(for now for better testing we don't make V special)
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Id2835bd393c0ec9e1710644681bc5aab0d7d2aae
Maciej Żenczykowskicommited 2024-03-19 21:45:21 +00:00
This CL is created as a best effort to migrate test targets
to the new android ownership model. If you find incorrect or unnecessary
attribution in this CL, please create a separate CL to fix that.
For more details please refer to the link below,
<add g3 doc link>
Bug: 304529413
Test: N/A
Change-Id: I243f17b3f0ad7af9ffa15ca242456e36688733f5
Merged-In: I243f17b3f0ad7af9ffa15ca242456e36688733f5
b/310046696 introduced a breaking ABI change in libbase, and
the following unit tests fail to launch on previous
platforms because of missing symbols:
- libnetworkstats_test
- netd_updatable_unit_test
Bug: 316464217
Test: atest libnetworkstats_test
Test: atest netd_updatable_unit_test
Change-Id: Icef58de0b46c6042a9459d3d4c45ea9ce2baefed
Instead of logging and aborting from the BpfHandler::initPrograms(),
return a Status object with an error message. The caller
NetdUpdatable::libnetd_updatable_init() will log the message. Netd
main() will exit and restart.
Bug: 312094533
Test: m
Change-Id: I6717da871a9a53357ac895709ea0094c089e7bbd
Debugging the SIGABRT of this function is annoying because the module
can be built from source or pre-built. It requires finding the correct
version of the symbol to get the correct line number. In addition, there
are 7 consecutive aborts in source code, it is hard to tell whether the
symbolized call stack shows the right line number or not. Adds error
trace before abort so we can identify the root cause without even
symbolizing the call stack of SIGABRT.
Bug: 312094533
Test: make; flash; adb logcat
Change-Id: I74713029d059e10bf5d34694cdb96712bc806696
(in preparation for moving it into netbpfload)
The programs themselves (in bpf_progs/block.c) required a 5.4+ kernel.
We relax this restriction to 4.19+ as we don't have any 5.4 device coverage
(while the pixel 4a 5G / 5 / 5a are all 4.19 devices).
I believe we could relax it further to 4.14+ but Pixel 4/4xl/4a that
would exercise those code paths are EOL and probably have poor to
non existent test coverage, and we cannot do anything for 4.9 T devices
anyway.
Note: on <4.19 kernels (ie. T devices running 4.9/4.14, U running 4.14)
this results in ConnectivityNativeService going from null to initialized
(as the bpf map will exist).
This doesn't hurt as the set/clear port interfaces are only ever
called by vendor code on devices where the kernel doesn't support
the older mechanism. And even if you call them it will just set/clear
the bits in the bpf bitmap, they just won't actually affect anything.
We could flag the map itself as being 4.19+ as well, but I think
I prefer the no-op map to exist...
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I1085addd22f4f3b709e1875049633832c5dac836
Maciej Żenczykowskicommited 2023-10-06 14:31:20 -07:00
https://android-developers.googleblog.com/2022/09/optimize-for-android-go-lessons-from-google-apps-part-1.html
Year Android MinRAM
2017 8/O 512 MB
2018 9/P 512 MB
2019 10/Q 512 MB
2020 11/R 1 GB
2021 12/S 1 GB
2022 13/T 2 GB
More than 4GB (and really even ~3..3.5 GB) of ram basically
requires a 64-bit kernel, as no one wants to deal with
debugging PAE kernel complexities.
Devices newly launching on 2023's Android 14/U must use
a 64-bit kernel. 5.15 LTS is highest supported by T.
Hence 5.16+ must be a 64-bit kernel.
(see vts_kernel_isa_test.cpp)
Note:
This change doesn't take effect until 2024's Android 15/V,
and only then on the latest 6.~6 LTS, which will only be used
with the latest SoCs, and will thus only affect the latest
and thus premium devices (which likely have 10+ GB).
By the time these 6.6 using SoCs reach lower end devices,
it'll be 2026 or later, at which point I expect even
low end devices will have 4+GB.
Additionally note that technically this only affects
mainline using devices. Non mainline usecases can
be customized (ie. for example this change reverted)
by oems/vendors however they wish. Although we
won't be providing support (but considering the
existing state of 32-bit testing, that's already
pretty much the case).
Test: TreeHugger
Bug: 163141236
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I64f5db5a440465f0b48368815fea3029619a9681
Maciej Żenczykowskicommited 2023-09-29 04:30:17 +00:00
The FD number isn't actually useful debugging information,
and I want to get rid of this fd leak out of BpfMap class.
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I981832b019b57f534bed1c1fbfedf6457abba6fa
Maciej Żenczykowskicommited 2023-08-20 16:42:09 +00:00
while at it add 'const' to satisfy the linter
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I207be20c75b103bc5332c111291e4c439ba82219
Maciej Żenczykowskicommited 2023-06-14 10:09:08 +00:00
The random grab bag of stuff in BpfUtils.h is weird,
and I'm trying to trim it down.
Since this is coming from the kernel, 0 meaning error / no socket
is actually kernel api and thus guaranteed.
IMHO if (!cookie) is also clearer to read.
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I433dfca5695a04a42d632b7e0c2434db26c4ed00
Maciej Żenczykowskicommited 2023-04-19 11:53:38 +00:00
These two checks are theoretically equivalent,
since netd.o marks the program as requiring 4.14+.
Thus unless netd.o bpf program is broken, or bpfloader
is misbehaving, this change is a no-op.
Bug: 270276754
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I2c6982e7476c2fa56b67532c80d97d7389030d32
Maciej Żenczykowskicommited 2023-02-22 22:10:48 +00:00
The 3 pre-existing //system/netd tests are:
TEST_F(BpfBasicTest, TestCgroupMounted)
TEST_F(BpfBasicTest, TestTagSocket)
TEST_F(BpfBasicTest, TestCloseSocketWithoutUntag)
which are directly related to BpfHandler.cpp implementation,
as it implements:
Status BpfHandler::init(const char* cg2_path)
BpfHandler::tagSocket()
BpfHandler::untagSocket()
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I1c01ae90904faaea54b427495c7a5deab8b1b900
Maciej Żenczykowskicommited 2022-12-20 00:41:05 +00:00
This effectively reverts commit 6ed2ab9b57,
while ensuring that the program has the right permissions as
defined in r.android.com/2130014 :
oriole:/ # ls -lZ /sys/fs/bpf/netd_shared/prog_netd_cgroupsock_inet_create
-r--r----- 1 root root u:object_r:fs_bpf_netd_readonly:s0 0 2022-10-27 20:05 /sys/fs/bpf/netd_shared/prog_netd_cgroupsock_inet_create
Reason for revert: need to support 4.9 devices upgrading to T.
The only thing that cannot currently be supported on those
devices is the inet_create program which implements the
INTERNET permission.
Also, update bpf_existence_test so it does not check for the
existence of the program on pre-4.14 devices.
Bug: 254001921
Test: atest bpf_existence_test
Change-Id: I14f26cee5feeaae93b4d9710a7b9a2f835ff405f
Lorenzo Colitticommited 2022-10-27 20:06:16 +09:00
since it doesn't actually work (this runs in netd, but is meant
to protect against system server modifications)
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I87f268f1a68c559b19caa4d625cb9eb8395c91e2
Maciej Żenczykowskicommited 2022-09-01 12:36:17 +00:00
This eliminates the need for netd_updatable BpfHandler.cpp
to initialize the hash map with a zero.
On startup the map will be freshly initialized and thus zero.
On restart it might not be empty, but it doesn't matter to netd.
Furthermore the mainline component of the system server will
re-initialize it again anyway:
see service/native/TrafficController.cpp initMaps()
This does remove the ability to call deleteValue on a key,
since that would always return -EINVAL, but since we don't
currently do that, that's really a feature.
(It does suggest though that we should have a BpfMapNonNullable
class which is writeable, but without a deleteValue() function)
Additionally BpfMap arrays are more efficient for the kernel bpf jit
compiler, as - on newer kernels - it can optimize the read/write
into a simple memory access (as opposed to a bpf helper call).
Before:
$ adb shell ls -l /sys/fs/bpf/netd_shared/map_netd_configuration_map
-rw-rw---- 1 root net_bw_acct 0 2022-06-11 08:20 /sys/fs/bpf/netd_shared/ map_netd_configuration_map
After:
$ adbz shell ls -l /sys/fs/bpf/netd_shared/map_netd_configuration_map
-r--rw---- 1 root net_bw_acct 0 2022-06-16 15:03 /sys/fs/bpf/netd_shared/map_netd_configuration_map
Bug: 235590615
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I21730e4fa22fbf0c94ab0ca5c5db03aa000b7680
Maciej Żenczykowskicommited 2022-06-16 22:53:42 +00:00
We'd like to switch more of these, but this is the only one
where tests don't get in our way.
We'll fix the rest later. This gives us an *example* for
further testing.
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I9b280c7ba2d19644fc3cdd0c132de85f45df69b4
Maciej Żenczykowskicommited 2022-06-13 19:39:06 -07:00
BpfMap.reset(createMap()) is equivalent to newly added BpfMap.resetMap(),
except that the latter makes it impossible to screw up the Key/Value sizes.
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I290986e9ae8660f3fc6f73b086d33f4ab93d6095
Maciej Żenczykowskicommited 2022-05-31 07:35:04 -07:00
We notice that:
BpfMap.reset(dupFd_with_cloexec(BpfMap.getMap())
is equivalent to
BpfMap = BpfMap
due to the current implementation of the BpfMap assignment operator.
Except the latter also verifies BpfMap<K,V> template types match.
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I99fcf77bc6aa360b6a19e22c2cd58d67a1e62976
Maciej Żenczykowskicommited 2022-05-31 07:35:03 -07:00
In the BPF code, per-UID network access (e.g., for doze mode,
standby, etc.) is stored in UidOwnerValue structures. Each of
these stores that UID's rules in a 32-bit bitmask of
UidOwnerMatchType values, so the code can support ~31 match
types.
However, which match types are enabled is stored in
configuration_map at index UID_RULES_CONFIGURATION_KEY, and
configuration_map only stores 8-bit values. So it's not
possible to define more than 7 match types.
Widen configuration_map to from 8 to 32 bits to match the width
of UidOwnerValue.rule. This doesn't impact memory because
configuration_map only has 2 entries.
Bug: 208371987
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I7e1eee2daedd66d27965a2dd4ce6b4c3667892f7
Lorenzo Colittiauthored and Maciej Żenczykowskicommited 2022-05-31 09:59:11 +00:00
In order to get counted by mts code coverage, these native tests need to
be run as part of mts.
Bug: 233904825
Test: m mts && mts-tradefed run mts-tethering-coverage
Change-Id: I79313197b146c7043ffb5e164faa46c2e16dd1d2
(for consistency with rest of code base)
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I5660615f24daf4285e2b6cbacecb7cd99061c5f5
Maciej Żenczykowskicommited 2022-05-23 20:53:12 +00:00
Configuration map index 1(CURRENT_STATS_MAP_CONFIGURATION_KEY) can only
have value 0(SELECT_MAP_A) or 1(SELECT_MAP_B). Return error if it is any
other values. Otherwise, read out of array boundary can cause memory
corruption or security issues.
Bug: 231420457
Test: TH
Change-Id: Ia800ad78781f72b8118469c0230cc550796d334e
S had a minimum kernel requirement of 4.9,
T bumps this up to 4.14, which adds net cgroup bpf support.
It's important to ship T with this otherwise we'll be forced
into trying to somehow support 4.9 kernels with T mainline
module updates for years and years, when we no longer have
any tests of the old code paths...
Test: TreeHugger
Bug: 232017472
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I6e873f0815f176f5618278087132156c9974d6ea
Maciej Żenczykowskicommited 2022-05-16 11:04:22 -07:00
This is a follow up commit for the family validation {INET, INET6}.
The protocol validation {TCP, UDP} has been added in previous
commit.
The TrafficController socket destroy listener only monitors
on the group {INET_TCP, INET_UDP, INET6_TCP, INET6_UDP}.
Tagging listener unsupported socket causes that the tag can't
be removed from tag map automatically. Eventually, the tag map
run out of space because of dead tag entries.
See TrafficController::makeSkDestroyListener in
packages/modules/Connectivity/service/native/TrafficController.cpp
Also address the comments from previous commit.
- Remove the useless else-statment in tagSocket protocol validation.
- Make the socket cookie query and test into one line in
BpfHandlerTest#TestTagSocketWithUnsupportedProtocol
Bug: 223094609
Test: atest BpfHandlerTest
Change-Id: I0f571fc00caa01c86399f0dbb593e8a40ad94bbd
The TrafficController socket destroy listener only monitors
on the group {INET_TCP, INET_UDP, INET6_TCP, INET6_UDP}.
Tagging listener unsupported socket causes that the tag can't
be removed from tag map automatically. Eventually, the tag map
run out of space because of dead tag entries.
See TrafficController::makeSkDestroyListener in
packages/modules/Connectivity/service/native/TrafficController.cpp
Bug: 223094609
Test: atest BpfHandlerTest
Change-Id: Icc19b7c9f37fef498b89f43e44767f6b9e931a5a
The process is not allowed to tag socket to AID_CLAT via tagSocket()
which would cause process data usage accounting to be bypassed.
Bug: 218407445
Test: atest BpfHandlerTest
Change-Id: Ia7b071e1065733da25e9f02f34ccd17f63653217
Added SPDX-license-identifier-Apache-2.0 to:
netd/Android.bp
Bug: 68860345
Bug: 151177513
Bug: 151953481
Test: m all
Change-Id: Ib1377fbb050fe52ee195eec58fea67ef769a487a
Before (aosp_cf_x86_phone-userdebug):
$ adbz shell ls -l /apex/com.android.tethering/lib
-rw-r--r-- 1 system system 251404 1969-12-31 16:00 libbase.so
-rw-r--r-- 1 system system 713636 1969-12-31 16:00 libc++.so
-rw-r--r-- 1 system system 64560 1969-12-31 16:00 libcom_android_connectivity_com_android_net_module_util_jni.so
-rw-r--r-- 1 system system 13596 1969-12-31 16:00 libframework-connectivity-jni.so
-rw-r--r-- 1 system system 45776 1969-12-31 16:00 libnetd_updatable.so
-rw-r--r-- 1 system system 948032 1969-12-31 16:00 libservice-connectivity.so
After (aosp_cf_x86_phone-userdebug):
$ adbz shell ls -l /apex/com.android.tethering/lib
-rw-r--r-- 1 system system 713636 1969-12-31 16:00 libc++.so
-rw-r--r-- 1 system system 64560 1969-12-31 16:00 libcom_android_connectivity_com_android_net_module_util_jni.so
-rw-r--r-- 1 system system 13596 1969-12-31 16:00 libframework-connectivity-jni.so
-rw-r--r-- 1 system system 212624 1969-12-31 16:00 libnetd_updatable.so
-rw-r--r-- 1 system system 948032 1969-12-31 16:00 libservice-connectivity.so
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I19c9d73ba3555bbc1987fbdc0be19af1f0511948
Maciej Żenczykowskicommited 2022-01-31 19:56:33 -08:00
1. Add libnetd_updatable.so in com.android.tethering. The library is
loaded by netd. Currently, it mainly targets on a few functions which
access BPF maps. The functionality may extend in the future.
2. Attach gcroup progs from libnetd_updatable.so.
3. Move (privileged)TagSocket and untagSocket implementation to mainline
module. Combine privilegedTagSocket and untagSocket into a single
function.
4. Split related unit tests from netd_unit_test to
libnetd_updatable_unit_test as well.
Bug: 202086915
Test: cd system/netd; atest
Test: atest TrafficStatsTest NetworkUsageStatsTest
Change-Id: Ib556458103a4cbb643c1342d9b689ac692160de0
Maciej Żenczykowski
commited 
Aditya Choudhary
commited 
Henri Chataing
commited 
Ken Chen
commited 
Gerrit Code Review
commited 
Nick Wille
commited 
Lorenzo Colitti
commited 
Treehugger Robot
authored and
Hungming Chen
commited 
Bob Badour
commited