From 0c67f3579f81799c13b439070ec321ceb2e6f9a1 Mon Sep 17 00:00:00 2001
From: Jacque Li <jacqueli@google.com>
Date: Wed, 12 Feb 2025 10:53:05 -0500
Subject: [PATCH] Set restrict local network aconfig flag for 26q2 dates

Local net protections is introduced in B as a developer opt-in, on dev
builds; the feature flag is meant to be used when enforcement begins in
2026

Bug: 396116600
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.connectivity.PermissionMonitorTest
Change-Id: Id5e7a7cf825f10f90edd600ea2567cfe6efd2e98
---
 common/flags.aconfig                                        | 2 +-
 service/src/com/android/server/BpfNetMaps.java              | 2 +-
 .../com/android/server/connectivity/PermissionMonitor.java  | 6 ++++--
 3 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/common/flags.aconfig b/common/flags.aconfig
index 5f279fa654..51b4fc009f 100644
--- a/common/flags.aconfig
+++ b/common/flags.aconfig
@@ -171,6 +171,6 @@ flag {
   is_exported: true
   namespace: "android_core_networking"
   description: "Flag for controlling access to the local network behind a new runtime permission. Requires ConnectivityCompatChanges.RESTRICT_LOCAL_NETWORK to enable feature."
-  bug: "365139289"
+  bug: "388774939"
   is_fixed_read_only: true
 }
diff --git a/service/src/com/android/server/BpfNetMaps.java b/service/src/com/android/server/BpfNetMaps.java
index c743573f45..4fae73a617 100644
--- a/service/src/com/android/server/BpfNetMaps.java
+++ b/service/src/com/android/server/BpfNetMaps.java
@@ -464,7 +464,7 @@ public class BpfNetMaps {
      ToDo : Remove this method when SdkLevel.isAtLeastB() is fixed, aosp is at sdk level 36 or use
      NetworkStackUtils.isAtLeast25Q2 when it is moved to a static lib.
      */
-    private static boolean isAtLeast25Q2() {
+    public static boolean isAtLeast25Q2() {
         return SdkLevel.isAtLeastB()  || (SdkLevel.isAtLeastV()
                 && "Baklava".equals(Build.VERSION.CODENAME));
     }
diff --git a/service/src/com/android/server/connectivity/PermissionMonitor.java b/service/src/com/android/server/connectivity/PermissionMonitor.java
index 0d388e89f0..737e27ae16 100755
--- a/service/src/com/android/server/connectivity/PermissionMonitor.java
+++ b/service/src/com/android/server/connectivity/PermissionMonitor.java
@@ -282,7 +282,8 @@ public class PermissionMonitor {
         mContext = context;
         mBpfNetMaps = bpfNetMaps;
         mThread = thread;
-        if (Flags.restrictLocalNetwork()) {
+        if (BpfNetMaps.isAtLeast25Q2()) {
+            // Local net restrictions is supported as a developer opt-in starting in Android B.
             // This listener should finish registration by the time the system has completed
             // boot setup such that any changes to runtime permissions for local network
             // restrictions can only occur after this registration has completed.
@@ -1330,7 +1331,8 @@ public class PermissionMonitor {
             // Flags.restrictLocalNetwork() is used to offer the feature to devices, but it will
             // only be enforced when develoeprs choose to enable it.
             // TODO(b/394567896): Update compat change checks
-            if (CompatChanges.isChangeEnabled(RESTRICT_LOCAL_NETWORK, uid)) {
+            if (CompatChanges.isChangeEnabled(RESTRICT_LOCAL_NETWORK, uid)
+                    && BpfNetMaps.isAtLeast25Q2()) {
                 // TODO(b/388803658): Update network permissions and record change
             }
         }