
 import android.net.NetworkTemplate.MATCH_WIFI
 import android.net.NetworkTemplate.NETWORK_TYPE_ALL
 import android.net.NetworkTemplate.OEM_MANAGED_ALL
@@ -299,93 +293,53 @@ class NetworkTemplateTest {
         }
     }
 
-    // Verify the builder does not throw, and transports read from the getter is expected.
+    /**
+     * Tests the successful setting and retrieval of a transport type.
+     */
     @Test
-    fun testBuilderTransportTypes() {
-        assertGetSetTransportTypes(MATCH_MOBILE, TRANSPORT_CELLULAR)
-        assertGetSetTransportTypes(MATCH_MOBILE, TRANSPORT_SATELLITE)
-        assertGetSetTransportTypes(MATCH_WIFI, TRANSPORT_WIFI)
-        assertGetSetTransportTypes(MATCH_ETHERNET, TRANSPORT_ETHERNET)
-        assertGetSetTransportTypes(MATCH_BLUETOOTH, TRANSPORT_BLUETOOTH)
-        assertGetSetTransportTypes(MATCH_PROXY, TRANSPORT_BLUETOOTH)
-        assertGetSetTransportTypes(MATCH_CARRIER, TRANSPORT_CELLULAR)
-        assertGetSetTransportTypes(MATCH_CARRIER, TRANSPORT_WIFI)
-        assertGetSetTransportTypes(MATCH_TEST, TRANSPORT_TEST)
-    }
-
-    private fun assertGetSetTransportTypes(matchRule: Int, transport: Int) {
-        val builder = NetworkTemplate.Builder(matchRule)
-                .setTransportTypes(intArrayOf(transport))
-        if (matchRule == MATCH_CARRIER) {
-            builder.setSubscriberIds(setOf(TEST_IMSI1))
-        }
-        val template = builder.build()
-        assertEquals(1, template.transportTypes.size)
-        assertEquals(transport, template.transportTypes[0])
-    }
-
-    @Test
-    fun testValidateTransportTypesNoTransportsSetSuccess() {
-        // Should succeed for any match rule if no transports are explicitly set.
-        listOf(
-                MATCH_WIFI,
-                MATCH_MOBILE,
-                MATCH_ETHERNET,
-                MATCH_BLUETOOTH,
-                MATCH_PROXY,
-                MATCH_TEST
-        ).forEach { matchRule ->
-            NetworkTemplate.Builder(matchRule)
-                    .setTransportTypes(intArrayOf()) // Explicitly empty, or just don't call it
-                    .build() // Should not throw
-        }
-        NetworkTemplate.Builder(MATCH_CARRIER)
-                .setSubscriberIds(setOf(TEST_IMSI1))
-                .setTransportTypes(intArrayOf())
-                .build() // Should not throw
-    }
-
-    @Test
-    fun testValidateTransportTypesDeducedTransportPlusCompatibleSuccess() {
-        NetworkTemplate.Builder(MATCH_WIFI)
-                .setTransportTypes(intArrayOf(TRANSPORT_WIFI, TRANSPORT_VPN))
-                .build()
-        NetworkTemplate.Builder(MATCH_MOBILE)
-                .setTransportTypes(intArrayOf(TRANSPORT_CELLULAR, TRANSPORT_TEST))
+    fun testSetAndGetTransportType() {
+        val template = NetworkTemplate.Builder()
+                .setTransportType(TRANSPORT_CELLULAR)
                 .build()
+
+        assertFailsWith<IllegalStateException> { template.matchRule }
+        assertEquals(TRANSPORT_CELLULAR, template.transportType)
     }
 
+    /**
+     * Verifies that if `setTransportType` is called multiple times, the last value supplied is used.
+     */
     @Test
-    fun testValidateTransportTypesDeducedTransportMissingThrows() {
-        assertFailsWith<IllegalArgumentException> {
-            NetworkTemplate.Builder(MATCH_WIFI)
-                    .setTransportTypes(intArrayOf(TRANSPORT_CELLULAR))
-                    .build()
-        }
-        assertFailsWith<IllegalArgumentException> {
-            NetworkTemplate.Builder(MATCH_MOBILE)
-                    .setTransportTypes(intArrayOf(TRANSPORT_WIFI))
-                    .build()
-        }
-        assertFailsWith<IllegalArgumentException> {
-            NetworkTemplate.Builder(MATCH_ETHERNET)
-                    .setTransportTypes(intArrayOf(TRANSPORT_WIFI))
-                    .build()
-        }
-        assertFailsWith<IllegalArgumentException> {
-            NetworkTemplate.Builder(MATCH_CARRIER)
-                    .setTransportTypes(intArrayOf(TRANSPORT_SATELLITE))
-                    .build()
-        }
-        assertFailsWith<IllegalArgumentException> {
-            NetworkTemplate.Builder(MATCH_TEST)
-                    .setTransportTypes(intArrayOf(TRANSPORT_SATELLITE))
-                    .build()
-        }
-        assertFailsWith<IllegalArgumentException> {
-            NetworkTemplate.Builder(MATCH_TEST)
-                    .setTransportTypes(intArrayOf(INVALID_TRANSPORT))
-                    .build()
-        }
+    fun testMultipleSetTransportTypeOverrides() {
+        val template = NetworkTemplate.Builder()
+                .setTransportType(TRANSPORT_CELLULAR).setTransportType(TRANSPORT_WIFI).build()
+        assertEquals(TRANSPORT_WIFI, template.transportType)
+    }
+
+    /**
+     * Verifies that building a template with a transport type set for a
+     * non-transport match rule throws an IllegalArgumentException.
+     */
+    @Test(expected = IllegalArgumentException::class)
+    fun testSetTransportType_withNonTransportRuleThrows() {
+        NetworkTemplate.Builder(MATCH_WIFI).setTransportType(TRANSPORT_CELLULAR)
+    }
+
+    /**
+     * Verifies that building a template with a non-transport match rule throws an
+     * IllegalStateException when getTransportType() calls.
+     */
+    @Test(expected = IllegalStateException::class)
+    fun testNonTransportRule_getTransportThrows() {
+        val template = NetworkTemplate.Builder(MATCH_WIFI).build()
+        template.transportType
+    }
+
+    /**
+     * Verifies template built with default constructor but doesn't specify transport throws.
+     */
+    @Test(expected = IllegalArgumentException::class)
+    fun testGetTransportType_whenNotSetThrows() {
+        NetworkTemplate.Builder().build()
     }
 }
diff --git a/tests/unit/java/android/net/NetworkTemplateTest.kt b/tests/unit/java/android/net/NetworkTemplateTest.kt
index 10392b47f6..1435cd01e7 100644
--- a/tests/unit/java/android/net/NetworkTemplateTest.kt
+++ b/tests/unit/java/android/net/NetworkTemplateTest.kt
@@ -51,7 +51,6 @@ import android.net.NetworkTemplate.normalize
 import android.net.wifi.WifiInfo
 import android.os.Build
 import android.telephony.TelephonyManager
-import com.android.net.module.util.BitUtils
 import com.android.testutils.DevSdkIgnoreRule
 import com.android.testutils.DevSdkIgnoreRunner
 import com.android.testutils.NonNullTestUtils
@@ -684,7 +683,6 @@ class NetworkTemplateTest {
     fun testEquals() {
         val templateImsi1 = NetworkTemplate.Builder(MATCH_MOBILE).setMeteredness(METERED_YES)
                 .setSubscriberIds(setOf(TEST_IMSI1)).setRatType(TelephonyManager.NETWORK_TYPE_UMTS)
-                .setTransportTypes(intArrayOf(TRANSPORT_SATELLITE, TRANSPORT_VPN))
                 .build()
         val dupTemplateImsi1 = NetworkTemplate(
                 MATCH_MOBILE,
@@ -695,7 +693,7 @@ class NetworkTemplateTest {
                 DEFAULT_NETWORK_ALL,
                 TelephonyManager.NETWORK_TYPE_UMTS,
                 OEM_MANAGED_ALL,
-                BitUtils.packBits(intArrayOf(TRANSPORT_SATELLITE, TRANSPORT_VPN))
+                TRANSPORT_TYPES_ALL
         )
         val templateImsi2 = NetworkTemplate.Builder(MATCH_MOBILE).setMeteredness(METERED_YES)
                 .setSubscriberIds(setOf(TEST_IMSI2)).setRatType(TelephonyManager.NETWORK_TYPE_UMTS)
@@ -707,7 +705,6 @@ class NetworkTemplateTest {
 
         val templateWifiKey1 = NetworkTemplate.Builder(MATCH_WIFI)
                 .setWifiNetworkKeys(setOf(TEST_WIFI_KEY1))
-                .setTransportTypes(intArrayOf(TRANSPORT_WIFI))
                 .build()
         val dupTemplateWifiKey1 = NetworkTemplate(
                 MATCH_WIFI,
@@ -718,7 +715,7 @@ class NetworkTemplateTest {
                 DEFAULT_NETWORK_ALL,
                 NETWORK_TYPE_ALL,
                 OEM_MANAGED_ALL,
-                BitUtils.packBits(intArrayOf(TRANSPORT_WIFI))
+                TRANSPORT_TYPES_ALL
         )
         val templateWifiKey2 = NetworkTemplate.Builder(MATCH_WIFI)
                 .setWifiNetworkKeys(setOf(TEST_WIFI_KEY2)).build()
@@ -911,46 +908,31 @@ class NetworkTemplateTest {
                 .setType(TYPE_MOBILE)
                 .setTransportTypes(setOf(TRANSPORT_SATELLITE))
                 .build()
-        val identMobileVpn = NetworkIdentity.Builder()
+        val identCellularVpn = NetworkIdentity.Builder()
                 .setType(TYPE_MOBILE)
                 .setTransportTypes(setOf(TRANSPORT_CELLULAR, TRANSPORT_VPN))
                 .build()
-        val identOnlyCellular = NetworkIdentity.Builder()
+        val identCellular = NetworkIdentity.Builder()
                 .setType(TYPE_MOBILE)
                 .setTransportTypes(setOf(TRANSPORT_CELLULAR))
                 .build()
 
-        val templateMobileNoTransport = NetworkTemplate.Builder(MATCH_MOBILE)
-                .build() // Wildcard for transports
-        val templateMobileWithCellularTransport = NetworkTemplate.Builder(MATCH_MOBILE)
-                .setTransportTypes(intArrayOf(TRANSPORT_CELLULAR))
+        val templateCellular = NetworkTemplate.Builder()
+                .setTransportType(TRANSPORT_CELLULAR)
                 .build()
-        val templateSatellite = NetworkTemplate.Builder(MATCH_MOBILE)
-                .setTransportTypes(intArrayOf(TRANSPORT_SATELLITE))
-                .build()
-        val templateVpnAndCellular = NetworkTemplate.Builder(MATCH_MOBILE)
-                .setTransportTypes(intArrayOf(TRANSPORT_VPN, TRANSPORT_CELLULAR))
+        val templateSatellite = NetworkTemplate.Builder()
+                .setTransportType(TRANSPORT_SATELLITE)
                 .build()
 
-        // 1. Mobile wildcard template
-        templateMobileNoTransport.assertMatches(identSatellite)
-        templateMobileNoTransport.assertMatches(identMobileVpn)
-        templateMobileNoTransport.assertMatches(identOnlyCellular)
+        // 1. Template requiring TRANSPORT_CELLULAR
+        templateCellular.assertDoesNotMatch(identSatellite)
+        templateCellular.assertMatches(identCellularVpn)
+        templateCellular.assertMatches(identCellular)
 
-        // 2. Template requiring TRANSPORT_CELLULAR
-        templateMobileWithCellularTransport.assertDoesNotMatch(identSatellite)
-        templateMobileWithCellularTransport.assertMatches(identMobileVpn)
-        templateMobileWithCellularTransport.assertMatches(identOnlyCellular)
-
-        // 3. Template requiring TRANSPORT_SATELLITE
+        // 2. Template requiring TRANSPORT_SATELLITE
         templateSatellite.assertMatches(identSatellite)
-        templateSatellite.assertDoesNotMatch(identMobileVpn)
-        templateSatellite.assertDoesNotMatch(identOnlyCellular)
-
-        // 4. Template requiring TRANSPORT_VPN AND TRANSPORT_CELLULAR
-        templateVpnAndCellular.assertDoesNotMatch(identSatellite)
-        templateVpnAndCellular.assertMatches(identMobileVpn)
-        templateVpnAndCellular.assertDoesNotMatch(identOnlyCellular)
+        templateSatellite.assertDoesNotMatch(identCellularVpn)
+        templateSatellite.assertDoesNotMatch(identCellular)
     }
 
     @Test
diff --git a/tests/unit/java/com/android/server/net/NetworkStatsServiceTest.java b/tests/unit/java/com/android/server/net/NetworkStatsServiceTest.java
index 90c9fc5c0a..955701e8ec 100644
--- a/tests/unit/java/com/android/server/net/NetworkStatsServiceTest.java
+++ b/tests/unit/java/com/android/server/net/NetworkStatsServiceTest.java
@@ -27,6 +27,8 @@ import static android.content.pm.PackageManager.PERMISSION_GRANTED;
 import static android.net.ConnectivityManager.TYPE_MOBILE;
 import static android.net.ConnectivityManager.TYPE_TEST;
 import static android.net.ConnectivityManager.TYPE_WIFI;
+import static android.net.NetworkCapabilities.TRANSPORT_CELLULAR;
+import static android.net.NetworkCapabilities.TRANSPORT_SATELLITE;
 import static android.net.NetworkIdentity.OEM_PAID;
 import static android.net.NetworkIdentity.OEM_PRIVATE;
 import static android.net.NetworkStack.PERMISSION_MAINLINE_NETWORK_STACK;
@@ -1138,7 +1140,7 @@ public class NetworkStatsServiceTest extends NetworkStatsBaseTest {
         // Pretend that 5g mobile network comes online
         final NetworkStateSnapshot[] mobileStates =
                 new NetworkStateSnapshot[] {buildMobileState(IMSI_1), buildStateOfTransport(
-                        NetworkCapabilities.TRANSPORT_CELLULAR, TYPE_MOBILE,
+                        TRANSPORT_CELLULAR, TYPE_MOBILE,
                         TEST_IFACE2, IMSI_1, null /* wifiNetworkKey */,
                         true /* isTemporarilyNotMetered */, false /* isRoaming */)};
         setMobileRatTypeAndWaitForIdle(TelephonyManager.NETWORK_TYPE_NR);
@@ -1413,7 +1415,7 @@ public class NetworkStatsServiceTest extends NetworkStatsBaseTest {
         mockNetworkStatsUidDetail(buildEmptyStats());
 
         final NetworkStateSnapshot mobileState = buildStateOfTransport(
-                NetworkCapabilities.TRANSPORT_CELLULAR, TYPE_MOBILE,
+                TRANSPORT_CELLULAR, TYPE_MOBILE,
                 TEST_IFACE2, IMSI_1, null /* wifiNetworkKey */,
                 false /* isTemporarilyNotMetered */, false /* isRoaming */);
 
@@ -1472,7 +1474,7 @@ public class NetworkStatsServiceTest extends NetworkStatsBaseTest {
         final String[] mobileIfaces = {TEST_IFACE2};
         mockNetworkStatsUidDetail(buildEmptyStats(), emptyTetherStats, mobileIfaces);
         final NetworkStats mobileStats = mService.getUidStatsForTransport(
-                NetworkCapabilities.TRANSPORT_CELLULAR);
+                TRANSPORT_CELLULAR);
 
         assertEquals(2, mobileStats.size());
         // Verify the operation count stats that caused by incrementOperationCount only appears
@@ -1491,7 +1493,7 @@ public class NetworkStatsServiceTest extends NetworkStatsBaseTest {
         mockNetworkStatsUidDetail(buildEmptyStats());
 
         final NetworkStateSnapshot mobileState = buildStateOfTransport(
-                NetworkCapabilities.TRANSPORT_CELLULAR, TYPE_MOBILE,
+                TRANSPORT_CELLULAR, TYPE_MOBILE,
                 TEST_IFACE2, IMSI_1, null /* wifiNetworkKey */,
                 false /* isTemporarilyNotMetered */, false /* isRoaming */);
 
@@ -1522,7 +1524,7 @@ public class NetworkStatsServiceTest extends NetworkStatsBaseTest {
         // with getUidStatsForTransport(TRANSPORT_CELLULAR) return stats of both cellular
         // and satellite
         final NetworkStats mobileStats = mService.getUidStatsForTransport(
-                NetworkCapabilities.TRANSPORT_CELLULAR);
+                TRANSPORT_CELLULAR);
 
         // The iface field of the returned stats should be null because getUidStatsForTransport
         // clears the interface field before it returns the result.
@@ -1531,7 +1533,7 @@ public class NetworkStatsServiceTest extends NetworkStatsBaseTest {
 
         // getUidStatsForTransport(TRANSPORT_SATELLITE) is not supported
         assertThrows(IllegalArgumentException.class,
-                () -> mService.getUidStatsForTransport(NetworkCapabilities.TRANSPORT_SATELLITE));
+                () -> mService.getUidStatsForTransport(TRANSPORT_SATELLITE));
 
     }
 
@@ -1543,17 +1545,17 @@ public class NetworkStatsServiceTest extends NetworkStatsBaseTest {
     public void testGetSatelliteStats() throws Exception {
         mockDefaultSettings();
         final NetworkTemplate templateSatellite =
-                new NetworkTemplate.Builder(MATCH_MOBILE)
+                new NetworkTemplate.Builder()
                         .setMeteredness(METERED_YES)
                         .setSubscriberIds(Set.of(IMSI_1))
-                        .setTransportTypes(new int[]{NetworkCapabilities.TRANSPORT_SATELLITE})
+                        .setTransportType(TRANSPORT_SATELLITE)
                         .build();
 
         final NetworkTemplate templateCellularOnly =
-                new NetworkTemplate.Builder(MATCH_MOBILE)
+                new NetworkTemplate.Builder()
                         .setMeteredness(METERED_YES)
                         .setSubscriberIds(Set.of(IMSI_1))
-                        .setTransportTypes(new int[]{NetworkCapabilities.TRANSPORT_CELLULAR})
+                        .setTransportType(TRANSPORT_CELLULAR)
                         .build();
 
         // Initial state: Assert all relevant templates are empty
@@ -1712,7 +1714,7 @@ public class NetworkStatsServiceTest extends NetworkStatsBaseTest {
         mockDefaultSettings();
         NetworkStateSnapshot[] states =
             new NetworkStateSnapshot[] {buildStateOfTransport(
-                    NetworkCapabilities.TRANSPORT_CELLULAR, TYPE_MOBILE,
+                    TRANSPORT_CELLULAR, TYPE_MOBILE,
                     TEST_IFACE,  IMSI_1, null /* wifiNetworkKey */,
                     false /* isTemporarilyNotMetered */, true /* isRoaming */)};
         mockNetworkStatsSummary(buildEmptyStats());
@@ -2892,13 +2894,13 @@ public class NetworkStatsServiceTest extends NetworkStatsBaseTest {
     }
 
     private static NetworkStateSnapshot buildMobileState(String subscriberId) {
-        return buildStateOfTransport(NetworkCapabilities.TRANSPORT_CELLULAR, TYPE_MOBILE,
+        return buildStateOfTransport(TRANSPORT_CELLULAR, TYPE_MOBILE,
                 TEST_IFACE, subscriberId, null /* wifiNetworkKey */,
                 false /* isTemporarilyNotMetered */, false /* isRoaming */);
     }
 
     private static NetworkStateSnapshot buildSatelliteMobileState(String subscriberId) {
-        return buildStateOfTransport(NetworkCapabilities.TRANSPORT_SATELLITE, TYPE_MOBILE,
+        return buildStateOfTransport(TRANSPORT_SATELLITE, TYPE_MOBILE,
                 TEST_IFACE, subscriberId, null /* wifiNetworkKey */,
                 false /* isTemporarilyNotMetered */, false /* isRoaming */);
     }
@@ -2942,7 +2944,7 @@ public class NetworkStatsServiceTest extends NetworkStatsBaseTest {
         for (int nc : oemNetCapabilities) {
             capabilities.setCapability(nc, true);
         }
-        capabilities.addTransportType(NetworkCapabilities.TRANSPORT_CELLULAR);
+        capabilities.addTransportType(TRANSPORT_CELLULAR);
         return new NetworkStateSnapshot(MOBILE_NETWORK, capabilities, prop, subscriberId,
                 TYPE_MOBILE);
     }
@@ -2955,7 +2957,7 @@ public class NetworkStatsServiceTest extends NetworkStatsBaseTest {
         capabilities.setCapability(NetworkCapabilities.NET_CAPABILITY_NOT_METERED, true);
         capabilities.setCapability(NetworkCapabilities.NET_CAPABILITY_NOT_ROAMING, true);
         capabilities.setCapability(NetworkCapabilities.NET_CAPABILITY_IMS, true);
-        capabilities.addTransportType(NetworkCapabilities.TRANSPORT_CELLULAR);
+        capabilities.addTransportType(TRANSPORT_CELLULAR);
         capabilities.setNetworkSpecifier(new TelephonyNetworkSpecifier(subId));
         return new NetworkStateSnapshot(
                 MOBILE_NETWORK, capabilities, prop, subscriberId, TYPE_MOBILE);

From 18523cb5f345b72292c2ca8ac26a9f4930efc19e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Sat, 7 Jun 2025 05:59:44 -0700
Subject: [PATCH 376/377] NetBpfLoad: add self-check for
 bpfGetNext{Prog,Map}Id()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This detects some kernel bugs, particularly on Xiaomi devices.

Bug: 414570528
Test: TreeHugger
Flag: EXEMPT mainline
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ic099c53dc1ad5f01bfebfddd29b1024f5b936fe5
---
 bpf/loader/NetBpfLoad.cpp                     | 44 +++++++++++++++++++
 .../include/BpfSyscallWrappers.h              | 12 +++++
 2 files changed, 56 insertions(+)

diff --git a/bpf/loader/NetBpfLoad.cpp b/bpf/loader/NetBpfLoad.cpp
index 2389bea177..c61aec34a1 100644
--- a/bpf/loader/NetBpfLoad.cpp
+++ b/bpf/loader/NetBpfLoad.cpp
@@ -1833,6 +1833,50 @@ static int doLoad(char** argv, char * const envp[]) {
         if (writeProcSysFile("/proc/sys/net/core/bpf_jit_kallsyms", "1\n")) return 1;
     }
 
+    if (runningAsRoot) {  // implies U QPR3+ and kernel 4.14+
+        // There should not be any programs or maps yet
+        errno = 0;
+        uint32_t progId = bpfGetNextProgId(0);  // expect 0 with errno == ENOENT
+        if (progId || errno != ENOENT) {
+            ALOGE("bpfGetNextProgId(zero) returned %u (errno %d)", progId, errno);
+            return 1;
+        }
+        errno = 0;
+        uint32_t mapId = bpfGetNextMapId(0);  // expect 0 with errno == ENOENT
+        if (mapId || errno != ENOENT) {
+            ALOGE("bpfGetNextMapId(zero) returned %u (errno %d)", mapId, errno);
+            return 1;
+        }
+    } else if (isAtLeastKernelVersion(4, 14, 0)) {  // implies S through U QPR2
+        // bpfGetNext{Prog,Map}Id require 4.14+
+        // furthermore since we're not running as root, we're not the initial
+        // platform bpfloader, so there may already be some maps & programs.
+        uint32_t mapId = 0;
+        while (true) {
+            errno = 0;
+            uint32_t next = bpfGetNextMapId(mapId);
+            if (!next && errno == ENOENT) break;
+            if (next <= mapId) {
+                ALOGE("bpfGetNextMapId(%u) returned %u errno %d", mapId, next, errno);
+                return 1;
+            }
+            mapId = next;
+        }
+        // mapId is now the last map id, creating a new map should change that
+        unique_fd map(createMap(BPF_MAP_TYPE_ARRAY, sizeof(int), sizeof(int), 1, 0));
+        errno = 0;
+        uint32_t next = bpfGetNextMapId(mapId);
+        if (next <= mapId) {
+            // We should fail here on Xiaomi S 4.14.180 due to kernel uapi bug,
+            // which causes bpfGetNextMapId to behave as bpfGetNextProgId,
+            // and thus it should return 0 with errno == ENOENT.
+            ALOGE("bpfGetNextMapId(final %d) returned %d errno %d", mapId, next, errno);
+            return 1;
+        }
+    } else {  // implies S/T with 4.9 kernel
+        // nothing we can do.
+    }
+
     // Create all the pin subdirectories
     // (this must be done first to allow selinux_context and pin_subdir functionality,
     //  which could otherwise fail with ENOENT during object pinning or renaming,
diff --git a/bpf/syscall_wrappers/include/BpfSyscallWrappers.h b/bpf/syscall_wrappers/include/BpfSyscallWrappers.h
index 43c3ac0f43..fe7b8c1345 100644
--- a/bpf/syscall_wrappers/include/BpfSyscallWrappers.h
+++ b/bpf/syscall_wrappers/include/BpfSyscallWrappers.h
@@ -251,6 +251,18 @@ inline int runProgram(const borrowed_fd &prog_fd, const void *data,
                });
 }
 
+// 4.14+: returns next id > prog_id, or 0 (and sets errno)
+inline uint32_t bpfGetNextProgId(const uint32_t prog_id) {
+    bpf_attr arg = { .start_id = prog_id };
+    return bpf(BPF_PROG_GET_NEXT_ID, &arg) ? 0 : arg.next_id;
+}
+
+// 4.14+: returns next id > map_id, or 0 (and sets errno)
+inline uint32_t bpfGetNextMapId(const uint32_t map_id) {
+    bpf_attr arg = { .start_id = map_id };
+    return bpf(BPF_MAP_GET_NEXT_ID, &arg) ? 0 : arg.next_id;
+}
+
 // BPF_OBJ_GET_INFO_BY_FD requires 4.14+ kernel
 //
 // Note: some fields are only defined in newer kernels (ie. the map_info struct grows

From f51c1857c71bba9de34db4893889a5643d14e754 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Sun, 8 Jun 2025 12:35:57 -0700
Subject: [PATCH 377/377] Fix netbpfload version info.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

(This is viable now that tethering prebuilt is from M-2025-07)

Test: TreeHugger
Flag: EXEMPT mainline
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I6aa58dc052fb292080032ec21fc3a92d718407ca
---
 bpf/loader/netbpfload.rc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/bpf/loader/netbpfload.rc b/bpf/loader/netbpfload.rc
index 420976a39c..ca7a8c1dba 100644
--- a/bpf/loader/netbpfload.rc
+++ b/bpf/loader/netbpfload.rc
@@ -1,6 +1,7 @@
-# 2025 2 36 0 0 1 # 25q3 sdk/api level 36.0 - Android 16 QPR1
+# 2025 2 36 0 1 # 25q3 sdk/api level 36.0 - Android 16 QPR1
 
 # Previous versions (for documentation)
+# 2025 2 36 0 0 1 # 25q3 sdk/api level 36.0 - Android 16 QPR1
 # 2025 2 36 0 0 # 25q2 sdk/api level 36.0 - Android 16 Baklava QPR0
 # (versions before A16 do not include anything here)