On V+, this capability is set by default.
Constrained satellite networks never become the system default network.
Test: CSSatelliteNetworkTest
Bug: 343823469
Change-Id: I020ba48e74f1f180e1807cbe1c066209bedb0454
Add a DeviceConfig flag that will be used to control whether callbacks
should be sent selectively based on whether the receiving method has
been overridden (will be implemented in a future change).
This adds utilities to allow ConnectivityManager to check whether a
ConnectivityService flag is enabled, as that feature will work across
ConnectivityManager and ConnectivityService. ConnectivityManager runs in
app process and does not necessarily have permissions to use
DeviceConfig. Also if it checked DeviceConfig separately from
ConnectivityService, values may be out-of-sync.
Test: atest, and see change using this
Change-Id: I204fa719cc627e84edc5c1e043d947f5ef3f8dee
When new capability is introduced and added to capaility or
forbiddenCapability by default, module rollback could cause system
server crash since JobScheduler persists network request that contains
new capability that is invalid for old code.
This CL updates capability validation not to throw exception to avoid
system crash in this case.
Bug: 343823469
Bug: 313030307
Test: NetworkCapabilitiesTest
Change-Id: I5708c475f3b4974284531212b77f9788ca9f497e
This reverts commit ee96ba0e60.
Reason for revert: Droidmonitor triggered revert due to b/342557183. Will be verifying through ABTD before submission.
Change-Id: I7e185c3ac11da27c7bb9d95e4221f7dfc22cf48c
Priyanka Advaniauthored and Gerrit Code Reviewcommited 2024-05-24 18:11:45 +00:00
Currently, even if apps don't have INTERNET permission and can not use
network, network access is considered not blocked and
ConnectivityService send onBlockedStatusChanged callback with
blocked=false.
This CL introduced BLOCKED_REASON_NETWORK_RESTRICTED and consider
network access from apps targetting W+ on V+ releases is blocked if apps
don't have INTERNET permission.
Permission is set when the user is added or package is installed and
permission is removed when the user is removed or packages is
uninstalled.
So ConnectivityService does not need to monitor permission change to
send onBlockedStatusChanged callback by permission change.
Test: CSBlockedReasonsTest
Bug: 339559837
Change-Id: I58d2a4eddc714e205f5b96219f95b637f2826c58
This allows apps built against V but run on older platform
can adopt this feature. This keep compatibility for older
apps which does not built against newest platform.
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.net.NetworkStatsServiceTest
Fix: 339154075
Change-Id: Ia12997595579190ae0d65ad36ce39d011dde37ce
NETWORKINFO_WITHOUT_INTERNET_BLOCKED compat flag only changed the
behavior of getActiveNetworkInfo that depends on
bpfNetMaps#isUidNetworkingBlocked.
But isUidNetworkingBlocked is used from other APIs(e.g. getActiveNetwork)
This CL update all APIs that depends on isUidNetworkingBlocked to follow
the compat flag to make behavior consistent between APIs.
aosp/3079290 will update onBlockedStatusChanged callback to follow this
compat flag.
Bug: 340773991
Bug: 339780435
Test: TH
Change-Id: If64ec800f21c2adc613884838202e2dece4a8d95
Before aosp/3001087, getNetworkActiveInfo did not return network info
with blocked state for apps without PERMISSION_INTERNET even if the
network is actually blocked.
aosp/3001087 updated getNetworkActiveInfo to return correct blocked
state on V+.
However, this broke some apps that use getNetworkActiveInfo in wrong way
and depends on the previous behavior.
So this CL introduces the compat flag to keep previous behavior for apps
targeting U or older releases.
Test: TH
Bug: 333340911
Change-Id: I0e0950f2148de0ffdb45495903a5a87e0d4c1c0b
FIREWALL_CHAIN_OEM_DENY_x chains were added by aosp/2114533 but
corresponding blocked reasons were not added.
Upcoming aosp/3027488 updates CS to generate blocked reasons based on
bpf map contents.
Without blocked reasons for oem deny chains, onBlockedStatusChanged
callback will have inconsistency from the actual network blocked status.
This CL adds BLOCKED_REASON_OEM_DENY for FIREWALL_CHAIN_OEM_DENY_x chains
Bug: 328732146
Test: TH
Change-Id: I3793aa0e231d32fea5eb202ed69e170f74d66b02
With this annotation, errorprone build will fail if callers don't check
sdk version before calling any methods in BpfNetMapsUtils.
Bug: 328732146
Test: TH
Change-Id: Ifa52dc1d2766f8d46dfdc4f6ca9dbb963406c084
Follow up CLs will update CS to generate blocked reason from bpf map
instead of asking NPMS.
However, one issue is NPMS set PENALTY_BOX for
BLOCKED_METERED_REASON_USER_RESTRICTED and
BLOCKED_METERED_REASON_ADMIN_DISABLED without telling the reason.
So, CS can not know the reason of PENALTY_BOX.
This CL add new firewall chain and match to distinguish reasons.
NPMS must call setUidFirewallRule with
FIREWALL_CHAIN_METERED_DENY_USER or FIREWALL_CHAIN_METERED_DENY_ADMIN
based on the reason so that CS can know the reason of restriction.
Bug: 332628891
Test: atest com.android.cts.net.HostsideRestrictBackgroundNetworkTests
Change-Id: Ia4ad4bdb345abc22c782630e828edfad2452db36
Update isUidNetworkingBlocked to return false for system uids regardless
of firewall chain status since this is an actual behavior
Bug: 328732146
Test: TH
Change-Id: Ic4760b927f51a1229e9af09c79b5261f85fe89d1
This CL also adds @RequiresApi(Build.VERSION_CODES.UPSIDE_DOWN_CAKE)
to NetworkStackBpfNetMaps
Bug: 328732146
Test: TH
Change-Id: Ifa4cffd046164405b8b49d2e2ee9f27240bec6fa
This is a preparation to add isUidNetworkingBlocked method to BpfNetMaps
without duplicating codes.
Bug: 328732146
Test: TH
Change-Id: I50a46931f6c80a1f4cfca5d9e78b2ab742a793f2
Allows compiler to turn some conditionals into constant
expressions and to simply the machine code.
Bug: 326744138
Change-Id: Ic0abed8c548986fe7ef1876bd1eb3e55ac6b8c10
BpfNetMapsReader is loaded to bootclasspath. So this class should not
contain unnecessary codes.
To make this clear, this CL renames to NetowrkStackBpfNetMaps and add
comments
Bug: 328732146
Test: TH
Change-Id: I557627c9fae087eb6119c2ae31d46526fa9e5d7e
aosp/2873154 disabled DEFAULT_FORBIDDEN_CAPABILITIES to avoid crash when
the module rolls back.
DEFAULT_FORBIDDEN_CAPABILITIES was introduced to avoid existing users
getting callback from local networks.
But aosp/2936050 fixed this issue by introducing compat flag.
So this CL cleans up DEFAULT_FORBIDDEN_CAPABILITIES code
Test: TH
Bug: 319212206
Change-Id: I125800cb3dd029f190056c8715ab9a741a83a234
Apps that target an SDK before V will not see networks with
NET_CAPABILITY_LOCAL_NETWORK unless they explicitly set this capability
in their network requests.
Bug: 319212206
Test: CSLocalAgentTests
Change-Id: I414b03dfea9a8aac83304c6be501f03d637739b4
- Allow adding two non test transports i.e. satellite and cellular
at setNetworkSpecifier, to receive network requests related to
satellite transport capabilities
Bug: 324347502
Test: atest FrameworksNetTests
Change-Id: I03a3d701e214792184bacfe5b5b59cdef61d555e
This change is a follow-up from aosp/2970991. The kernel bug
can trigger crashes on some T devices. Therefore, bumping the
required API level is necessary.
No CTS modification since the check doesn't exist in
pre-U CTS releases.
Test: atest CtsHostsideNetworkTests:com.android.cts.net.HostsideNetworkCallbackTests
Bug: 326143935
Change-Id: I63796f25315ee9f966dd5bf0afd2240b1ed456e1
This commit also updates to use V14 dnsresolver APIs which was V13.
Bug: 320514105
Test: m & atest FrameworksNetTests
Change-Id: I6e92f4d99e0eba3b5d1d5e45bf11e5e945ea43f1
This CL allows the Carrier Config app to request restricted WiFi nework
by setting the correspoding subscription ID in the network request.
Bug: 315835605
Test: atest android.net.cts.NetworkRequestTest
atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.connectivity.CarrierPrivilegeAuthenticatorTest
atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.ConnectivityServiceTest
Change-Id: I237e692d092ff5f969ce4b7962f6d58099a6f3a9
Apps that target an SDK before {@link Build.VERSION_CODES.VANILLA_ICE_CREAM}
will not see networks with this capability unless they explicitly set the
NET_CAPABILITY_LOCAL_NETWORK in their NetworkRequests.
In this way, `NET_CAPABILITY_LOCAL_NETWORK` should be public.
Bug: 313000440
Test: None
Change-Id: I44d9cf3ecf5da471a627696f3d2680f35d4b122d
Handa Wangauthored and Motomu Utsumicommited 2024-02-07 17:23:42 +09:00
Bug: 319532485
Test: Verified the return value on husky(64-bit kernel)
and mokey_go32 (32-bit kernel)
Test: NetworkUtilsTest#testIsKernel64Bit
Change-Id: I929ce23932698b44a72ce4f35e2bd5a41ba472ee
Follow-up from aosp/2856948, the data saver status value is
filled by ConnectivityService before Android V. Thus, calling
BpfNetMapsReader#getDataSaverEnabled() is a legit use case, which
should not trigger log.wtf.
Remove the check accordingly.
Test: TH
Bug: 314858283
Fix: 316839561
Change-Id: I90c85ab98fbefd1f99ec799a4eec8d1d0cfd47b0
This causes the module to crash on rollback because the current
production code does not consider LOCAL_NETWORK to be a valid
capability.
Change-Id: Idf57d72c384b41b483098c4c302738072ebf7f90
Test: TH
Fix: 313030307
Lorenzo Colittiauthored and Remi NGUYEN VANcommited 2023-12-13 11:24:25 +09:00
Yuyang Huang
commited 
Motomu Utsumi
authored and
Gerrit Code Review
commited 
Remi NGUYEN VAN
authored and
Junyu Lai
authored and
Maciej Żenczykowski
authored and
Priyanka Advani
authored and
Treehugger Robot
authored and
Lorenzo Colitti
commited 
Shai Barack
authored and
Nagendra Prasad Nagarle Basavaraju
commited 
Yan Yan
commited 
Ying Xu
commited 
Handa Wang
authored and