Commit graph android_packages_modules_Co.../framework
Message SHA1
Merge "Add jarjar rules generator"
Remi NGUYEN VAN   authored and   Gerrit Code Review   commited 2022-06-17 01:09:11 +00:00
49d6b5d80b
Merge changes Ic6ff7a3d,Iff9b9792
* changes:
  Refactor code and improve tests for VPN filtering
  Remove LOCKDOWN from FirewallChain IntDef

Motomu Utsumi   authored and   Gerrit Code Review   commited 2022-06-16 01:32:20 +00:00
5d787feef0
Merge changes Ie1a91959,Ic189b2c0,I39d70e0a,Ibb5f1402
* changes:
  TestNetworkInterface: add support for MacAddress and MTU
  TestNetworkService: add support for creating iface without carrier
  TestNetworkService: Add support for toggling carrier on tun/tap
  TestNetworkService: Fix TestNetworkInterface parcel flags

Patrick Rohr   authored and   Gerrit Code Review   commited 2022-06-15 20:53:30 +00:00
929368eb1a
TestNetworkInterface: add support for MacAddress and MTU
Both MacAddress and MTU size are often needed in tests and very painful
to get a hold of without system server permissions.

Test: TH
Change-Id: Ie1a91959916ea39277e76aa1b61f38d59a5d2a90

Patrick Rohr   commited 2022-06-15 10:25:45 -07:00
88f97f4fba
TestNetworkService: add support for creating iface without carrier
Disabling the carrier of a tun/tap interface before the interface is
brought up is useful in testing.

Test: atest EthernetManagerTest
Change-Id: Ic189b2c0eda76e3f58c3f664e5f5d18c2d7e6e96

Patrick Rohr   commited 2022-06-15 10:25:45 -07:00
2b726efdc0
TestNetworkService: Add support for toggling carrier on tun/tap
Adds support for setting carrier to on/off for a tun/tap interface. It
turns out that TUNSETCARRIER is also usable by tap interfaces, and
TUNSETLINK does not work as expected.

Test: atest EthernetManagerTest
Change-Id: I39d70e0a65a34e7a4c4df70c53e4cc781a24a213

Patrick Rohr   commited 2022-06-15 10:17:42 -07:00
bbd16c57a0
Unfinalize additional methods in NetworkAgent
This change allows tests to mock NetworkAgent, and the methods
required for ensuring that the VPN is migrating properly.

Bug: 235853154
Test: Treehugger
Change-Id: I49333c010cc7f3d60ffd39f853777bfc52de3a89

Benedict Wong   authored and   Lorenzo Colitti   commited 2022-06-15 09:16:50 +00:00
0815c8c66a
TestNetworkService: Fix TestNetworkInterface parcel flags
PARCELABLE_WRITE_RETURN_VALUE will close the fd when writeParcelable is
called. This is not always preferable (specifically, if
TestNetworkInterface is passed as an "in" parameter).
writeParcelable(FileDescriptor, ...) should therefore use the flags
passed to writeToParcel which should be correct for all cases.

Test: atest EthernetManagerTest
Change-Id: Ibb5f14028a3d686157504da3657a18ec0bc28110

Patrick Rohr   commited 2022-06-14 10:23:53 -07:00
2ebff8a777
Add jarjar rules generator
(This rolls forward part of a previous change, now that jarjar was fixed
to not get very slow when the number of rules increases).

Jarjar rules are hard to keep in sync with code, and hard to maintain
manually as the distinction between what should and should not be
jarjared is not always clear. This results in unsafe binaries that are
manually maintained, and developer frustration when something fails due
to incorrect jarjar rules.

Add utility to autogenerate jarjar rules, which can be run at build time
time (via a genrule) instead. The generator scans pre-jarjar
intermediate artifacts, and outputs jarjar rules for every class to put
it in a package specific to the module. The only exceptions are:

 - Classes that are API (module-lib API is the largest API surface of
   the module, so module-lib API stubs would typically be used)
 - Classes that have unsupportedappusage symbols
 - Classes that are excluded manually (for example, because they have
   hardcoded external references, like for
   ConnectivityServiceInitializer in SystemServer).

Bug: 217129444
Test: atest jarjar-rules-generator-test;

Change-Id: I3493957e39a661b6c2e330944e7c3023b8f3203e

Remi NGUYEN VAN   commited 2022-06-14 09:11:27 +00:00
11f162b5f8
Make setUnderlyingNetwork() non-final
This change allows tests to mock NetworkAgent, and the methods
required for ensuring that the VPN is migrating properly.

Bug: 235853154
Test: Treehugger
Change-Id: If4de0935a3c8627ca12db52ff223834f9f7237e8

Benedict Wong   commited 2022-06-14 02:07:50 +00:00
33acb90622
Merge "Make FIREWALL_CHAIN_OEM_DENY API"
Treehugger Robot   authored and   Gerrit Code Review   commited 2022-06-13 02:12:30 +00:00
662f414c99
Make FIREWALL_CHAIN_OEM_DENY API
Bug: 208371987
Test: m
Change-Id: Ie0c2ad862c02f9fd4561869cf5a1adc44f1be11b

Motomu Utsumi   commited 2022-06-12 11:37:19 +00:00
62385c884f
Remove LOCKDOWN from FirewallChain IntDef
LOCKDOWN_VPN was in the FirewallChain IntDef but this was not a right
place because LOCKDOWN_VPN was not a valid value for Connectivity APIs
that take an argument annotated with @FirewallChain(setUidFirewallRule,
setFirewallChainEnabled, replaceFirewallChain).

LOCKDOWN_VPN was in the FirewallChain IntDef because
BpfNetMaps#setUidRule was used to add/remove LOCKDOWN_VPN entries.
This commit adds BpfNetMaps#updateUidLockdownRule and uses this to
add/remove LOCKDOWN_VPN entries instead of BpfNetMaps#setUidRule and
removes LOCKDOWN from FirewallChain.

Bug: 206482423
Test: atest TrafficControllerTest ConnectivityServiceTest
PermissionMonitorTest HostsideVpnTests#testBlockIncomingPacket

Change-Id: Iff9b9792fc0f208f153e10e396c6d5034b412d7c

Motomu Utsumi   commited 2022-06-10 02:49:25 +00:00
8b42e6d431
Replace gensrcs with java_library to deprecate depfile in gensrcs
The depfile concept in Soong and Ninja isn't applicable in Bazel because
Bazel requires listing the deps explicitly. This CL changes the module
type from gensrcs to java_library with proto.type set to "stream".

The end goal is to eventually deprecate depfile in gensrcs to ensure all
gensrcs modules are convertable to Bazel.

Test: CI
Bug: 179452413
Change-Id: I921324e6260b7de6329a1ff445b6326643a9c526

Vinh Tran   commited 2022-06-08 01:26:16 -04:00
6d8c1d7916
Add 3rd deny firewall chain for OEM
Bug: 208371987
Test: atest
CtsNetTestCases:android.net.cts.ConnectivityManagerTest#testFirewallBlocking
ConnectivityServiceTest

Change-Id: Ib521fa02f6a19270cb88a3d85321bda822516c78

Motomu Utsumi   commited 2022-06-06 07:47:35 +00:00
1d9054ba5f
Add deny firewall chain for OEM
Bug: 207773349
Bug: 208371987
Test: atest
CtsNetTestCases:android.net.cts.ConnectivityManagerTest#testFirewallBlocking
--iterations 50 && atest ConnectivityServiceTest --iterations 10

Change-Id: I60d5540821abcced03356f366775f16ee369d7f9

Motomu Utsumi   commited 2022-06-03 09:10:57 +00:00
d980149817
Revert "NetworkRequest.Builder should create a defensive copy of capabilities"
This reverts commit f1ab80ea62.

Reason for revert: DroidMonitor: Potential culprit for Bug 233698500 - verifying through ABTD before revert submission. This is part of the standard investigation process, and does not mean your CL will be reverted.

Change-Id: I7de63e0a3656194b94b29e28862c62fc300dfdfa

Iván Budnik   commited 2022-05-24 09:24:16 +00:00
6373153fcd
NetworkRequest.Builder should create a defensive copy of capabilities
This broke my tests in unexpected ways as creating a new
NetworkRequest.Builder() changed the static request object.

Test: TH && atest EthernetManagerTest
Change-Id: Ia6c39145cf92a2795f7fc2f4efbcb46d193f6b72

Patrick Rohr   commited 2022-05-20 12:00:36 -07:00
f1ab80ea62
Merge changes Ide01c994,Ia9f12a7b
* changes:
  Revert "Autogenerate connectivity jarjar rules"
  Revert "Clarify comment in gen_jarjar.py"

Colin Cross   authored and   Gerrit Code Review   commited 2022-05-18 18:34:32 +00:00
708b1ab707
Revert "Autogenerate connectivity jarjar rules"
This reverts commit 53eb35cd82.

Reason for revert: b/233081774, caused long build times in FrameworkNetTests

Change-Id: Ide01c994f694b55fc0e87bb0e81584ac44196e68

Colin Cross   commited 2022-05-18 18:30:27 +00:00
ece3171cf0
Merge changes If52ece61,Iedf344f6
* changes:
  Block incoming packets in VPN Lockdown mode.
  Refactor VPN interface filtering necessity check

Motomu Utsumi   authored and   Gerrit Code Review   commited 2022-05-17 01:42:00 +00:00
f6131c483b
Block incoming packets in VPN Lockdown mode.
Currently, even when VPN Lockdown mode is enabled, incoming packets are
not dropped if VPN is not connected.

This commit fixed this issue.
After this commit, If VPN Lockdown mode is enabled, incoming packets
are dropped regardless of the VPN connectivity.

Bug: 206482423
Test: atest TrafficControllerTest ConnectivityServiceTest PermissionMonitorTest
Change-Id: If52ece613c8aac1073355e43b6fb9cb3fcc87d1d

Motomu Utsumi   commited 2022-05-16 10:40:59 +00:00
b08654ca04
Merge "Autogenerate connectivity jarjar rules"
Remi NGUYEN VAN   authored and   Gerrit Code Review   commited 2022-05-16 09:06:33 +00:00
4cd92adf0e
Autogenerate connectivity jarjar rules
Jarjar rules are hard to keep in sync with code, and hard to maintain
manually as the distinction between what should and should not be
jarjared is not always clear. This results in unsafe binaries that are
manually maintained, and developer frustration when something fails due
to incorrect jarjar rules.

Autogenerate jarjar rules at build time instead. This is achieved by
introducing a jarjar-rules-generator python-based library, which scans
pre-jarjar intermediate artifacts, and outputs jarjar rules for every
class to put it in a package specific to the module. The only exceptions
are:

 - Classes that are API (module-lib API is the largest API surface of
   the module)
 - Classes that have unsupportedappusage symbols
 - Classes that are excluded manually (for example, because they have
   hardcoded external references, like for
   ConnectivityServiceInitializer in SystemServer).

This change causes all classes in framework-connectivity(-t) and
service-connectivity to be jarjared into android.net.connectivity, but
still avoids jarjaring classes in com.android.server as before, to keep
it small.
For many classes this differs from the original jarjar rule.

Notes on implementation:

 - connectivity-jarjar-rules now has a subset
   framework-connectivity-jarjar-rules containing only the rules
   necessary for framework-connectivity. This is necessary because
   framework-connectivity cannot depend on rules generated based on
   service-connectivity, as there would be a dependency cycle
   (service-connectivity depends on framework-connectivity); Soong even
   crashes with a stack overflow.

 - framework-wifi.stubs.module_lib is added to
   framework-connectivity-pre-jarjar as it is necessary to build it (it
   is already in impl_only_libs in the defaults).
   It is unclear why framework-connectivity-pre-jarjar could build
   before that (possibly because it was only used as "lib" ?)

 - Fix package-private visibility; for example NattSocketKeepalive,
   TcpSocketKeepalive are not API so should be jarjared, but are used
   by ConnectivityManager which is not jarjared, so they are not in the
   same package after the change. Package-private members in the
   former 2 need to be public to be accessible. Changes in this commit
   are all that is needed, as demonstrated by followup commits that move
   the classes to a different package without further changes, and that
   enforce that no class in an API package gets jarjared.

 - framework-connectivity-internal-test-defaults is separated from
   framework-connectivity-test-defaults, for unit tests that need to
   access internal jarjared classes. Such tests need to use the jarjar
   rules themselves too, so this is only appropriate for connectivity
   internal unit tests.

Test: atest ConnectivityCoverageTests CtsNetTestCases
Bug: 217129444
Change-Id: Ied17c3955ea2fda130089265d02908937ad8af1e

Remi NGUYEN VAN   commited 2022-05-13 17:30:06 +09:00
53eb35cd82
Merge "Do not remove profile network preference for different uids"
Lorenzo Colitti   authored and   Gerrit Code Review   commited 2022-05-09 09:40:52 +00:00
42791188b2
Merge "Support QosCallback for UDP socket -Filter"
Sewook Seo   authored and   Gerrit Code Review   commited 2022-05-06 20:46:26 +00:00
047423fd34
Do not remove profile network preference for different uids
Multiple enterprise slice can be setup within single user profile based
on different uids. So do not remove profile network preference with same
user profile but with different uids

Bug: 229644102
Test: manual system test and ConnectivityServciceTest
Change-Id: I897b643e01240958fff575de9e15182069efc698

Sooraj Sasindran   commited 2022-05-06 00:58:33 -07:00
9cc129f37d
Merge "Update VPN isolation code for excluded routes"
Prerana Patil   authored and   Gerrit Code Review   commited 2022-05-03 17:40:12 +00:00
a1c6dbbd53
Merge "Fix ConnectivityManager memory leak"
Mark Chien   authored and   Gerrit Code Review   commited 2022-05-03 02:46:05 +00:00
8e3b96b61f
Update VPN isolation code for excluded routes
Bug: 230058738
Test: atest LinkPropertiesTest

Result: https://paste.googleplex.com/4706859672928256

Change-Id: I970fca6b0e2cd358e9bd77152563d13367867c74

Prerana   authored and   Prerana Patil   commited 2022-04-29 22:23:02 +00:00
2b97bbebf4
Merge "Fix targetSdkVersion gate for EXCLUDED_ROUTES compat change"
Treehugger Robot   authored and   Gerrit Code Review   commited 2022-04-29 08:57:25 +00:00
134d5ec884
Fix ConnectivityManager memory leak
ConnectivityManager have a self reference static instance. This
causes a leak if context is refernce from a static variable. Using
the applicationContext, which will never be freed for the life of the
application, for the sInstance static instance.

Bug: 202978965
Test: atest ConnectivityManagerTest
Change-Id: I87206e1bfbb1f877b5a10f5fdbc25e2f9f11bef4

markchien   authored and   Mark Chien   commited 2022-04-29 08:01:23 +00:00
d201566169
Fix targetSdkVersion gate for EXCLUDED_ROUTES compat change
Bug: 230726333
Test: check Developer options > App Compat Changes
Change-Id: Ia80efd07e6a8c6e6cc043411fbc2b56b07b4dd06

Taras Antoshchuk   commited 2022-04-28 15:47:29 +02:00
af3c360ed4
Merge "Make a defensive copy when sending NetworkInfo change"
Treehugger Robot   authored and   Gerrit Code Review   commited 2022-04-28 09:29:27 +00:00
8eda07cff7
Make a defensive copy when sending NetworkInfo change
The issue scenario is:
- Telephony registers a network agent and calls markConnected().
- NetworkAgent set mNetworkInfo to CONNECTED and call
  queueOrSendNetworkInfo() with mNetworkInfo, but NetworkAgent
  don't actually send a message to CS yet because the agent is
  not registered.
- Telephony calls unregister because the cellular network is
  disconnected.
- NetworkAgent set mNetworkInfo to DISCONNECTED, overwriting the
  previous CONNECTED state, and then call queueOrSendNetworkInfo
  again with mNetworkInfo. Again this doesn't send any message
  because the agent is not connected.
- EVENT_AGENT_CONNECTED arrives. NetworkAgent replies all the
  messages in mPreConnectedQueue, but NetworkAgent send two
  DISCONNECTED NetworkInfos eventually.

The CONNECTED state should be sent to CS instead of latest state
DISCONNECTED. Thus, make a defensive copy when sending
NetworkInfo change to prevent state overwriting.

Without the NetworkAgent fix, the test will fail with no
onAvailable callback. Because the Network has never been martk as
CONNECTED.

Bug: 228623362
Test: atest FrameworksNetTests CtsNetTestCases
Change-Id: I11681743d3ff87ff9affd0b7e766894dc5111028

Paul Hu   commited 2022-04-28 14:57:43 +08:00
0869af65b4
Merge "Add a method to create a TAP interface with a given interface name."
Xiao Ma   authored and   Gerrit Code Review   commited 2022-04-22 13:10:19 +00:00
7d7e7cd1fe
Add a method to create a TAP interface with a given interface name.
Add a method that allows the caller to specify whether to create a
tap interface with a given specific interface name instead of the
default one. So far only the given name that starts with "v4-testtap"
or "v4-testtun" prefix is allowed. That's helpful to create a clat
interface which always has "v4-" clat prefix in the IpClient integration
test, to verify the callbacks happend on adding/removing clat interface.

Bug: 163492391
Test: atest CtsNetTestCases
Change-Id: I9ea7013fce919cafb719998a123164b5507f9ac0

Xiao Ma   commited 2022-04-21 16:57:22 +09:00
8bbb8089d7
Support QosCallback for UDP socket -Filter
Add matchProtocol() to QosFilter.
Add remoteAddress check to validate().
Add exception EX_TYPE_FILTER_SOCKET_REMOTE_ADDRESS_CHANGED
Don't send ParcelFileDescriptor to QosProvider for security reason

Bug: 203146631
Test: atest & verified on LTE test equipment
Change-Id: I7102ae9ba7cb9e1cc8d06b252aad4dad75860f3e

sewookseo   commited 2022-04-20 22:46:21 +00:00
afc22b02e2
Merge "Filter out excluded routes in LinkProperties"
Taras Antoshchuk   authored and   Gerrit Code Review   commited 2022-04-13 12:29:24 +00:00
ac8935bee7
Merge "Add protection for setLocalRoutesExcludedForVpn"
Chiachang Wang   authored and   Gerrit Code Review   commited 2022-04-13 04:19:42 +00:00
620ea6f1fc
Filter out excluded routes in LinkProperties
Gate presence of excluded routes in LinkProperties on target sdk T.

Bug: 186082280
Test: atest LinkPropertiesTest
Change-Id: If8fdb468a0a4968c5f2a878b7aacfeb4f7d9a9e5

Taras Antoshchuk   commited 2022-04-13 01:17:56 +02:00
30d41e59bc
Add MDnsManager
- Have MDnsManager to manage mdns native service binder call.
- Register it as a system service for NsdService.
- NsdService will use aidl to communicate with mdns, so add the
  relevant lib to framework-connectivity
- Add jarjar rule for mdns-aidl-interface classes.

Bug: 209894875
Test: atest FrameworksNetTests CtsNetTestCases
Change-Id: Ibc8b726c01a15015b450caf94d0afed570117b7f

paulhu   commited 2022-04-04 15:02:17 +00:00
541b72d03b
Merge "Support QosCallback with UDP socket"
Sewook Seo   authored and   Gerrit Code Review   commited 2022-03-30 20:01:45 +00:00
2304205a58
Merge "Add @RequiresPermission for setUnderlyingNetworks"
Lucas Lin   authored and   Gerrit Code Review   commited 2022-03-29 15:34:17 +00:00
41ed965e68
Improve JavaDoc for FirewallRule constants
Bug: 226946569
Test: TH
Change-Id: I8366bd58194e24da7ea74bf398aae196482d0151

markchien   commited 2022-03-29 12:28:25 +08:00
011a7f51c1
Merge "Api review: change updateFirewallRule to setUidFirewallRule"
Treehugger Robot   authored and   Gerrit Code Review   commited 2022-03-29 03:41:02 +00:00
3d4de57752
Support QosCallback with UDP socket
Add a constructor for QosSocketInfo using DatagramSocket.

Bug: 203146631
Test: atest & verified on LTE test equipment
Change-Id: I85c091a65610a96d721e4f0b07631867cda4db8a

sewookseo   commited 2022-03-29 02:38:05 +00:00
82657d70d7
Merge history of ConnectivityT
Renamed files/directories:
ConnectivityT/service/Android.bp --> service-t/Sources.bp
ConnectivityT/framework-t/Android.bp --> framework-t/Sources.bp
ConnectivityT/framework-t/aidl-export --> framework/aidl-export
ConnectivityT/service --> service-t
ConnectivityT/framework-t --> framework-t
ConnectivityT/tests --> tests
ConnectivityT/OWNERS --> (removed)

BUG: 222234190
TEST: TH
Ignore-AOSP-First: Move with history done per-branch
Merged-In: I81893df9f327abb84f1561b2b33027a2d23a4d65
Merged-In: I67c703e3f7aa9d5787f032a79ed62e45412baf4f
Change-Id: I27a91f1a94f9d807f92762436f533c4b0d0114d5

Remi NGUYEN VAN   commited 2022-03-25 11:02:45 +00:00
700ffc994f
Api review: change updateFirewallRule to setUidFirewallRule
Bug: 218494748
Test: TH

Change-Id: I52a02ebe109b687359f579c16fded4af3c9cd242
Merged-In: I52a02ebe109b687359f579c16fded4af3c9cd242

markchien   commited 2022-03-25 18:49:08 +08:00
3c04e66da0
Move the DscpPolicy status constants and IntDef to NetworkAgent.
As requested by API council.

Also fix lint errors in the test.

Fix: 217366078
Test: existing tests modified in this CL
Change-Id: I8f7cd0e78bf29aeb52ec6a08a5d635d25fa2205d

Lorenzo Colitti   commited 2022-03-25 01:06:46 +09:00
fbe1576139