This doesn't do anything at this patchset, but the whole
pipe from the agent to ConnectivityService is built.
LocalNetworkInfo will be the name of the public information
sent in callbacks to clients.
Test: CSLocalAgentTests
Change-Id: I70e133031ef3b0aaf6c3e59ccc2ad895c66d339c
This patch does the following :
• When a network is local but the system doesn't support it,
throw in registerNetworkAgent.
• When a network is local, tell netd about it.
• Add tests for the above, as well as a test for callbacks
being sent correctly when the caps are set and not when
they aren't and that the new keep connected flag is
respected.
Telling netd about the network being local has it add two
routes that do not exist if the network is not local :
• One at PRIORITY_LOCAL_NETWORK matching unmarked sockets
and looking up the table for the interface.
20000: from all fwmark 0x0/0x10000 lookup xxxx
• One at PRIORITY_EXPLICIT_NETWORK matching explicitly on
network 99, so that dnsmasq traffic and any OEM traffic
marked for network 99 flowing there.
16000: from all fwmark 0x10063/0x1ffff iif lo lookup xxxx
IMPLICIT_NETWORK and EXPLICIT_NETWORK rules are installed
by connectivity service as a matter of course whether the
network is local or not.
See commit If8729fc6f3716a580c936584b851bc38000b5de5 for
implementation details of this mechanic.
There is no need to implement anything in particular for the
new connected reason, as the current implementation will
already keep it connected. A new test makes sure of that.
Test: FrameworksNetTests
CtsNetTestCases
FrameworksNetIntegrationTests
NetworkStackTests
NetworkStaticLibTests
TetheringTests
MtsTetheringTestLatestSdk
TetheringIntegrationTests
Change-Id: I6fb7dfe4c232eea8cac9ac268897ddb36bb794d1
* changes:
Ensure nri is satisfied before returning.
Add testLockdownVpn that mocks platform VPN.
Make variables in testLegacyLockdownVpn() final.
Update testLegacyLockdownVpn to mock VPN.
Hansen Kurliauthored and Gerrit Code Reviewcommited 2023-10-13 05:00:29 +00:00
When a network preference is set, the highest priority nri will
be a managed default request that disallows default networking.
In the case where there is no satisfying network,
mNoServiceNetwork is used as the satisfier instead of null.
(see computeNetworkReassignment)
mNoServiceNetwork should not be returned in any public API.
Check for the nri being satisfied before returning the satisfier
to ensure mNoServiceNetwork is not returned.
Fixes: 301222648
Test: atest FrameworksNetTests
Change-Id: I22d67a7e8d0274d8ad4f6123fbedf6d37eed18e7
Add a test for lockdown vpn that uses TYPE_IKEV2_IPSEC_PSK and
mocks platform VPN by override in startLegacyVpnPrivileged().
In the context of ConnectivityService, setVpnDefaultForUids()
is the main interaction.
Refactor testLegacyLockdownVpn to take a VpnProfile and assert
behaviors with and without setVpnDefaultForUids().
This includes:
1. Updating callback asserts and assertActiveNetworkInfo to
reflect setVpnDefaultForUids().
2. Adding TODOs where mCm.getActiveNetworkInfo() returns
unexpected values.
Bug: 230548427
Test: atest FrameworksNetTests
Change-Id: Ida4a4bc745af5ba2fc251795b2ffca56ead79b7f
The created handler thread will stay there for a while until
all the tests are finished. This is considered as a leakage
which will take the resource from the devices. In low end
devices, this may possibly impact the performance. The created
threads should be closed explicitly.
Test: atest ConnectivityCoverageTests ConntrackSocketTest
Change-Id: Ic1beb2a210e7c8c80c66fc9e0727c47599150672
* changes:
Prepare exposing Network{Request,Caps}.forbiddenCapabilities
Add a keep connected for test reason
Improvements to CSTest : legacy type, wait for LOST, permissions
Jean Chalardauthored and Gerrit Code Reviewcommited 2023-10-12 02:14:52 +00:00
This is useful going forward in particular because there will
be a default forbidden capability for LOCAL_NETWORKS. This
means it will be useful to be able to remove it.
It is also generally useful and we have been wanting to open
this API to the public, so this is a good opportunity to do so.
Test: new tests for NetworkRequest
NetworkCapabilitiesTest already has tests because it
already was @SystemApi
Change-Id: Ibb8d33b799f2d274326fd9cd0b05a2c33a18032a
This has been sorely needed for a while. Instead of filing requests
for each of your networks in a CSTest, which is fiddly at best and
sometimes almost impossible (because you can't single out the network),
you can now add this flag and be done with it.
Test: CSKeepConnectedTest
Change-Id: Ie168fe1f3a17de035fdf05e3d6580d3262a3448e
• Make sure all Agents have a legacy type. This is necessary to
avoid crashes in LegacyNetworkTracker
• Wait for LOST when disconnecting a network
• Make sure the test package sees its own permissions (importantly
it can't see background networks otherwise, because it lacks
CHANGE_NETWORKING_STATE)
Test: in the followup
Change-Id: I9f699b6372a8fe0d5bcd5310d8f35f72e48a6c61
service-connectivity-mdns-standalone-build-test builds the mDNS
discovery and advertisement implementation against API level 21.
This stops the advertisement code from calling new NsdServiceInfo
public or private APIs which are required by Thread.
This commit removes the mDNS advertisement code from the standalone
build to loose the check given this will never be used by GMS Core.
Bug: 265095929
Test: verified that it can build with aosp/2608627
Change-Id: I32cfce7b994d51a4b4ec468e9f79ffc2be6635ff
(in preparation for moving it into netbpfload)
The programs themselves (in bpf_progs/block.c) required a 5.4+ kernel.
We relax this restriction to 4.19+ as we don't have any 5.4 device coverage
(while the pixel 4a 5G / 5 / 5a are all 4.19 devices).
I believe we could relax it further to 4.14+ but Pixel 4/4xl/4a that
would exercise those code paths are EOL and probably have poor to
non existent test coverage, and we cannot do anything for 4.9 T devices
anyway.
Note: on <4.19 kernels (ie. T devices running 4.9/4.14, U running 4.14)
this results in ConnectivityNativeService going from null to initialized
(as the bpf map will exist).
This doesn't hurt as the set/clear port interfaces are only ever
called by vendor code on devices where the kernel doesn't support
the older mechanism. And even if you call them it will just set/clear
the bits in the bpf bitmap, they just won't actually affect anything.
We could flag the map itself as being 4.19+ as well, but I think
I prefer the no-op map to exist...
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I1085addd22f4f3b709e1875049633832c5dac836
Maciej Żenczykowskicommited 2023-10-06 14:31:20 -07:00
Override more VPN methods to mock the VPN interaction of
testLegacyLockdownVpn instead of relying on the Vpn class.
This includes:
1. Overriding startLegacyVpnPrivileged() and avoid creating
a VpnRunner.
2. Removing expectStartLegacyVpnRunner() since it is not
used when startLegacyVpnPrivileged() is overridden.
Bug: 230548427
Test: atest FrameworksNetTests
Change-Id: Id55d8d6cd03b84bca815cd331eb0f7d584eaed5f
In testLegacyLockdownVpn, remove the fail check on IPv6 networks
and add coverage in VpnTest instead as this interaction relies
on the Vpn implementation, not ConnectivityService.
Bug: 230548427
Test: atest FrameworksNetTests
Change-Id: Ib24809ece2332c4c3d3e08c168e02ad859242eac
The test coverage of LockdownVpnTracker has been moved to a
separate unit test file. testLegacyLockdownVpn now calls the Vpn
methods directly instead of creating a new LockdownVpnTracker.
Note this removes calls to expectStopVpnRunnerPrivileged since
stopVpnRunnerPrivileged is now directly called in the test so it
is already guaranteed to be called.
The expected calls/behavior of LockdownVpnTracker can be seen in
LockdownVpnTrackerTest.
Bug: 230548427
Test: atest FrameworksNetTests
Change-Id: Id9d26435bf62ffef954f6c7fa0558ce99540de1f
This is written based on observation that
testStartVpnProfileNoPreviousConsent()
appears to result in the right things happening when running
adb logcat | egrep --color -i 'Switched from |protect'
ie. it results in:
I netd : networkSetProtectDeny(<ctsappuid>) <0.01ms>
I Vpn : Switched from android.net.cts to [Legacy VPN]
I netd : networkSetProtectAllow(1000) <0.00ms>
Which disallows the CTS uid, and allows AID_SYSTEM.
That in turn appears to be the 'default' state of things.
So this basically copies that logic into tearDown()
Test: atest android.net.cts.{Ikev2VpnTest,VpnServiceTest} --iterations 2
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ic9cca56097d78ae48157e808081de2ebb76635e8
Maciej Żenczykowskicommited 2023-10-03 23:59:20 +00:00
For general internet access, a specialized slice is generally
not preferable to a non-specialized network.
Test: new test in this patch
Change-Id: I052ce923300566807999b2f20f5911181fb761dd
Jean Chalard
authored and
Gerrit Code Review
commited 
Hansen Kurli
authored and
Paul Hu
authored and
Krzysztof Kosiński
authored and
Kangping Dong
authored and
Maciej Żenczykowski
commited 
Treehugger Robot
authored and
Automerger Merge Worker
commited 
Motomu Utsumi
commited 
Chiachang Wang
authored and