Follow up from aosp/1781202 and aosp/1821293, creating nris
before removing old nris had been proven not necessary for
per-app API flow. Hence, the per-uid counter hack for system
uid that allows counter temporary go over limit does not
actually be used in the production code.
In other words, this CL is a no-op refactoring.
Test: testRequestCountLimits
Bug: 235771502
Change-Id: I8f71c6e4506fbec60cb503731aee64ab022b4634
This is a no-op refactoring. This will be useful to
mutate a member of the NC before sending it to the app.
Test: ConnectivityServiceTest
Change-Id: I1cf472bd7626d5ee2b163078a695c4a52ac39085
Chalard Jeanauthored and Paul Hucommited 2022-08-04 06:45:39 +00:00
These are no longer useful. Also, NAI no longer needs to
be comparable, and it should no longer be – comparing 2
NAIs only make sense in the context of a specific request.
Bug: 238139913
Test: ConnectivityServiceTest IpConnectivityMetricsTest
Change-Id: I6967ad6f08380213c29f3d47d6422f8bbea1946c
Chalard Jeanauthored and Paul Hucommited 2022-08-04 06:45:39 +00:00
Unused arguments, non-final members, unannotated members, typos.
This doesn't try to remove all warnings, but just opportunistically
fixes some.
Bug: 238139913
Test: ConnectivityServiceTest
Change-Id: Ia5e905a0244cfb5f72c06d0c0be3458c42b27a52
Chalard Jeanauthored and Paul Hucommited 2022-08-04 06:45:39 +00:00
These objects have a non-trivial lifetime, as they will be
stored while the NetworkMonitor (which lives in another
process) starts. Agents that live in the system server will
still have a reference to the passed arguments and might
want to keep and mutate them for their own purposes. To
avoid bad surprises, ConnectivityService should copy these
objects before the function returns.
This patch should not cause any additional copies, because
the copies that used to happen after the monitor has started
are now not necessary and are removed.
Bug: 238139913
Test: FrameworksNetTests
Change-Id: I1cdd14e7a247dc01a3d73f528c3f3d77bd103be5
Chalard Jeanauthored and Paul Hucommited 2022-08-04 06:45:39 +00:00
To make sure anyone using the capabilities originally from
the agent have to know what they're dealing with, make the
member private and make accessors that spell out explicitly
the important parts.
This is the last step towards addressing the leftover
comment from aosp/1958906.
Bug: 238139913
Test: FrameworksNetTests CtsNetTestCases
Change-Id: I9fc1986c59726212acfc2ad921745c8bbc424035
Chalard Jeanauthored and Paul Hucommited 2022-08-04 06:45:39 +00:00
Once moving NetworkMonitorUtils to frameworks/libs/net is done, we can
remove the connectivity-module-utils-srcs filegroup from connectivity
module, instead import it from net-utils-device-common lib.
Bug: 238960524
Test: atest ConnectivityCoverageTests
Change-Id: Ic1464a4c32d7c22ca7916e8f298ff1a09b71ce46
Following CLs will switch previous codepath (JNI) and new codepath
(Java) for bpf map operations based on this flag.
Bug: 217624062
Test: atest BpfNetMapsTest
Change-Id: I74f10d5c97390993acea110f6528ef8980bb2aa4
This will move to NetworkAgentInfo. The caps argument is always
the same and can be removed, while the nai argument will become
'this'. The authenticator will need to be passed.
This is a second step towards addressing the leftover
comment from aosp/1958906.
Bug: 238139913
Test: FrameworksNetTests CtsNetTestCases
Change-Id: Ife5e91de15d0571f1251d2cd6f1b3ecc256572c6
Chalard Jeanauthored and Paul Hucommited 2022-07-27 10:45:26 +00:00
This is a first step towards addressing the leftover
comment from aosp/1958906.
Bug: 238139913
Test: FrameworksNetTests CtsNetTestCases
Change-Id: I46c5dfebfc12c4db71f7c9c6624b8d6cdf0bf3b5
Chalard Jeanauthored and Paul Hucommited 2022-07-27 10:31:30 +00:00
"{@see" aren't rendered properly. Replace them with "See {@link"
or @see depending on the usage.
Bug: 238753273
Test: make doc-comment-check-docs ; Check the doc result
Change-Id: I70cb2f36e7c5fa8102b5949054df5184d755202c
Currently (T+), BPF program and map status are only dumped on demand.
$ adb shell dumpsys connectivity trafficcontroller
The information can be useful for issue debugging, especially on Data
Usage and NetworkPolicyManagerService. It should be logged in bugreport
dumpsys connectivity section as Android S (which is handled by netd).
Bug: 237954856
Test: adb bugreport
Change-Id: Ic02a58ff2ebdbf375d9df0917e8218ab8faa96da
This commit adds ConnectivityManager#getFirewallChainEnabled to read the
current firewall chain status
Bug: 208371987
Test: m
Change-Id: I1eadb69f953af5d031cd8dabde3e1f098cf0f4df
NetworkMonitorManager should just be a passthrough wrapper for
INetworkMonitor. Move logic to choose the notifyNetworkConnected version
to call to its only caller, ConnectivityService.
This allows removing the dependency on modules-utils-build, which makes
the networkstack-client library less portable; for example it would add
duplicate classes if networkstack-client is included into service-wifi,
as service-wifi can already use modules-utils-build from framework-wifi.
Fixes: 227161380
Test: atest ConnectivityServiceTest
Change-Id: Ie50f586c5d1ffe021cb0a96294f13f478fd3a2dd
This is a followup commit for aosp/2017317.
1. Reorder the NAT464 information in dumpsys connectivity
2. Reword message when clat not started
Bug: 212345928
Test: dumpsys connectivity
Change-Id: I31c7066787dc7db8e5fe225f3918368b25bb7f5e
Hungming Chenauthored and Nucca Chencommited 2022-05-18 14:49:57 +00:00
Allow ethernet factories on automotive devices to set the allowed UIDs
on NetworkCapabilities.
Bug: 229419469
Test: atest FrameworksNetTests
Change-Id: I03e7cda75f1c530e0d0e4a756330bc9847a96668
(out of current /sys/fs/bpf/net_shared/...)
This will allow genfscon regexp changes in a followup selinux commit.
Note that this has a hard dependency on system/bpf change
'bpfloader: add support for netd_shared and net_private subdirs'
which also bumps bpfloader to v0.13.
This was merged May 12, 2022 (into both aosp/master and tm-dev)
and it is in Android T starting with Beta 3 release.
This isn't really an issue since amusingly T Beta 2 is already
incompatible with current mainline releases due to the snap
reverting a previous required bpfloader system/bpf change:
move net_shared bpf programs into net_shared subdirectory
See: http://b/232050459#comment14
So this doesn't break T Beta1/2, since they already don't work,
and Beta3 will work.
Bug: 218408035
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Id5f14d6e3f11cfe35d9d8a9496548a2bc4d022ec
Maciej Żenczykowskicommited 2022-05-16 23:24:37 +00:00
Currently, even when VPN Lockdown mode is enabled, incoming packets are
not dropped if VPN is not connected.
This commit fixed this issue.
After this commit, If VPN Lockdown mode is enabled, incoming packets
are dropped regardless of the VPN connectivity.
Bug: 206482423
Test: atest TrafficControllerTest ConnectivityServiceTest PermissionMonitorTest
Change-Id: If52ece613c8aac1073355e43b6fb9cb3fcc87d1d
Currently, there is no limtation for an app to request
data usage callback, which is dangerous if the app fire
hundreds of thousands requests and potientially this might
cause OOM if the apps don't free them.
Test: atest NetworkStatsObserversTest#testRegister_limit
Bug: 229103088
Change-Id: I8299f46fd47a82ec9b25ba2e0d3c95db5512c331
1) alowFallback flag was incorrectly not reset while setting profile
preference. Corrected it.
2) Threw exception if default preference and enterprise preference are
set together
3) renamed clearUser to withoutUser
Bug: 231670730
Test: ConnectivityServiceTest
Change-Id: Iaf49237bdc791c7e1dd884d069eff64e74757477
Normally if an app calls requestNetwork with capabilities that it
does not have permission to request, it gets a SecurityException,
except if it requests NET_CAPABILITY_CBS, in which case the request
will not throw but the app will get an onUnavailable callback.
Make this codepath throw as well. This simplifies the code and makes
the app-visible behaviour more consistent (and consistent with what
happens in S and below). The reason the code was written this way is because the carrier privilege app should receive a callback if it
loses permission. But onUnavailable is also not the best callback to
send, since it is used very rarely and also releases the app's
request. It seems better to leave the request registered and send
onLost.
Test: atest FrameworksNetTests
Bug: 194332512
Change-Id: I5eaeb415a6654851246e38599a996fbd9366fde0
junyulaiauthored and Paul Hucommited 2022-05-10 10:26:54 +00:00
Since 3p apps are allowed to use restricted networks in S, they
should be allowed to request a restricted network reasonably.
Otherwise, the functionalities of 3p apps will break if they rely
on restricted networks. Thus, CS needs to allow 3p apps to
request restricted networks if 3p apps are in the allowed list.
Bug: 230509118
Test: atest FrameworksNetTests CtsNetTestCases
Change-Id: I236f1550095ee2be29adbc3b28d3ac2561a8b072
Multiple enterprise slice can be setup within single user profile based
on different uids. So do not remove profile network preference with same
user profile but with different uids
Bug: 229644102
Test: manual system test and ConnectivityServciceTest
Change-Id: I897b643e01240958fff575de9e15182069efc698
isMangedProfile returns true for managed profiles.
But enterprise device can be fully managed like device owner.
Hence check specifically if request is coming on fully managed
device.
Bug: 226966328
Bug: 231071836
Test: ran DevicePolicyManager CTS and ConnectivityServiceTest
Change-Id: I7827466bd61e24ba9c36c3a2e25043257e2ed602
Xiao Ma
authored and
Gerrit Code Review
commited 
Junyu Lai
commited 
Chalard Jean
authored and
Paul Hu
commited 
Motomu Utsumi
commited 
Chiachang Wang
authored and
Ken Chen
commited 
Remi NGUYEN VAN
authored and
Treehugger Robot
authored and
Hungming Chen
authored and
James Mattis
commited 
Maciej Żenczykowski
commited 
Sooraj Sasindran
authored and
Prerana Patil
authored and