Add new testcase in IpConfigStoreTest to cover the readIpConfiguration
usage, improve the code coverage for connectivity module.
To reduce the flakyness of test, this cl refactors DelayedDiskWriter
constructors by allowing to pass in a Dependencies instance, then
waitForIdle can be used to check if the delayed write operation
associated with the passed-in HandlerThread has completed in tests.
Bug: 234315786
Test: atest com.android.server.net.IpConfigStoreTest
Change-Id: I57c8bd02a771f1cca815252ba502cda0210d1385
NetworkMonitorManager should just be a passthrough wrapper for
INetworkMonitor. Move logic to choose the notifyNetworkConnected version
to call to its only caller, ConnectivityService.
This allows removing the dependency on modules-utils-build, which makes
the networkstack-client library less portable; for example it would add
duplicate classes if networkstack-client is included into service-wifi,
as service-wifi can already use modules-utils-build from framework-wifi.
Fixes: 227161380
Test: atest ConnectivityServiceTest
Change-Id: Ie50f586c5d1ffe021cb0a96294f13f478fd3a2dd
Updating the automotive allowed UIDs check to only work if the
capabilities have a single transport equal to ethernet.
Bug: 229419469
Test: atest FrameworksNetTests
Change-Id: I91e987d6b943a3c5986ab88553a6eef0d479b079
This is a followup commit for aosp/2017317.
1. Reorder the NAT464 information in dumpsys connectivity
2. Reword message when clat not started
Bug: 212345928
Test: dumpsys connectivity
Change-Id: I31c7066787dc7db8e5fe225f3918368b25bb7f5e
Hungming Chenauthored and Nucca Chencommited 2022-05-18 14:49:57 +00:00
Allow ethernet factories on automotive devices to set the allowed UIDs
on NetworkCapabilities.
Bug: 229419469
Test: atest FrameworksNetTests
Change-Id: I03e7cda75f1c530e0d0e4a756330bc9847a96668
(out of current /sys/fs/bpf/net_shared/...)
This will allow genfscon regexp changes in a followup selinux commit.
Note that this has a hard dependency on system/bpf change
'bpfloader: add support for netd_shared and net_private subdirs'
which also bumps bpfloader to v0.13.
This was merged May 12, 2022 (into both aosp/master and tm-dev)
and it is in Android T starting with Beta 3 release.
This isn't really an issue since amusingly T Beta 2 is already
incompatible with current mainline releases due to the snap
reverting a previous required bpfloader system/bpf change:
move net_shared bpf programs into net_shared subdirectory
See: http://b/232050459#comment14
So this doesn't break T Beta1/2, since they already don't work,
and Beta3 will work.
Bug: 218408035
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Id5f14d6e3f11cfe35d9d8a9496548a2bc4d022ec
Maciej Żenczykowskicommited 2022-05-16 23:24:37 +00:00
Currently, even when VPN Lockdown mode is enabled, incoming packets are
not dropped if VPN is not connected.
This commit fixed this issue.
After this commit, If VPN Lockdown mode is enabled, incoming packets
are dropped regardless of the VPN connectivity.
Bug: 206482423
Test: atest TrafficControllerTest ConnectivityServiceTest PermissionMonitorTest
Change-Id: If52ece613c8aac1073355e43b6fb9cb3fcc87d1d
* changes:
Catch new exceptions from BpfMap
Revert "Open and close clat bpf map while clat is starting and stoping"
Revert "ClatCoordinator: replace BpfMap with IBpfMap"
Nucca Chenauthored and Gerrit Code Reviewcommited 2022-05-12 13:42:23 +00:00
Currently, there is no limtation for an app to request
data usage callback, which is dangerous if the app fire
hundreds of thousands requests and potientially this might
cause OOM if the apps don't free them.
Test: atest NetworkStatsObserversTest#testRegister_limit
Bug: 229103088
Change-Id: I8299f46fd47a82ec9b25ba2e0d3c95db5512c331
1) alowFallback flag was incorrectly not reset while setting profile
preference. Corrected it.
2) Threw exception if default preference and enterprise preference are
set together
3) renamed clearUser to withoutUser
Bug: 231670730
Test: ConnectivityServiceTest
Change-Id: Iaf49237bdc791c7e1dd884d069eff64e74757477
Normally if an app calls requestNetwork with capabilities that it
does not have permission to request, it gets a SecurityException,
except if it requests NET_CAPABILITY_CBS, in which case the request
will not throw but the app will get an onUnavailable callback.
Make this codepath throw as well. This simplifies the code and makes
the app-visible behaviour more consistent (and consistent with what
happens in S and below). The reason the code was written this way is because the carrier privilege app should receive a callback if it
loses permission. But onUnavailable is also not the best callback to
send, since it is used very rarely and also releases the app's
request. It seems better to leave the request registered and send
onLost.
Test: atest FrameworksNetTests
Bug: 194332512
Change-Id: I5eaeb415a6654851246e38599a996fbd9366fde0
junyulaiauthored and Paul Hucommited 2022-05-10 10:26:54 +00:00
Since 3p apps are allowed to use restricted networks in S, they
should be allowed to request a restricted network reasonably.
Otherwise, the functionalities of 3p apps will break if they rely
on restricted networks. Thus, CS needs to allow 3p apps to
request restricted networks if 3p apps are in the allowed list.
Bug: 230509118
Test: atest FrameworksNetTests CtsNetTestCases
Change-Id: I236f1550095ee2be29adbc3b28d3ac2561a8b072
Multiple enterprise slice can be setup within single user profile based
on different uids. So do not remove profile network preference with same
user profile but with different uids
Bug: 229644102
Test: manual system test and ConnectivityServciceTest
Change-Id: I897b643e01240958fff575de9e15182069efc698
BpfMap class supports AutoCloseable interface which closes
file descriptor only in try-exit. BpfMap class doesn't close
fds while the object is released.
Change the timing of opening and closing bpf map file descriptors
to clat is starting and stoping.
Moreover, the reason that manual close BPF map file descriptors is
as follows. Just don't rely on that GC releasing to close the file
descriptors even if class BpfMap supports close file descriptor in
finalize(). If the interfaces are added and removed quickly, too
many unclosed file descriptors may cause unexpected problems.
Bug: 230880517
Test: manual test
Steps:
1. Connect to IPv6 only wifi (GoogleGuest) and mobile data
2. Check that map fds are appeared:
/proc/$(system_server_pid)/fd/$(bpf_map_fd)
$ adb shell ps | grep system_server
system 1929 825 20311224 730060 do_epoll_wait 0 S system_server
$ adb shell ls -all proc/1929/fd | grep bpf-map
.. system system 64 2022-05-05 13:36:42 .. 331 -> anon_inode:bpf-map
.. system system 64 2022-05-05 13:36:42 .. 348 -> anon_inode:bpf-map
3. Check the clat maps are added.
$ adb shell dumpsys connectivity
NetworkAgentInfo{network{105} handle{454377263117} ni{WIFI ..
Nat464Xlat:
..
Forwarding rules:
BPF ingress map: iif nat64Prefix v6Addr -> v4Addr oif
47 /64:ff9b::/96 /2a00:79e1:abc:6f02:f182:6c29:ab56:9961 -> /192.0.0.4 62
BPF egress map: iif v4Addr -> v6Addr nat64Prefix oif
62 /192.0.0.4 -> /2a00:79e1:abc:6f02:f182:6c29:ab56:9961 /64:ff9b::/96 47 ether
NetworkAgentInfo{network{106} handle{458672230413} ni{MOBILE[LTE] ..
Nat464Xlat:
<not start>
4. Disconnect from wifi
5. Check that map fds are disappeared:
/proc/$(system_server_pid)/fd/$(bpf_map_fd)
$ adb shell ls -all proc/1929/fd | grep bpf-map
(fd 331 and 348 were not found)
Change-Id: I60c0301bf00beae5cf5ab3535c6a3da68a2a4a9b
Do validate() before sending QosCallback to App.
If validate fails, notify error to App & tear down QosCallback internally.
Bug: 203146631
Test: atest & verified on LTE test equipment
Change-Id: I05e28b10b816381a191272c85b3b178204d835d7
sewookseoauthored and Sewook Seocommited 2022-05-05 08:43:50 +00:00
isMangedProfile returns true for managed profiles.
But enterprise device can be fully managed like device owner.
Hence check specifically if request is coming on fully managed
device.
Bug: 226966328
Bug: 231071836
Test: ran DevicePolicyManager CTS and ConnectivityServiceTest
Change-Id: I7827466bd61e24ba9c36c3a2e25043257e2ed602
(this is safe because on pre-T none of these maps and programs are mainlined
and thus safe to access from mainline code anyway)
Test: TreeHugger, manual
Bug: 218408035
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I23e565d665247f33e084978890a1ee8ffe0fe568
Maciej Żenczykowskicommited 2022-04-23 09:03:06 +00:00
Add a method that allows the caller to specify whether to create a
tap interface with a given specific interface name instead of the
default one. So far only the given name that starts with "v4-testtap"
or "v4-testtun" prefix is allowed. That's helpful to create a clat
interface which always has "v4-" clat prefix in the IpClient integration
test, to verify the callbacks happend on adding/removing clat interface.
Bug: 163492391
Test: atest CtsNetTestCases
Change-Id: I9ea7013fce919cafb719998a123164b5507f9ac0
- For clatd start and stop, use ClatdCoordinator on T+ and Netd on S-
- Fix the unit test for T+ and S- devices
Note that mokito.verify(.., times(1)) is replaced by verify(..)
because times(1) is the default and can be omitted.
See verify in mockito/src/main/java/org/mockito/Mockito.java
Note that this commit needs to be merged with aosp/1956072.
Bug: 212345928
Test: atest FrameworksNetTests
manual test
1. Connect to ipv6-only wifi.
2. Try IPv4 traffic.
$ ping 8.8.8.8
3. Check bpf entries are added
4. Disconnect from ipv6-only wifi.
5. Check bpf entries are removed
6. testipv4.com shows 10/10
Change-Id: I7dfda6eec19de94e4258971effcd8a1210542473
Address aosp/2052545 leftover comments:
- Log a wtf when the received user is unknown.
- Move the code to where it's used.
- PermissionMonitor is using BpfNetMaps for sending traffic
permission. So it’s useless to do the netd null check before
sending permission. Thus, remove this redundant check.
bug: 224775316
Test: atest FrameworksNetTests
Change-Id: I5c1291b6b855747d7900372b800dd039dd0730fe
A UID can be a concatenation of a UserID with a 5 digit package UID.
E.g., Bluetooth under User10 would have UID 1001002. This CL removes the
UserID (if any), before checking against BLUETOOTH_UID.
Bug: 228598338
Test: m
Change-Id: I532583345cc9ab474fc848a3ede6be9d8be9c5b0
Remi NGUYEN VAN
commited 
Hungming Chen
commited 
Xiao Ma
authored and
Gerrit Code Review
commited 
Chiachang Wang
commited 
Treehugger Robot
authored and
James Mattis
commited 
Maciej Żenczykowski
commited 
Motomu Utsumi
commited 
Junyu Lai
authored and
Sooraj Sasindran
authored and
Paul Hu
authored and
Lorenzo Colitti
authored and
Sewook Seo
authored and
Prerana Patil
authored and
Andrew Cheng
commited