PermissionMonitor#hasPermission only checks permssions that app
requested but it doesn't check whether the permission can be
granted to this app. If requested permission doens't be granted
to app, this method still returns that app has this permission.
Then PermissionMonitor will pass this info to netd that means
this app still can use network even restricted network without
granted privileged permission like CONNECTIVITY_INTERNAL or
CONNECTIVITY_USE_RESTRICTED_NETWORKS.
PermissionMonitor#hasUseBackgroundNetworksPermission only uses
the first package name of the uid for checking permission.
This is incorrect since each package declared different
permissions. So using the mApps which already checked both
network and using restricted network permissions. If uid is in
the mApps list that means uid has one of permission at least.
Bug: 144679405
Test: Build, flash, manual test
atest FrameworksNetTests
Change-Id: I2da730feda4d7ebed1f158b073167bb3964b3e7d
Merged-In: I8b03c9e23ffc9ff46264d6307fb841a7eda76a76
Merged-In: Ib08a940a6e5d3365c392ab7174d8484c197e0947
(cherry picked from commit 2dd1f14da1)
Paul Huauthored and paulhucommited 2019-12-19 13:43:40 +08:00
The "Connected" notification would be shown every time a network
validates after being identified as a captive portal. This causes issues
on networks that have auto-login mechanisms, as a high priority
notification would be shown even though the user was not interacting
with the phone.
The "Connected" notification is intended to confirm to the user that
they successfuly logged in (manually), so only show it after the user
opens the portal on the network.
Bug: 134124044
Test: Flashed, connected to portal: notification shown
Opened portal from command line + revalidate: no notification
Tests passing with change, failing without
Merged-In: I99be7d312d020d242081971c7e522023bbbab072
Merged-In: I7dc1b3a313b255fe89313efb9117bb160efdb533
(cherry picked from commit 0b5a4d862190320d285413b1feb921144fee8420)
Change-Id: I67c124cc34f09c2f186706b5cec839f60d00a90a
This reverts commit ee48ac4abd.
Reason for revert: This change has been implicated in 4-way deadlocks as seen in b/134244752.
Bug: 134244752
Change-Id: Ibdaad3a4cbf0d8ef1ed53cfab1e454b9b878bae9
Benedict Wongauthored and Lorenzo Colitticommited 2019-06-07 09:18:01 +00:00
This reverts commit df34063a17.
Reason for revert: This change has been implicated in 4-way deadlocks as seen in b/134244752.
Bug: 134244752
Change-Id: I0c00e8f0e30cee987b71b561079a97bf09d4dae4
Benedict Wongauthored and Lorenzo Colitticommited 2019-06-07 09:17:47 +00:00
This reverts commit 8031acad0e.
Reason for revert: This change has been implicated in 4-way deadlocks as seen in b/134244752.
Bug: 134244752
Change-Id: I5fbb3443a39a21fc9d96442726cd10d20e8d61cd
Benedict Wongauthored and Lorenzo Colitticommited 2019-06-07 09:17:31 +00:00
This reverts commit 54bb4f4608.
Reason for revert: This change has been implicated in 4-way deadlocks as seen in b/134244752.
Bug: 134244752
Change-Id: I64b48d575f2e6ec4cb7d2d100a859a30af0501dc
Benedict Wongauthored and Lorenzo Colitticommited 2019-06-07 09:16:48 +00:00
Split-tunnel VPN (which are the only ones affected by this change)
always fall through to the default network for routes they don't
handle, and even if the underlying network(s) don't provide access
this may be a pinhole that can actually reach the broader network.
In practice this behaves like the original release of P and is the
safest thing to do for Q. In R we should evaluate giving the VPN
app the ability to simply tell the network stack whether it does
provide Internet access or not.
Bug: 119216095
Test: FrameworksNetTests NetworkStackTests
Change-Id: I262ca41fe0225660551c9a421562405366b6acac
Merged-In: I262ca41fe0225660551c9a421562405366b6acac
(cherry picked from commit 6d5a4a3b1d1c69eb8a542fecf5e8a306822c19b7)
Chalard Jeanauthored and Lorenzo Colitticommited 2019-05-30 08:54:35 +00:00
* changes:
Add one more test for VPN usage stats.
Addressing comments for http://ag/7700679.
NetworkStatsService: Fix getDetailedUidStats to take VPNs into account.
Take all VPN underlying networks into account when migrating traffic for VPN uid.
Varun Anandauthored and Android (Google) Code Reviewcommited 2019-05-29 16:34:14 +00:00
Covers the case where the majority of traffic through the VPN is
caused by the VPN app itself, and ensures that that traffic is
correctly attributed to the VPN app as opposed to spread between
the other apps that use the VPN.
Bug: 120145746
Test: atest NetworkStatsServiceTest
Change-Id: Iffd3f95fc2e11d311691a797b010edb38d2ef3c6
Lorenzo Colitticommited 2019-05-29 19:57:43 +09:00
Note, that its in a separate CL so we could cherry-pick this CL to aosp.
http://ag/7700679 is already in aosp.
Bug: 113122541
Bug: 120145746
Test: atest FrameworksNetTests
Change-Id: I7cfda226b4ed11b67002b83b38fba0f5caf96718
Varun Anandauthored and Lorenzo Colitticommited 2019-05-29 18:15:34 +09:00
(cherry picked from commit 23e1e5e300)
This API is similar to one provided by NetworkStatsFactory with the
difference that NSS also migrates traffic from VPN UID to other apps.
Since traffic can only be migrated over NetworkStats delta, NSS
therefore maintains NetworkStats snapshot across all UIDs/ifaces/tags.
This snapshot gets updated whenever NSS records a new snapshot
(based on various hooks such as VPN updating its underlying networks,
network getting lost, etc.), or getDetailedUidStats API is invoked by
one of its callers.
Bug: 113122541
Bug: 120145746
Test: atest FrameworksNetTests
Test: manually verified that battery stats are migrating traffic off of
TUN (after patching above CL where we point BatteryStats to use this
API).
Change-Id: I4b8d7c5b6905a4a12c1806dfd35c2c4c63610404
Varun Anandauthored and Lorenzo Colitticommited 2019-05-29 18:15:24 +09:00
VPN uid.
(cherry picked from commit 2dbf6e6978)
Bug: 113122541
Bug: 120145746
Test: atest FrameworksNetTests
Test: Manually verified on device that stats from VPN UID are moved
appropriately based on its declared underlying network set.
Test: vogar --mode app_process --benchmark NetworkStatsBenchmark.java
Change-Id: I7f368c5970b2dcb969fe0daf5ef44edb1f51d09d
Varun Anandauthored and Lorenzo Colitticommited 2019-05-29 18:15:17 +09:00
Also :
- Fix testUidFilteringDuringVpnConnectDisconnectAndUidUpdates that
was failing on devices with a first released SDK >= Q
- Add a test actually tests that the system has the permission, as
the test was only testing what's in the mock
Bug: 119770201
Test: New test making sure this stays true
Merged-In: I74cf5f0fa17fcf818f1fed78c7e3e4375c20152e
Change-Id: I0daa644fbad8e389ad7cfa66c0e3b3480c8bb50a
(cherry picked from commit 629b49d58fe8d108a3d7d47a21471aff913c6b34)
This test is conitnuely fail in cuttlefish.
Lack of ipv6 default route in cuttlefish caused the test failed.
The reason is that the result of rfc6724Sort depends on on the route in system.
It is not good to expect any route should exists, so remove it.
Bug: 133649648
Test: atest DnsUtilsTest
Merged-In: Idc6db433585de067e45088b43665c8e37b310397
(cherry picked from commit 91b35f88429d77ddce0e3f539690e6370b89915b)
Change-Id: Idb6f4c094d3466772e3bfc98a57505bf38f381ef
This is a follow-up commit for aosp/955431 to update commets
and minor updates in unit test.
Test: atest com.android.server.ConnectivityServiceTest#testCaptivePortalOnPartialConnectivity
Bug: 130683832
Change-Id: I581eae8daeddd2c4c186e7b40e27fef2aaa7ab43
Merged-In: I9087ef791b3fee5399ba8e83ef9d8a544845a4dd
Merged-In: I4424663292c5ad29eb7a888fa6975835721a5d2e
(cherry picked from commit 3d3a9fff7b7fa0df4ee627cb082668e642d6f754)
Once a network is determined to have partial connectivity, it
cannot go back to full connectivity without a disconnect. This
is because NetworkMonitor can only communicate either
PARTIAL_CONNECTIVITY or VALID, but not both. Thus, multiple
validation results allow ConnectivityService to know the real
network status.
Bug: 129662877
Bug: 130683832
Test: atest FrameworksNetTests
Test: atest NetworkStackTests
Test: atest --generate-new-metrics 50
NetworkStackTests:com.android.server.connectivity.NetworkMonitorTest
Test: Simulate partial connectvitiy
Change-Id: I406c9368617c03a2dd3ab15fb1f6dbf539d7c714
Merged-In: I243db4c406cca826e803c8035268bc0c6e6e01e2
(cherry picked from commit 4532abd4d2af9ad118873a63cafc6028ed87c52e)
When unregistering callback due to ON_UNAVAILABLE did not check for
a non-null callback.
Bug: 132950880
Test: atest ConnectivityServiceTest
Merged-In: Ib3fde31d88c36469cdee1e3578606d130a9817cb
Change-Id: Ib3fde31d88c36469cdee1e3578606d130a9817cb
(cherry picked from commit 51ddc176abd23bd3ddbc26124e5541a983a1db07)
1. pass default network explicitly to fix potential
mis-sync network problem in DnsResolver#query
2. Add rfc6724 sort and related test
3. DnsResolver do rfc6724 sort before response InetAddress answers
4. move haveIpv* function from DnsResolver to DnsUtils
Bug: 129530368
Test: atest DnsResolverTest DnsUtilsTest
Merged-In: I0323f5c7f32fc3fa589b9e87f8e7c9caf744dbd4
(cherry picked from commit d352f4ca85ff8418a5a58d32fb03b85d7e0b843b)
Change-Id: I98455045fa43cc5a5902a08232251c1734feaac3
Our stable AIDL interfaces need to use versioned build targets,
otherwise getVersion will always return 0, which makes it
impossible to support different components at different versions.
List generated with:
find . -name Android.bp -exec egrep \
-H "(netd|dnsresolver|ipmemorystore|networkstack).aidl.interface(s?)-(java|cpp)" {} \; \
| grep -v oemnetd | grep -v tests/
Test: m
Bug: 133124190
(cherry-pick from aosp/968011)
Merged-In: Idf49e840263ef32b9ee4fafa6718d4f893ea7c87
(cherry picked from commit 433f7c4178aaadac7d6a5f6727f39ef83342d436)
Change-Id: I77e2291b52fda24ee01e1b22ddafe4fe7368959e
Lorenzo Colittiauthored and Remi NGUYEN VANcommited 2019-05-23 07:43:47 +00:00
Delete the unused NetworkManagementService API for set/remove
permissions. Use PERMISSION_NONE to replace NO_PERMISSIONS so the
framework now use the same set of permission constant when communicate
with netd.
Bug: 128944261
Test: PermissionMonitorTest.java
Change-Id: I25224c9576f52d2a0a0bd2182325c7aac7b28eb5
Merged-In: I25224c9576f52d2a0a0bd2182325c7aac7b28eb5
(cherry picked from commit 05887f99c6ca6885db737af2f356023dc6de80a2)
Currntly, keepalive slot is released when stop() is called. Next
starting keepalive can use the same slot number while previous
keepalive is still stopping. When the previous keepalive is
stopped, the incoming as will be processed by the new keepalive.
This change release keepalive slot after the result of stopping
has returned. Thus, newly created keepalive cannot allocate the
same slot number while lower layer is still processing stop event.
This change also disable flaky assertions that are caused by
test port has been occupied by other process.
Bug: 129512753
Test: 1. atest com.android.server.ConnectivityServiceTest \
#testNattSocketKeepalives --generate-new-metrics 100
2. atest FrameworksNetTests --generate-new-metrics 10
3. simulate the fail case manually.
Change-Id: I790f6bbc5efc3f088034ac45ec379da5f781d0ca
Merged-In: I1991627545519ee5cb408a3df3a006f710f4af7b
(cherry picked from commit 4b0556df84)
Junyu Laiauthored and junyulaicommited 2019-05-13 18:42:19 +08:00
This change specifies the required minimum supported keepalives
in SDK, and allows OEMs to customize supported keepalive count
per network through resource overlay.
Bug: 129371366
Test: 1. m -j doc-comment-check-docs
2. atest FrameworksNetTests
Clean cherry-pick of aosp/946359
Change-Id: I06840834d0ee8121358bf4829fe47ecf9964d395
Merged-In: I0218f3674628c13ead63fc9a873895ba7f113033
Merged-In: Ia667386c1a8949839871a6949d79552d9c8b88f0
junyulaiauthored and Chalard Jeancommited 2019-05-13 15:52:07 +09:00
Currently, strict mode private DNS does not work on VPNs because
NetworkMonitor does not validate VPNs. When a VPN connects, it
immediately transitions to ValidatedState, skipping private DNS
hostname resolution.
This change makes NetworkMonitor perform private DNS hostname
resolution and evaluation even on VPNs.
In order to ensure that the system always immediately switches to
the VPN as soon as it connects, remove the unvalidated penalty
for VPN networks. This ensures that the VPN score is always 101
and the VPN always outscores other networks as soon as it
connects. Previously, it would only outscore other networks
when no-op validation completed.
Bug: 122652057
Test: atest FrameworksNetTests NetworkStackTests
Test: manually ran a VPN with private DNS in strict mode
atest android.net.cts.ConnectivityManagerTest com.android.cts.net.HostsideVpnTests
Change-Id: Iaa78a7edcf23755c89d7b354edbc28d37d74d891
Merged-In: Iaa78a7edcf23755c89d7b354edbc28d37d74d891
(cherry picked from commit 414b8c8b1ce8ae2ad6ef95c1ffba19062077d3e6)
Chalard Jeanauthored and Lorenzo Colitticommited 2019-05-10 13:09:00 +00:00
The onUnavailable semantics promise that it is equivalent to calling
the unregister callback method. But - it doesn't unregister the callback
allowing it to be reused. Fixed.
Additionally, modified the unregisterNetworkCallback method to not fail
on duplicate unregistration (since a callback could now self
unregister). Instead simply print a log.
Bug: 130651445
Test: atest ConnectivityServiceTest
Merged-In: I4c54b003a733eb0b1e4fd8674ed13081b1bef8e3
Change-Id: I4c54b003a733eb0b1e4fd8674ed13081b1bef8e3
This patch adds checks to ensure that the IPSEC_TUNNEL feature flag is
enabled.
Bug: 117183273
Test: Compiles & tests passing
Change-Id: I2699dda29e1eed139bc6fd1b70071e5ab33cad88
Support adding NATT keepalive packet filter to APF
filter.
Generating APF program will be addressed in another CL.
Bug: 33530442
Test: - atest NetworkStackTests
- atest FrameworksNetTests
Change-Id: I403cd14ac9aa6b001c4e580abbb33a615931a192
Merged-In: Idaa7238a5c9acdae9f6cff13095ee9436c7c92c8
(cherry picked from commit 038c11d564452c9e08f25119423049339ff93c57)
Mark Chienauthored and markchiencommited 2019-04-30 11:26:26 +08:00
The tests are run both in unit and CTS tests.
Test: atest FrameworksNetTests NetworkStackTestCases
Bug: 129200175
Change-Id: I78d78dd421cc3ffea774ff5eaa6aa758debc9cf2
Merged-In: I9b65a2eef94567d2b79a9955619938e64906080d
Merged-In: I78d78dd421cc3ffea774ff5eaa6aa758debc9cf2
(cherry picked from commit 9e046d509a37c6f37b4757f1681846cee60cfd5c)
Paul Hu
authored and
Remi NGUYEN VAN
commited 
Junyu Lai
commited 
Benedict Wong
authored and
Lorenzo Colitti
commited 
Chalard Jean
authored and
TreeHugger Robot
authored and
Android (Google) Code Review
commited 
chen xu
authored and
Varun Anand
authored and
Chiachang Wang
authored and
Xiao Ma
commited 
Luke Huang
authored and
Etan Cohen
commited 
Chenbo Feng
commited 
Mark Chien
authored and