This reverts commit ee96ba0e60.
Reason for revert: Droidmonitor triggered revert due to b/342557183. Will be verifying through ABTD before submission.
Change-Id: I7e185c3ac11da27c7bb9d95e4221f7dfc22cf48c
Priyanka Advaniauthored and Gerrit Code Reviewcommited 2024-05-24 18:11:45 +00:00
Currently, even if apps don't have INTERNET permission and can not use
network, network access is considered not blocked and
ConnectivityService send onBlockedStatusChanged callback with
blocked=false.
This CL introduced BLOCKED_REASON_NETWORK_RESTRICTED and consider
network access from apps targetting W+ on V+ releases is blocked if apps
don't have INTERNET permission.
Permission is set when the user is added or package is installed and
permission is removed when the user is removed or packages is
uninstalled.
So ConnectivityService does not need to monitor permission change to
send onBlockedStatusChanged callback by permission change.
Test: CSBlockedReasonsTest
Bug: 339559837
Change-Id: I58d2a4eddc714e205f5b96219f95b637f2826c58
This allows apps built against V but run on older platform
can adopt this feature. This keep compatibility for older
apps which does not built against newest platform.
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.net.NetworkStatsServiceTest
Fix: 339154075
Change-Id: Ia12997595579190ae0d65ad36ce39d011dde37ce
NETWORKINFO_WITHOUT_INTERNET_BLOCKED compat flag only changed the
behavior of getActiveNetworkInfo that depends on
bpfNetMaps#isUidNetworkingBlocked.
But isUidNetworkingBlocked is used from other APIs(e.g. getActiveNetwork)
This CL update all APIs that depends on isUidNetworkingBlocked to follow
the compat flag to make behavior consistent between APIs.
aosp/3079290 will update onBlockedStatusChanged callback to follow this
compat flag.
Bug: 340773991
Bug: 339780435
Test: TH
Change-Id: If64ec800f21c2adc613884838202e2dece4a8d95
Before aosp/3001087, getNetworkActiveInfo did not return network info
with blocked state for apps without PERMISSION_INTERNET even if the
network is actually blocked.
aosp/3001087 updated getNetworkActiveInfo to return correct blocked
state on V+.
However, this broke some apps that use getNetworkActiveInfo in wrong way
and depends on the previous behavior.
So this CL introduces the compat flag to keep previous behavior for apps
targeting U or older releases.
Test: TH
Bug: 333340911
Change-Id: I0e0950f2148de0ffdb45495903a5a87e0d4c1c0b
FIREWALL_CHAIN_OEM_DENY_x chains were added by aosp/2114533 but
corresponding blocked reasons were not added.
Upcoming aosp/3027488 updates CS to generate blocked reasons based on
bpf map contents.
Without blocked reasons for oem deny chains, onBlockedStatusChanged
callback will have inconsistency from the actual network blocked status.
This CL adds BLOCKED_REASON_OEM_DENY for FIREWALL_CHAIN_OEM_DENY_x chains
Bug: 328732146
Test: TH
Change-Id: I3793aa0e231d32fea5eb202ed69e170f74d66b02
With this annotation, errorprone build will fail if callers don't check
sdk version before calling any methods in BpfNetMapsUtils.
Bug: 328732146
Test: TH
Change-Id: Ifa52dc1d2766f8d46dfdc4f6ca9dbb963406c084
Follow up CLs will update CS to generate blocked reason from bpf map
instead of asking NPMS.
However, one issue is NPMS set PENALTY_BOX for
BLOCKED_METERED_REASON_USER_RESTRICTED and
BLOCKED_METERED_REASON_ADMIN_DISABLED without telling the reason.
So, CS can not know the reason of PENALTY_BOX.
This CL add new firewall chain and match to distinguish reasons.
NPMS must call setUidFirewallRule with
FIREWALL_CHAIN_METERED_DENY_USER or FIREWALL_CHAIN_METERED_DENY_ADMIN
based on the reason so that CS can know the reason of restriction.
Bug: 332628891
Test: atest com.android.cts.net.HostsideRestrictBackgroundNetworkTests
Change-Id: Ia4ad4bdb345abc22c782630e828edfad2452db36
* Struct.java is removed from net-utils-device-common-bpf and
net-utils-device-common-struct's source list
* Created a lib net-utils-device-common-struct-base for Struct.java
* Updated libs that require Struct.java to include
net-utils-device-common-struct-base.
* Replaced net-utils-multicast-forwarding-structs with
net-utils-device-common-struct in service-connectivity
Bug: 323503345
Test: build tethering module.
Change-Id: I3f60715c3d8043b7569db7612dee9d4fa1ccba59
Update isUidNetworkingBlocked to return false for system uids regardless
of firewall chain status since this is an actual behavior
Bug: 328732146
Test: TH
Change-Id: Ic4760b927f51a1229e9af09c79b5261f85fe89d1
This CL also adds @RequiresApi(Build.VERSION_CODES.UPSIDE_DOWN_CAKE)
to NetworkStackBpfNetMaps
Bug: 328732146
Test: TH
Change-Id: Ifa4cffd046164405b8b49d2e2ee9f27240bec6fa
This is a preparation to add isUidNetworkingBlocked method to BpfNetMaps
without duplicating codes.
Bug: 328732146
Test: TH
Change-Id: I50a46931f6c80a1f4cfca5d9e78b2ab742a793f2
Allows compiler to turn some conditionals into constant
expressions and to simply the machine code.
Bug: 326744138
Change-Id: Ic0abed8c548986fe7ef1876bd1eb3e55ac6b8c10
BpfNetMapsReader is loaded to bootclasspath. So this class should not
contain unnecessary codes.
To make this clear, this CL renames to NetowrkStackBpfNetMaps and add
comments
Bug: 328732146
Test: TH
Change-Id: I557627c9fae087eb6119c2ae31d46526fa9e5d7e
aosp/2873154 disabled DEFAULT_FORBIDDEN_CAPABILITIES to avoid crash when
the module rolls back.
DEFAULT_FORBIDDEN_CAPABILITIES was introduced to avoid existing users
getting callback from local networks.
But aosp/2936050 fixed this issue by introducing compat flag.
So this CL cleans up DEFAULT_FORBIDDEN_CAPABILITIES code
Test: TH
Bug: 319212206
Change-Id: I125800cb3dd029f190056c8715ab9a741a83a234
Revert submission 2980591-cronet_121_0_6167_71
Reason for revert: Seems to be the cause for b/328855816
Reverted changes: /q/submissionid:2980591-cronet_121_0_6167_71
Change-Id: I8baddfcbc1926acf9d58130b2032b5acd921e4fa
Apps that target an SDK before V will not see networks with
NET_CAPABILITY_LOCAL_NETWORK unless they explicitly set this capability
in their network requests.
Bug: 319212206
Test: CSLocalAgentTests
Change-Id: I414b03dfea9a8aac83304c6be501f03d637739b4
This commit removes the unused library visibility.
The "frameworks/base/packages/Connectivity" folder is the
temporary folder for modulizing the connectivity codes. There is
no such need now.
Test: m
Change-Id: Ia2890fe64c1bc369fcb90be645263bc56c98a7b2
These unit tests are closely tied to the source code in
frameworks/base and were incorrectly placed in the connectivity
module. Also update the libraries visibility that are used by
the tests.
Test: atest FrameworksNetTests
Change-Id: I196c33a8bd5b5cdb9d42aea381e900681ff6d25e
Junyu Lai
authored and
Gerrit Code Review
commited 
Maciej Żenczykowski
authored and
Yuyang Huang
commited 
Motomu Utsumi
authored and
Priyanka Advani
authored and
Treehugger Robot
authored and
Lorenzo Colitti
commited 
Chidera Olibie
commited 
Shai Barack
authored and
Nagendra Prasad Nagarle Basavaraju
commited 
Yang Sun
authored and
George Verhaegen
authored and
Lisa (LeeWei) Liu
authored and
Patrick Rohr
commited 
Chiachang Wang
authored and