Handler thread updates mDefaultNetworkRequests and Multiple threads
read/iterate mDefaultNetworkRequests without locking.
This caused NPE when there is concurrent updates and iterations.
This CL fixed this issue by using CopyOnWriteArraySet.
CopyOnWriteArraySet is suitable since number of default network request
is small (system default network request + per-app default network
requests) and updated infrequently but read frequently.
Bug: 293978451
Test: TH
Change-Id: Iaefe8e6e31c2b5257ebc51b4f848c3a7197781cb
INGRESS_TO_VPN_ADDRESS_FILTERING is disabled due to b/352424251 and
testDropPacketToVpnAddress fails if the feature is disabled.
So skip testDropPacketToVpnAddress if the feature is disabled.
Bug: 362434644
Test: adb shell device_config put tethering
ingress_to_vpn_address_filtering -1
Test: atest CtsHostsideNetworkTests
Change-Id: Ib16a7550dcf93dd9ecf29047b1c4f101ff6d610d
networkRemoveUidRangesParcel throws ServiceSpecificException if the
native network is already destroyed.
This can happen when
1) per-app default network request is satisfied by network1
2) unregisterAfterReplacement is called to the network1. This calls
netd.networkDestroy and network is removed from netd.
3) per-app default network request is removed. This calls
netd.networkRemoveUidRangesParcel but netd does not know about this
netid anymore.
This CL fixes this issue by skip calling networkRemoveUidRangesParcel if
the request satisfier is already destroyed.
Bug: 336961452
Bug: 357974842
Test: CSSatelliteNetworkTest
Change-Id: Id775cca6fffd03545f1c4bc5016d0de4813f17df
OEM VPNs might need to receive packets to VPN address via
non-VPN interface.
Bug: 352424251
Test: CsIngressDiscardRuleTest
Change-Id: Ia9000bcbb5b3b9e1e0d396ba78946be36e2fc5ba
"Shrinked" should actually be "shrunk" or "shrunken"; in any case
"minimized" is simpler and possibly more accurate (it's the minimum size
required to hold the values).
Test: atest
Change-Id: If787d3f3d6e1046338d4e89ed924bce183e74bd6
To avoid filling the binder buffers, and sending unnecessary callbacks
when apps are unfrozen (for example successive LinkProperties changes or
onAvailable+onLost are not useful), queue and aggregate callbacks for
apps that are suspended.
Test: atest
Bug: 327038794
Bug: 279392981
Change-Id: I6de357ac2834f1f7e960dfbaa63adfc3825f2a82
Some legacy VPNs need to receive packets to VPN address via
non-VPN interface.
Bug: 352424251
Test: CsIngressDiscardRuleTest
Change-Id: Iad06dc69c5bf5ccda476e89ed9b0fc1bc63d2ebe
No-op refactoring of ConnectivityService, in preparation for a change to
suspend callbacks for frozen apps.
Test: atest
Bug: 327038794
Bug: 279392981
Change-Id: I55bdd6c1244d6829d40223883ca148ce9ac5dca8
Add a flag to be used for an optimization to queue callbacks while apps
are frozen, instead of filling the binder buffer.
Bug: 327038794
Bug: 279392981
Test: atest
Change-Id: I6cc2507de88fae3d0866f9831e1e9026200297e4
- This CL puts RoutingCoordinator into staticlibs to make it usable by
both Tethering and ConnectivityService on R.
- This CL also changes the return type of
ConnectivityInternalApi#getRoutingCoordinatorManager() to IBinder so
it has fewer dependencies.
Bug: 350699020
Test: CI
Change-Id: Iba096e940795cd33e61c5141721394ad39e5ce6d
Instead of printing the flags as hex, use flag names for known flags.
Bug: 327038794
Bug: 279392981
Test: atest
Change-Id: I11ba4de1e8e60d5468a72b275cd724be669b32bc
Address review comment on aosp/3027487
This CL also adds test for enforceMeteredApnPolicy
Test: CSBlockedReasonsTest
Bug: 344800107
Change-Id: Ib531bf5b34566fc91fec9f977c5257b332189706
Most users of NetworkCallback do not override all methods, so callbacks
from ConnectivityService end up being unused by the app.
To save resources, check which callback methods are overridden in
ConnectivityManager, and inform ConnectivityService so it can skip
preparing and sending the corresponding binder calls when the callback
is not used by the app.
This is flagged off by default.
Test: flag enabled: atest CtsNetTestCases ConnectivityCoverageTests
Bug: 327038794
Bug: 279392981
Change-Id: Iaf490f416fb6e1437d40497fba1a40a899a9f523
This reverts commit fe956d9189.
This is targetting mainline release M-2024-09.
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: If89337854d677fdef1389b85cea645715a5e8491
Maciej Żenczykowskicommited 2024-06-21 15:14:33 +00:00
This reverts commit 9161b153b4.
This is targetting mainline release M-2024-09.
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I3d053f8c006eee8c1cbc7918f6fc5e30f5d09375
Maciej Żenczykowskicommited 2024-06-21 15:14:20 +00:00
this is to fix some lint issues
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I8c4dff0c8a6ba28596a346fef40f698962e7094b
Maciej Żenczykowskicommited 2024-06-16 05:22:58 -07:00
Apparently, we have previously seen instances of the pipeline being
broken, so this is adding a Log.wtf() to test the pipeline.
It is only run on user builds to not randomly crash droidfood devices.
Test: cf boots
Change-Id: Ie4e6661adef6f1878529688561805f2485e58391
Since BpfHandler::init() in the August module does not wait on
netbpfload (it only loads test.o), post on the ConnectivityService
handler and check that netbpfload ran to completion after 30s.
Log.wtf() on failure as these logs show up in Pitot even on release
builds.
Note that system server does not have access to any of the programs or
maps loaded from test.c, so all it can do is verify that mainline_done
exists.
Test: cuttlefish boots and does not crash
Change-Id: I6d2063f1d4f03207bbb6599b75954cfceb793af4
Patrick Rohrauthored and Maciej Żenczykowskicommited 2024-06-15 03:58:43 -07:00
On V+, there could be satellite network which is not restricted but
bandwidth constrained.
These satellite network has NET_CAPABILITY_NOT_RESTRICTED but does not
have NET_CAPABILITY_NOT_BANDWIDTH_CONSTRAINED.
Since NET_CAPABILITY_NOT_BANDWIDTH_CONSTRAINED is set by default, this
CL remove this capability from per-app default network request for the
default messaging app.
Test: CSSatelliteNetworkTest
Bug: 343823469
Change-Id: I413bdb764ead42d67ce1315c365500dbb8508eb3
Add a DeviceConfig flag that will be used to control whether callbacks
should be sent selectively based on whether the receiving method has
been overridden (will be implemented in a future change).
This adds utilities to allow ConnectivityManager to check whether a
ConnectivityService flag is enabled, as that feature will work across
ConnectivityManager and ConnectivityService. ConnectivityManager runs in
app process and does not necessarily have permissions to use
DeviceConfig. Also if it checked DeviceConfig separately from
ConnectivityService, values may be out-of-sync.
Test: atest, and see change using this
Change-Id: I204fa719cc627e84edc5c1e043d947f5ef3f8dee
Add dump raw BPF map command to connectivity service. The result will
be encoded as base64 strings. This is a preparation for Clatd's tests.
Usage:
dumpsys connectivity {clatEgress4RawBpfMap|clatIngress6RawBpfMap}
Bug: 285124667
Test: test with MtsEthernetTetheringTest#testTetherClatBpfOffloadUdp
which will be uploaded in a separated CL
Change-Id: I02c8efadb1c4b861d9bf6168667816b13412dc75
This reverts commit ee96ba0e60.
Reason for revert: Droidmonitor triggered revert due to b/342557183. Will be verifying through ABTD before submission.
Change-Id: I7e185c3ac11da27c7bb9d95e4221f7dfc22cf48c
Priyanka Advaniauthored and Gerrit Code Reviewcommited 2024-05-24 18:11:45 +00:00
Currently, CS destroys sockets of apps under firewall chain restriction
only when the firewall chains get enabled by setFirewallChainEnabled.
This CL updates CS to also destroy sockets of apps when the
setUidFirewallRule and replaceFirewallChain update uid rule and apps
lose network access due to FIREWALL_CHAIN_BACKGROUND.
This socket destruction is delayed until the cell modem is up in the
same way that CS destroys sockets of frozen apps.
Test: CSSocketDestroyTest
Bug: 300681644
Change-Id: I6a6fb5d6d7b71c0949a4195b84d30efef95bff37
Currently, even if apps don't have INTERNET permission and can not use
network, network access is considered not blocked and
ConnectivityService send onBlockedStatusChanged callback with
blocked=false.
This CL introduced BLOCKED_REASON_NETWORK_RESTRICTED and consider
network access from apps targetting W+ on V+ releases is blocked if apps
don't have INTERNET permission.
Permission is set when the user is added or package is installed and
permission is removed when the user is removed or packages is
uninstalled.
So ConnectivityService does not need to monitor permission change to
send onBlockedStatusChanged callback by permission change.
Test: CSBlockedReasonsTest
Bug: 339559837
Change-Id: I58d2a4eddc714e205f5b96219f95b637f2826c58
Currently, CS receives the blocked status change from
NetworkPolicyCallback.
This CL update CS to generate blocked status based on bpf map contents
on V+.
When the data saver and firewal chain status is updated, CS generate new
blocked reasons based on bpf map contents.
U- keeps listening to NetworkPolicyCallback.
Bug: 328732146
Test: testNetworkCallbackMaximum, CSBlockedReasonsTest
Change-Id: I6fa3f1a44eadc67d9cff17133905ef69203c044a
This CL moves mPerUidCounter.incrementCountOrThrow from
NetworkRequestInfo constructor to the caller of NetworkRequestInfo
constructor and stop incrementing counter for internal NetworkRequestInfo
(e.g. per-app default requests).
Also, this CL update CS not to modify perUidCounter when CS updates
apps' track default network request when the per-app default request is
updated since this does not change the number of request for each uids.
Test: testNetworkCallbackMaximum
Bug: 339106399
Change-Id: I82dbeb82b1c762c2c277d5794d54997b57009b6a
This CL is a no-op and does not change any behavior.
Upcoming CL updates CS to destroy socket of background apps.
As a preparation, this CL updates socket destroy code non specific to
frozen apps.
Bug: 300681644
Test: ConnectivityServiceTest
Change-Id: I027766db342bf9a05d4532ecf9a60e6854e9456d
As a preparation to update CS to destroy sockets for background apps,
renamed socket destroy methods to non specific to frozen apps
Bug: 300681644
Test: TH
Change-Id: I64c108aee1ee0d60df30ef055c8c9df8c6562d0f
delay_destroy_frozen_sockets_version is rolled out to public 100%.
So this CL enables this flag as default with kill switch.
This flag is no-op if destroy_frozen_sockets_version is disabled, and
destroy_frozen_sockets_version is also rolled out to public 100%.
So this CL does not change any behabior on the production devices.
Upcoming CLs will update CS to destroy sockets of apps that are under
FIREWALL_CHAIN_BACKGROUND restriction as well.
So this CL renames flag name from delay_destroy_frozen_sockets_version
to delay_destroy_sockets which is not specific to frozen apps.
Bug: 300681644
Test: TH
Change-Id: Icb9edff4e517fca57408d7d690fe9e172754c35e
NETWORKINFO_WITHOUT_INTERNET_BLOCKED compat flag only changed the
behavior of getActiveNetworkInfo that depends on
bpfNetMaps#isUidNetworkingBlocked.
But isUidNetworkingBlocked is used from other APIs(e.g. getActiveNetwork)
This CL update all APIs that depends on isUidNetworkingBlocked to follow
the compat flag to make behavior consistent between APIs.
aosp/3079290 will update onBlockedStatusChanged callback to follow this
compat flag.
Bug: 340773991
Bug: 339780435
Test: TH
Change-Id: If64ec800f21c2adc613884838202e2dece4a8d95
Before aosp/3001087, getNetworkActiveInfo did not return network info
with blocked state for apps without PERMISSION_INTERNET even if the
network is actually blocked.
aosp/3001087 updated getNetworkActiveInfo to return correct blocked
state on V+.
However, this broke some apps that use getNetworkActiveInfo in wrong way
and depends on the previous behavior.
So this CL introduces the compat flag to keep previous behavior for apps
targeting U or older releases.
Test: TH
Bug: 333340911
Change-Id: I0e0950f2148de0ffdb45495903a5a87e0d4c1c0b
Motomu Utsumi
authored and
Gerrit Code Review
commited 
Remi NGUYEN VAN
authored and
Handa Wang
commited 
Treehugger Robot
authored and
Maciej Żenczykowski
commited 
Patrick Rohr
commited 
KH Shi
commited 
Priyanka Advani
authored and