This commit adds support of registering a public key for a host/service.
This is required to enable Advertising Proxy feature for Thread devices.
For example:
```
NsdServiceInfo info = new NsdServiceInfo();
info.setServiceName("My Service");
info.setServiceType("_test._tcp");
info.setHostname("MyHost");
info.setHostAddresses(List.of(address1, address2));
info.setPublicKey(/* KEY RDATA */);
nsdManager.registerService(info, PROTOCOL_DNS_SD, listener);
```
Bug: 317946010
Change-Id: I367ebff8119d5c1dff0410c85e6fb86dca6c66b8
Adds a test that sends a ping packet, asserts its reply, then installs a
filter and asserts that the second ping packet is dropped.
Test: test only
Change-Id: I832ea1b3cc35a44c98fbf8c86c16bf753f183c92
This discards anything that is not an echo reply. Technically, length
cannot be 0, since zero-length packets close the PacketReader (because
FdEventsReader#shoudlProcessZeroLengthPacket has not been overridden
(yet?)).
Test: atest ApfIntegrationTest
Change-Id: Ib7cd9bf819614e66c8b6b7fc15622be5c344a208
A Thread.sleep() is needed after turnScreenOff() to ensure APF has
started running. This means it makes sense to move turnScreenOff to
a @BeforeClass setup to avoid slowing down the tests.
Test: atest ApfIntegrationTest
Change-Id: Ie1d9335fb1ad2ac3c51a48269b28f66f212f993c
This reverts commit 98219a4e8a.
Moved the revert past "Only run APF tests on physical devices".
This broke on cuttlefish, as CF does not support IPv6.
Test: TH
Change-Id: I04d1adb4538e6c413a1325432e1c014ca78b41e3
Cuttlefish does not actually implement APF, and there is no point in
general to test APF integration on virtual devices.
Test: atest ApfIntegrationTest
Change-Id: I1f0e25255d1ebcc5a6a50a42968ea1e14b5755db
The SparseArray.indexOfValue() uses == to compare values,
MulticastRoutingCoordinator uses SparseArray with String type values,
and the indexOfValue function would sometimes return -1 when looking for
a value in the SparseArray.
Added a helper function getIndexForValue in CollectionUtils to get index
by comparing values with equals, and used this function in MulticastRoutingCoordinator.
Updated
MulticastRoutingCoordinatorServiceTest#testMulticastRouting_applyConfigNone_removesMfc
test case to use copies of interface names when updating the multicast
configs, so the test would fail without this fix.
Test: atest NetworkStaticLibTests:com.android.net.moduletests.util.CollectionUtilsTest#testGetIndexForValue
atest android.net.connectivity.com.android.server.connectivity.MulticastRoutingCoordinatorServiceTest#testMulticastRouting_applyConfigNone_removesMfc
Change-Id: I862242d6be01b8552cdd6af6c9691948a9f0bfe0
Follow up CLs will update CS to generate blocked reason from bpf map
instead of asking NPMS.
However, one issue is NPMS set PENALTY_BOX for
BLOCKED_METERED_REASON_USER_RESTRICTED and
BLOCKED_METERED_REASON_ADMIN_DISABLED without telling the reason.
So, CS can not know the reason of PENALTY_BOX.
This CL add new firewall chain and match to distinguish reasons.
NPMS must call setUidFirewallRule with
FIREWALL_CHAIN_METERED_DENY_USER or FIREWALL_CHAIN_METERED_DENY_ADMIN
based on the reason so that CS can know the reason of restriction.
Bug: 332628891
Test: atest com.android.cts.net.HostsideRestrictBackgroundNetworkTests
Change-Id: Ia4ad4bdb345abc22c782630e828edfad2452db36
The following commit is only in 4.15:
commit cb4d2b3f03d8eed90be3a194e5b54b734ec4bbe9
Author: Martin KaFai Lau <kafai@fb.com>
Date: Wed Sep 27 14:37:52 2017 -0700
bpf: Add name, load_time, uid and map_ids to bpf_prog_info
$ git describe cb4d2b3f03d8eed90be3a194e5b54b734ec4bbe9
v4.14-rc1-661-gcb4d2b3f03d8
Bug: 335390828
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I246a7a8640bea1e939f12f3ffd3fedc25a0a6422
Maciej Żenczykowskicommited 2024-04-23 03:16:05 +00:00
When using IPv4 ping, the APF filter has to take clat into account. In
order to prevent this complexity, just send an ICMPv6 ping instead.
Test: atest ApfIntegrationTest
Change-Id: I7938366ea26295bb3b3b1077d7d31395bc493770
Also, it throws a TimeoutException instead of an ExecutionException if
get() times out. (ExecutionExceptions are thrown if the future completes
exceptionally, which is not the case here.)
Test: TH
Change-Id: If1bc359e8fefb819089e4f2885fb45ee7e3a996c
ByteArray.toHexString is experimental stdlib API, so it requires a
special annotation to be used. If there is a good reason not to use the
experimental API, an extension function "asHexString()" could be added
to.
Unfortunately, ByteArray does not have a companion object, so it is not
possible to add a fun ByteArray.Companion.fromHexString().
Test: TH
Change-Id: Ifedc998e95d6a1e4cdeb5bd9982b9456e64e649c
This CL adds elapsedRealTime() to Dependencies so that in the unit test
we can simulate the elapse of time.
Bug: 336268432
Test: atest FrameworksNetTests:android.net.connectivity.com.android.server.connectivity.mdns.MdnsRecordRepositoryTest
Change-Id: I64cf0ac1772f54edf187cf9ca6351a75b81fd859
ConnectivityServiceTest is deprecated but people sometimes still
add new test methods to it, and getting review feedback to rewrite
tests in CSTest. This wastes resources.
Thus, assert fixed test method count to make it fails locally for
people to aware of it.
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.ConnectivityServiceTest#testTestMethodCount
Bug: N/A
Change-Id: I0a98a0e3fcd97484f372737e7c6fe24743c21834
This CL separates the multicast reply quota for IPv4 and IPv6. Before
this change, when an IPv4 mDNS query and an IPv6 mdns query arrives at
the same time for the same record (which is a common behavior for DNS-SD
resolvers), MdnsRecordRepository will only respond to one of them. The
other response will be throttled silently.
It's especially problematic when the IPv4 query and IPv6 query are sent
by different hosts. One of the hosts will get no reply.
Bug: 335096961
Test: Unit test and verified on a local device.
Change-Id: I0d7a9fad2b43bbfb8b042828295cdf08bf4ae5c8
instead of using 'NetBpfLoad' from NetBpfLoad.cpp
and 'NetBpfLoader' from loader.cpp
This will make it easier to filter logcat.
Test: N/A
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ibd4e0b04592e8b41cde651c5596ce84bd8893c19
Maciej Żenczykowskicommited 2024-04-20 00:03:19 +00:00
My guess is some 4.14-T devices lack the required
bpf_skb_change_head(), see comment in file at line 321:
// bpf_skb_change_head() is only present on 4.14+ and 2 trivial kernel patches are needed:
// ANDROID: net: bpf: Allow TC programs to call BPF_FUNC_skb_change_head
// ANDROID: net: bpf: permit redirect from ingress L3 to egress L2 devices at near max mtu
// (the first of those has already been upstreamed)
//
// These were added to 4.14+ Android Common Kernel in R (including the original release of ACK 5.4)
// and there is a test in kernel/tests/net/test/bpf_test.py testSkbChangeHead()
// and in system/netd/tests/binder_test.cpp NetdBinderTest TetherOffloadForwarding.
(will revert once we have a release key signed build for
testing on user builds)
Bug: 335390828
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I3517e70543d93ced2c1abd9c0f3ccc2b211d9966
Maciej Żenczykowskicommited 2024-04-19 18:50:31 +00:00
Since start() triggers createFd(), it does need to wait for it to
complete. Otherwise, sendPing() might run before a socket has been
allocated.
Bug: 335824575
Test: TH
Change-Id: Ic65b691ea039c3cbbe99c792144f491c46c486b7
* changes:
Add support for sendPing
Add support to expect ping reply or dropped ping
Bind socket to WiFi network
Add IcmpPacketReader to ApfIntegrationTest
Maciej Żenczykowskiauthored and Gerrit Code Reviewcommited 2024-04-19 02:12:32 +00:00
APF is only supported on WiFi, so make sure that the socket is bound to
the right network.
Test: TH
Change-Id: Id3fb329b0bb3125c9dfe64cc22f3e04bd586f70a
Some MultinetworkApiTest tests require a testable network and
attempt to request cell or Wi-Fi connections. This involves
calling ConnectivityManager#requestNetwork, which requires the
CHANGE_NETWORK_STATE permission. Since instant apps cannot be
granted this permission, return currently available testable
networks directly in instant mode instead of attempting to
request new ones.
Fix: 335103621
Test: atest CtsNetTestCases:android.net.cts.MultinetworkApiTest \
--instant
Change-Id: I51dbd33e0dab12856e1c0f387e45e6286feefe20
The test EthernetManagerTest#testEnableDisableInterface_callbacks
captures the interface state changes of ethernet
interfaces that already exist instead of the test one created. Changes
the expectCallback to eventuallyExpect to account for this.
Test: atest EthernetManagerTest
Flag: TEST_ONLY
Bug: 333338569
Change-Id: Ic08444c87f93b3832c4fae1ce2f8382bbb71cb28
This allows the behavior to align with how MAC addresses can configure
network capabilities in config.xml. Ethernet interfaces can be
configured in the following format "<interface name|mac address>;
[Network Capabilities];[IP config];[Override Transport]", however for IP
configurations within EthernetTracker the mac address was not
considered.
Additionally, this CL fixes lapses in the retrieval of network
capabilities by mac address as well (e.g. within isRestrictedInterface,
network capabilities were only retrieved by the interface name rather
than the interface name and the mac address)
Test: atest FrameworksNetTests
Bug: 142259350
Change-Id: I211dd6466abcdbb1de3ca512a65214ed9e249969
A Matter device uses a hex as the hostname so it may begin with a digit
which wasn't allowed in NsdService. This CL looses this check to allow
Matter devices to register their services at Android Thread Border
Router.
Bug: 334828525
Test: CI
Change-Id: Ia779791e214158a08c2ec06adf8d5630ec8ea616
Handa Wang
commited 
Maciej Żenczykowski
authored and
Gerrit Code Review
commited 
Motomu Utsumi
authored and
Patrick Rohr
commited 
Yang Sun
authored and
Daniel Hsieh
authored and
Treehugger Robot
authored and
Junyu Lai
commited 
Paul Hu
commited 
Chris Desir
commited 
Xiao Ma
authored and