Even if there are no preferences, the allow list needs
to be updated upon adding a new user, because it's set
unconditionally when the network connects.
Adding all existing UIDs would address this issue too
and we probably want to do it, but immediately this
seems simpler.
Bug: 266136779
Test: new test for this
Change-Id: I77091a6c3d3ccf2b80ab0aaa01d09ef0df922501
Add SocketKeepalive.start with parameter to enable dynamic
keepalive mode based on the existence of TCP connections.
This supports IPSec mode to notify KeepaliveTracker to disable
keepalive when keepalive is unnecessary to improve battery life.
Keepalive is controlled by periodically TCP socket status check
for both enable and disable. This is a transition commit and
is expected to be updated based on the socket creation or
destroy.
Bug: 259000745
Test: m ; atest FrameworksNetTests
Change-Id: Ie4d598d69a73c4931c7d0b6dfde0e459e5dca6b4
chiachangwangauthored and Chalard Jeancommited 2023-01-20 13:51:20 +09:00
Add a new AutomaticOnOffKeepaliveTracker class between
ConnectivityService and KeepaliveTracker to handle the automatic
on/off keepalive. This commit only creates this new class and
move the TCP polling code to the new class as a preparation for
the following commit.
The original test file was created for testing the TCP polling
mechanism, so rename it to match the new class.
Bug: 259000745
Test: m ; atest FrameworksNetTests
Change-Id: I1b229f906283c0f5ef7a3efdb0572fcbfc5df72b
chiachangwangauthored and Chalard Jeancommited 2023-01-19 13:17:54 +09:00
This allows us to skip any older CONNECTIVITY_ACTION broadcasts
waiting to be delivered when a new broadcast is dispatched.
Bug: 255545931
Test: TH
Change-Id: Iac5da2f727e295d1775bfe91358900f316258be4
* changes:
Add HostsideVpnTests for testing setVpnDefaultForUids()
Add CTS for ConnectivityManager#setVpnDefaultForUids()
Create a new API to make a set of UIDs use only VPN by default
Lucas Linauthored and Gerrit Code Reviewcommited 2022-12-21 01:13:47 +00:00
Setting the MTU for an interface should not be skipped when the
interface names are different. This occurs when a VPN network creates
a new interface with identical MTU.
Bug: 246398088
Test: atest ConnectivityServiceTest
Test: Manual test: Connect to VPN network and switch networks
Test: Confirm MTU of interface is set correctly with `adb shell ip addr`
Change-Id: I811a01feca2fb2130c57c6c924145314180434c5
Create a new API - setVpnNetworkPreference() for the caller to
set VPN as the preference network.
VPN will be disconnected when its underlying network is gone.
To prevent packets going through an underlying network when the
underlying network is back but VPN is not connected yet, set VPN
as the only preferred network for specific apps.
Bug: 231749077
Test: 1. atest FrameworksNetTests
2. Create a test app to register default network and check if
the VPN is the only default network for the test app.
Change-Id: Iabcd38e2fec2aefedbf78d20e338f222d83a9e7f
This change introduces a limited library for dependencies on
framework-connectivity from Tethering,
connectivity-internal-api-util, where all classes are annotated with
@RequiresApi(S) to ensure proper API checks are done before usage.
Bug: 245972418
Change-Id: I82bafd9063341adc71d07f0858e6d68283d081f0
Igor Chernyshevcommited 2022-12-16 17:55:53 +00:00
Currently, NET_CAPABILITY_TEMPORARILY_NOT_METERED traffic is
counted as unmetered data usage, and "mobile data usage"
settings screen shows metered data usage which means it doesn't
include TEMPORARILY_NOT_METERED traffic. However, some carriers
show TEMPORARILY_NOT_METERED data usage in customer's bill which
would be confusing if the data usage in the device shows different
results. Thus, revert the change to avoid confusing.
Bug: 183776809
Test: FrameworksNetTests
Change-Id: I4ef25095462adf30b1ecf82134996739f167930d
This commit clear the calling identity before accessing the
DeviceConfig in ConnectivityService#dump().
The calling package of DeviceConfig.getProperties() comes from
ActivityThread.currentApplication(). In ConnectivityService#dump(),
the caller is ConnectivityService. It's OK to access DeviceConfig
from ConnectivityService. The same scenario applies to an app with
proper permission accessing DeviceConfig from its own context.
However, if cts would like to verify design by calling
ConnectivityService#dump(), the calling uid will comes from the
binder but package name will stay as ConnectivityService which
is 'android'. This will result in a SecurityException says that
the package does not match the uid and failed the test.
Bug: 255231779
Test: atest CtsNetTestCases FrameworksNetTests
Change-Id: I257e246b1cbf3b8a93bee2c326055ced9dfde588
To ensure that permission cannot change while CS is doing works,
scoring networks, sending callbacks, etc. So making all
permission update are running on handler thread.
Bug: 232048835
Test: FrameworksNetTests CtsNetTestCases
Change-Id: I5380ec8ff1282a1056d9063848e0fff8b3a570ec
Most permission update functions are running on the handler
thread. So the startMonitoring() should be running on handler
thread as well to ensure the permission won't change while
processing CS's works.
However, startMonitoring() has a dependency with
MultipathPolicyTracker. It needs to call and complete the
permission update before calling MultipathPolicyTracker#start.
Thus, we need to check the startMonitoring done in the end of
systemReadyInternal because we are processing it on the handler
thread.
Bug: 232048835
Test: atest FrameworksNetTests CtsNetTestCases
Change-Id: I41fef14d6c163eb5676eab3ccd43416ea1fe1414
When the user selects "Do not use this network" in the captive portal
app, it indicates that the user does not want to log in and does not
want to use the network. Thus, the network should be disconnected.
Internally handle the network disconnect in ConnectivityService upon
receiving a captive portal app response of APP_RETURN_UNWANTED.
Test: atest ConnectivityServiceTest
Change-Id: I789ddb663b533a71a77ed435fa91b0c20d3bbfd4
Currently 5G usage includes both metered and unmetered usage.
To support 5G unmetered usage metrics, unmetered usage should
be separated from the 5G usage. Thus, ConnectivityService needs
to inform NetworkStatsService if TEMPORARILY_NOT_METERED has
changed. Then NSS will count temporarily not metered usage as
unmetered.
Bug: 222339311
Bug: 183776809
Test: FrameworksNetTests:ConnectivityServiceTest
Change-Id: I0c7e1eb98925184f36e322e09b4d3d8c6f056fa6
Some callers (e.g. iwlan) need to learn about system default
network but they cannot have NETWORK_SETTINGS permission.
To allow them to use this API but prevent from misuse by
unprivileged apps, enforce USE_RESTRICTED_NETWORKS for this API.
Test: atest com.android.server.ConnectivityServiceTest#testRegisterPrivilegedDefaultCallbacksRequireNetworkSettings android.net.cts.ConnectivityManagerTest#testRegisterNetworkCallback
Fix: 242456635
Change-Id: I80ab27445af874328c9c0f4814a8fbf035ae5df4
In ConnectivityService, updateLinkProperties calls NetworkStats
even though the ip address or interface name has not changed and
only the tcp buffer size has changed. This is noisy and could
be problematic when RAT change occurs frequently, since when
RAT changes tcp buffer size configuration also changes.
This CL also fixes a wrong nullability annotation where the oldLp
of updateLinkProperties could be null when updateNetworkInfo
is called.
Test: atest ConnectivityServiceTest#testStatsIfacesChanged
Fix: 232048480
Change-Id: Ic226eb4a8aa1f38cba293510813f1cb55f0ea658
shouldIgnoreValidationFailureAfterRoam will incorrectly return
true in the first few seconds after boot even if the network
never roamed. This is extremely unlikely to happen, but add a
check for that just in case.
Fix: 230450214
Test: new unit test
Change-Id: I0789d9bdaa0bd9e78673e8f4248a2ca610052f1e
Lorenzo Colitticommited 2022-10-24 23:28:56 +09:00
This will be useful for diagnosing default network changes.
Logs may look like, for example :
Update capabilities for net 100 : -NET_CAPABILITY_OEM_PAID+NET_CAPABILITY_TRUSTED
Or :
Update score for net 100 : -POLICY_EVER_EVALUATED+POLICY_IS_VPN+POLICY_IS_DESTROYED
Test: FrameworksNetTests
manual
Change-Id: Ic4788c599573aae9daeca995b8853800aaaba0b8
Also remove the dump of mPrivilegedUser because this is not used now and
the information is duplicated with uidPermissionMap dump.
Before this CL
....
mUidPermissionMap:
10049 PERMISSION_NONE
10027 BPF_PERMISSION_INTERNET BPF_PERMISSION_UPDATE_DEVICE_STATS
1041 BPF_PERMISSION_UPDATE_DEVICE_STATS
....
After this CL
....
sUidPermissionMap:
10049 PERMISSION_NONE
10027 PERMISSION_INTERNET PERMISSION_UPDATE_DEVICE_STATS
1041 PERMISSION_UPDATE_DEVICE_STATS
....
Bug: 217624062
Test: dumpsys connectivity trafficcontroller, atest BpfNetMapsTest
Change-Id: I416501d5a28a5443f954f9c8c58ea255e5cdc897
Test: FrameworksNetTests
adb shell device_config put connectivity actively_prefer_bad_wifi
+ check that dumpsys updates
Test: at this patchset tests fail with :
Permission denial: reading from settings requires:android.permission.READ_DEVICE_CONFIG
Change-Id: Icfe1e64b8313921ff1dc8e4cbd45f967692e1c4a
This is necessary so that MultinetworkPolicyTracker can see
DeviceConfig. It will also allow removing reflection from
this file to address a long-standing TODO.
Test: build
Change-Id: I968bf67e0e0189b01515242371599c02bc9e2ca2
With this patch and "config_activelyPreferBadWifi=1"
(or SDK level >= U) and bad wifi avoidance turned off,
when the device connects to a bad wifi, after 20
seconds of the wifi not validating the device will
pop up a head-up notification with text
"<SSID> has no internet access".
When tapped, the notification will bring up the existing
Settings dialog :
*Wifi not connected to the internet*
You can switch to mobile whenever Wi-Fi is bad
□ Never show again
<Stay on Wi-Fi> <Switch to Mobile>
If the wifi validates and loses access again, the same
notification/dialog are shown if Settings.Global.
NETWORK_AVOID_BAD_WIFI=PROMPT ; if IGNORE, the device
stays stuck on wifi.
If AVOID, then bad wifi avoidance is turned on in the
first place, so none of this happens.
Behavior in other cases :
- If config_activelyPreferBadWifi=0, then upon connecting
to a wifi without internet, the behavior is unchanged :
the device stays on mobile and after 8 seconds a
notification pops up asking whether to stay connected.
If the network validates, then loses access, the behavior
depends on a few things :
- If config_networkAvoidBadWifi is 0 and Settings.Global.
NETWORK_AVOID_BAD_WIFI = IGNORE, then the device stays
on wifi and says nothing.
- If config_networkAvoidBadWifi is 0 and Settings.Global.
NETWORK_AVOID_BAD_WIFI = PROMPT, then
notification pops up asking whether to switch to mobile.
- If config_networkAvoidBadWifi is 1 (regardless of the
value of Settings.Global.NETWORK_AVOID_BAD_WIFI), or if
Settings.Global.NETWORK_AVOID_BAD_WIFI = AVOID, then
the device switches back to mobile.
- If Mobile is not connected, all the above applies. This
is not great for the messages including "switch to mobile"
but this patch doesn't change it.
Test: manual
Change-Id: Idb05b6a6e5c085f5ef72435d462e14bfd1341f87
If a notification is up and the avoid bad wifi setting
is turned off, the notification should disappear.
This patch also adds some general tests for the bad wifi
notifications.
Test: new tests in this patch
Change-Id: I5bc42afbe0efd93cfb59a759bf0aaba49a4bfc9f
In the previous code, ConnectivityService would mark a network
a captive portal when NetworkMonitor sends it a message to notify
the user for it. Theoretically, this is incorrect ; instead, the
marking should be done upon receiving the message that the network
was tested to be a captive portal.
In practice this hasn't been a problem so far. The captive portal
capability is observable in the app-received callbacks, but for
these purposes the old code and the new code behave the same, in
that in the callbacks, the network used to not have the portal
capability, then later it acquires it.
However, this is only not a problem as long as the captive portal
bit isn't used by network selection, which an upcoming change has
to implement for the "prefer bad wifi" feature. When that is the
case, network selection prefers the wrong result between the time
the network is marked as having been evaluated and the time the
network has been marked a captive portal. It should be marked as
both at the same time to avoid this discrepancy. This is what
this patch is accomplishing.
To do this correctly, this patch also has to disconnect the network
immediately upon it being tested as a captive portal if the old
CAPTIVE_PORTAL_MODE setting is set to CAPTIVE_PORTAL_MODE_AVOID,
instead of keeping it until NM sends the message to notify about
it.
Unfortunately because of the relative timing of the events this
patch has observable impact on what callbacks are sent because of
b/245893397 (the DoubleValidated bug). Before this patch, there
would be an extra useless callback when a captive portal validates
where the capabilities contain both VALIDATED and CAPTIVE_PORTAL,
then a second callback removing CAPTIVE_PORTAL. This patch fixes
this, but unfortunately introduces a symmetrical extra useless
callback when a captive portal network starts matching a callback,
where onCapabilitiesChanged is fired a second time after the
onAvailable sequence with the same capabilities. Fixing this is
very complex ; the best (and simplest) solution is really to
address b/245893397 decisively.
In the mean time, the behavior implemented by this patch is better
than the old one, because there no longer is an observable state
where the network is supposed to be a closed captive portal AND
validated, but instead there is a useless, but correct, caps
callback that mirrors exactly the one from b/245893397. When
b/245893397 is addressed this behavior goes away at the same time,
so this is probably the better behavior.
Test: FrameworksNetTests CtsNetTestCases
Change-Id: I6694db498507860e1d711e2aa0c591dfbfa90be2
chiachangwang
commited 
Chalard Jean
authored and
Motomu Utsumi
commited 
Sudheer Shanka
commited 
Gerrit Code Review
commited 
Junyu Lai
commited 
Lucas Lin
authored and
Maciej Żenczykowski
authored and
Hansen Kurli
commited 
Igor Chernyshev
commited 
Aaron Huang
commited 
Paul Hu
commited 
Treehugger Robot
authored and
Lorenzo Colitti
commited