delay_destroy_frozen_sockets_version is rolled out to public 100%.
So this CL enables this flag as default with kill switch.
This flag is no-op if destroy_frozen_sockets_version is disabled, and
destroy_frozen_sockets_version is also rolled out to public 100%.
So this CL does not change any behabior on the production devices.
Upcoming CLs will update CS to destroy sockets of apps that are under
FIREWALL_CHAIN_BACKGROUND restriction as well.
So this CL renames flag name from delay_destroy_frozen_sockets_version
to delay_destroy_sockets which is not specific to frozen apps.
Bug: 300681644
Test: TH
Change-Id: Icb9edff4e517fca57408d7d690fe9e172754c35e
NETWORKINFO_WITHOUT_INTERNET_BLOCKED compat flag only changed the
behavior of getActiveNetworkInfo that depends on
bpfNetMaps#isUidNetworkingBlocked.
But isUidNetworkingBlocked is used from other APIs(e.g. getActiveNetwork)
This CL update all APIs that depends on isUidNetworkingBlocked to follow
the compat flag to make behavior consistent between APIs.
aosp/3079290 will update onBlockedStatusChanged callback to follow this
compat flag.
Bug: 340773991
Bug: 339780435
Test: TH
Change-Id: If64ec800f21c2adc613884838202e2dece4a8d95
Before aosp/3001087, getNetworkActiveInfo did not return network info
with blocked state for apps without PERMISSION_INTERNET even if the
network is actually blocked.
aosp/3001087 updated getNetworkActiveInfo to return correct blocked
state on V+.
However, this broke some apps that use getNetworkActiveInfo in wrong way
and depends on the previous behavior.
So this CL introduces the compat flag to keep previous behavior for apps
targeting U or older releases.
Test: TH
Bug: 333340911
Change-Id: I0e0950f2148de0ffdb45495903a5a87e0d4c1c0b
Clarify that only the highest priority preference is applied if the uid
is target of multiple preferences.
Test: TH
Change-Id: I55b6a37995bcfe876ed609cf653077df2b5e7615
With this annotation, errorprone build will fail if callers don't check
sdk version before calling any methods in BpfNetMapsUtils.
Bug: 328732146
Test: TH
Change-Id: Ifa52dc1d2766f8d46dfdc4f6ca9dbb963406c084
Follow up CLs will update CS to generate blocked reason from bpf map
instead of asking NPMS.
However, one issue is NPMS set PENALTY_BOX for
BLOCKED_METERED_REASON_USER_RESTRICTED and
BLOCKED_METERED_REASON_ADMIN_DISABLED without telling the reason.
So, CS can not know the reason of PENALTY_BOX.
This CL add new firewall chain and match to distinguish reasons.
NPMS must call setUidFirewallRule with
FIREWALL_CHAIN_METERED_DENY_USER or FIREWALL_CHAIN_METERED_DENY_ADMIN
based on the reason so that CS can know the reason of restriction.
Bug: 332628891
Test: atest com.android.cts.net.HostsideRestrictBackgroundNetworkTests
Change-Id: Ia4ad4bdb345abc22c782630e828edfad2452db36
The BACKGROUND firewall chain has been recently added. We want to
be able to turn it off in case of contingencies with a device-config
flag flip.
The flag is assumed to be boot-stable and its value is read at boot.
When the flag is off, we ignore any operation on this firewall chain.
Additionally, this chain is always considered disabled on versions
upto UPSIDE_DOWN_CAKE.
Note: All firewall chains are in disabled state at boot by default.
Test: atest FrameworksNetTests
Test: Manually, using adb shell device_config commands.
Bug: 331484830
Change-Id: I9ccc483e02e27a584da6714931466a9f2ec95ca9
NetworkPolicyManager#isUidNetworkingBlocked does not know about some
firewall chains status(e.g. FIREWALL_CHAIN_OEM_DENY_1)
So BpfNetMaps#isUidNetworkingBlocked is more correct but there could be
some behavior difference.
To avoid breaking devices and have longer verification time, this CL
updates to use BpfNetMaps#isUidNetworkingBlocked only on V+ devices.
Bug: 328732146
Test: TH
Change-Id: I60f84a5fff90386103692841dead465652249446
When request_restricted_wifi is enabled CarrierPrivilegeAuthenticator
calls CarrierPrivilegesLost callback passed from ConnectivityService.
But CarrierPrivilegeAuthenticator was using its own handler thread to
receive broadcast and callbacks so CarrierPrivilegesLost callback needed
to post a message to the CS handler.
This CL updates CarrierPrivilegeAuthenticator to use CS handler if
request_restricted_wifi is enabled, and remove the message post in
ConnectivityService.
Test: TH
Change-Id: Ib41304a30e3dd366b0f6f1d7df81145f0e05ece1
When there are addresses that are used by a single VPN interface,
ConnectivityService sets ingress discard rules to drop packets to this
address from the non-Vpn interfaces
Test: FrameworksNetTests
Bug: 295800201
Change-Id: I089d01a38eff3f37a851627fa9e4acefb8d9ad5e
This enforceNetworkStackPermission() should be adopted to check
the required permission but this may be break OEM captive portal
apps. Simply ignore the request if the caller does not have
permission.
This commit also fixes the format issues that is auto-fixed by
ktlint.
Fix: 329385091
Test: ates FrameworksNetTests
Change-Id: Ia973a1078eda3134fc8ff261d3954cd050767880
This CL updates CSTest to use mocked appOpsManager to bypass
checkPackage enforcement so that test can file network request as
SYSTEM_UID
Bug: 314627716
Test: atest ConnectivitySampleMetricsTest
Change-Id: I0a5f3b1bf2c343644e6f5e2a4ec1b0460e2645c4
This reverts commit 41557553f6.
(this is no longer needed, as it rolled out with January module,
while the May module this is targetting already includes an rc,
thus eliminating the need for this warning)
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I90c8abad2f70d65d142f55c18ad2f34018da6615
Maciej Żenczykowskicommited 2024-03-05 19:49:20 -08:00
This CL allows everyone to see the subscriptionIds and the network owner
to see the allowedUids from the NetworkCapabilities.
Bug: 324357121
Test: atest ConnectivityManagerTest
atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.ConnectivityServiceTest
Change-Id: I91e360827d2a9a64625f1d6ae0f808aa327c7d22
Apps that target an SDK before V will not see networks with
NET_CAPABILITY_LOCAL_NETWORK unless they explicitly set this capability
in their network requests.
Bug: 319212206
Test: CSLocalAgentTests
Change-Id: I414b03dfea9a8aac83304c6be501f03d637739b4
The hasNetworkStackPermission() method does not enfore the
permission check. It should be replaced with
enforceNetworkStackPermission().
Bug: 325984919
Test: atest FrameworksNetTests
Change-Id: I9ad0b47190dbc9afd2ee6f5dfc21a4935036733a
Always store the corresponding SubscriptionId together with the Carrier
uid so that when the carrier loses the Privilege, both the uid and
SubscriptionID will be used in the onCarrierPrivilegesLost callback
Bug: 324357121
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.connectivity.CarrierPrivilegeAuthenticatorTest
atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.ConnectivityServiceTest
Change-Id: I28e51c583261a67d4441c6f825ade6781b862ee4
On V, this feature is enabled on all devices.
On U, this feature is enabled if the flag is enabled.
Test: TH
Change-Id: I025b9a8098a0896be51cf06c5b8262243ba439b7
These can be used by manual or automated tests.
Test: Manual by using the `cmd connectivity` shell commands
Test: atest CtsNetTestCases:ConnectivityManagerTest
Test: atest netd_integration_test
Bug: 322562125
Change-Id: I1de55e430141f566e510b37554a9416c4444213b
- Implement handleSetSatelliteNetworkPreference() at ConnectivityService
to create multi layer request with preference order
PREFERENCE_ORDER_SATELLITE_FALLBACK.
- unit test coverage
Bug: 320514105
Test: m and atest FrameworksNetTests
Change-Id: I3f71104f8c3c998599eaab71ae4076985f4bed77
This CL allows the Carrier Config app to request restricted WiFi nework
by setting the correspoding subscription ID in the network request.
Bug: 315835605
Test: atest android.net.cts.NetworkRequestTest
atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.connectivity.CarrierPrivilegeAuthenticatorTest
atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.ConnectivityServiceTest
Change-Id: I237e692d092ff5f969ce4b7962f6d58099a6f3a9
The check*Permission methods are a bit error-prone because people
can forget to check the return value and expect that they behave
like the enforce* methods. This was pointed out before in some bugs.
This change adds @CheckResult annotation to enforce linter warning
and rename methods accordingly.
Test: TH
Fix: 279691948
Change-Id: Ibb0df6540fe0ed40289bb190b790130daaa2f763
Applies multicast routing configs when they are updated in
LocalNetworkConfig, or when local network/upstream network
status changes.
Bug: 281217735
Test: atest CSLocalAgentTests
Change-Id: Ib1c43c645a367d0f91e5cf0a0d9f8e5883be2c40
The original patch (aosp/2891011) incorrectly counted TCP
sockets with keepalive enabled for VPNs. This issue was
caused by the UID range verification. On bypassable VPNs,
the socket mark is always correct. It's possible for an
app that is not in the UID ranges to establish a socket
on the VPN. But that socket should be counted for the
purposes of keepalive. The old code would correctly count
it and the new code will incorrectly not count it. Also,
the UID range verification does not help on non-bypassable
VPNs since the socket mark is always the mark of default
network, not the socket mark of the VPN.
Instead of reverting the entire patch, this commit
removes the UID range mechanism. The code refactoring from
the original commit (which used structured classes to read
socket information) has been kept as it is a valuable
improvement.
Bug: 320842519
Test: atest FrameworksNetTests
Change-Id: I00731796144c982b9fd4d9771f3d0db1f1529a89
This is no-op refactor to move utility methods from
ConnectivityService to a common place.
Test: atest NetworkStaticLibTests#com.android.net.moduletests.util.PermissionUtilsTest#testEnforcePackageNameMatchesUid
Bug: N/A
Change-Id: I5802dedcc91fa6e130a5c534bba5080ca37dbeec
This change includes:
1. Refactor the logic in Tethering#dump into utils class.
2. Move the utils class to a common place which could be referenced
from other sub-modules.
3. Add @MonitorThreadLeak annotation to enforce
there is no thread leak problem.
Test: atest FrameworksNetTests NetworkStaticLibTests
Test: atest ConnectivityCoverageTests:com.android.networkstack.tethering.TetheringTest#testDumpTetheringLog
Test: adb shell dumpsys tethering (with hardcoded exception)
Fix: 312669345
Change-Id: Ia6fdfeeec2110afa0ec9e056e9db3843748845c3
This reverts commit e3245081b1.
Reason for revert: The change is unsafe as it introduces code with writings to a separate thread whose message queue size is unlimited.
Test: atest FrameworksNetTests
Change-Id: I392a30f77cfbcd17f420e29f0944604fd789b10a
This reverts commit c0baea5406.
Reason for revert: Checking if culprit of b/317506400
Change-Id: Icbe9d993c6d4bfdf305f2a4c7b8422095c8846a6
Bug: 317506400
Motomu Utsumi
commited 
Treehugger Robot
authored and
Gerrit Code Review
commited 
Maciej Żenczykowski
authored and
Kholoud Mohamed
authored and
Android Build Cherrypicker Worker
commited 
Patrick Rohr
authored and
Suprabh Shukla
authored and
Ying Xu
authored and
Chiachang Wang
authored and
Nagendra Prasad Nagarle Basavaraju
commited 
Junyu Lai
commited 
Yang Sun
commited 
Danuta Brotikovskaya
commited 
Karl Shaffer
authored and
Chris Göllner
commited