This reverts commit ee96ba0e60.
Reason for revert: Droidmonitor triggered revert due to b/342557183. Will be verifying through ABTD before submission.
Change-Id: I7e185c3ac11da27c7bb9d95e4221f7dfc22cf48c
Priyanka Advaniauthored and Gerrit Code Reviewcommited 2024-05-24 18:11:45 +00:00
Currently, even if apps don't have INTERNET permission and can not use
network, network access is considered not blocked and
ConnectivityService send onBlockedStatusChanged callback with
blocked=false.
This CL introduced BLOCKED_REASON_NETWORK_RESTRICTED and consider
network access from apps targetting W+ on V+ releases is blocked if apps
don't have INTERNET permission.
Permission is set when the user is added or package is installed and
permission is removed when the user is removed or packages is
uninstalled.
So ConnectivityService does not need to monitor permission change to
send onBlockedStatusChanged callback by permission change.
Test: CSBlockedReasonsTest
Bug: 339559837
Change-Id: I58d2a4eddc714e205f5b96219f95b637f2826c58
FIREWALL_CHAIN_OEM_DENY_x chains were added by aosp/2114533 but
corresponding blocked reasons were not added.
Upcoming aosp/3027488 updates CS to generate blocked reasons based on
bpf map contents.
Without blocked reasons for oem deny chains, onBlockedStatusChanged
callback will have inconsistency from the actual network blocked status.
This CL adds BLOCKED_REASON_OEM_DENY for FIREWALL_CHAIN_OEM_DENY_x chains
Bug: 328732146
Test: TH
Change-Id: I3793aa0e231d32fea5eb202ed69e170f74d66b02
Follow up CLs will update CS to generate blocked reason from bpf map
instead of asking NPMS.
However, one issue is NPMS set PENALTY_BOX for
BLOCKED_METERED_REASON_USER_RESTRICTED and
BLOCKED_METERED_REASON_ADMIN_DISABLED without telling the reason.
So, CS can not know the reason of PENALTY_BOX.
This CL add new firewall chain and match to distinguish reasons.
NPMS must call setUidFirewallRule with
FIREWALL_CHAIN_METERED_DENY_USER or FIREWALL_CHAIN_METERED_DENY_ADMIN
based on the reason so that CS can know the reason of restriction.
Bug: 332628891
Test: atest com.android.cts.net.HostsideRestrictBackgroundNetworkTests
Change-Id: Ia4ad4bdb345abc22c782630e828edfad2452db36
Currently, the signature file elides overrides of a default method,
as they are not essential for the compilation of the stubs.
However, in some scenarios, the overrides of a default method may be
essential for the compilation of the reverse dependency of the stubs.
In the scenario seen below:
```
// API
interface ApiInterface {
public default void bar() {};
}
class ApiClass implements AnotherParentInterface{
public void bar() {}
}
// App depending on the API
interface AppInterface {
public void bar();
}
public class AppClass extends ApiClass implements AppInterface {
}
```
Removal of `ApiClass.bar()` will lead to not overriding an abstract method
`AppInterface.bar()` compilation error in `AppClass`.
Therefore, this change adds the overrides of a default method to the
signature files.
Test: checkapi
Bug: 299366704
Change-Id: Ie11dbeafc39efec06f605e306c92155e834a6685
A new firewall chain is needed to configure background network
restrictions for apps.
This change only adds the API stubs and traffic controller constants to
make the chain work. Policy changes using this chain will follow in
the framework code.
Test: atest CtsNetTestCases:ConnectivityManagerTest
Test: atest ConnectivityServiceTest
NO_IFTTT=The Lint rule along with the relevant code in Common.h is
being deleted in aosp/2819759
Bug: 304347838
Change-Id: I33e2db6671431f7c576fc931d9f96e684fc1e78a
Revert submission 2799494-revert-2745215-npmsbpf-OBOPDXREUI
Reason for revert: Need to 1. Merge API first. 2. Wait for prebuilt. 3. Merge the caller.
Reverted changes: /q/submissionid:2799494-revert-2745215-npmsbpf-OBOPDXREUI
Change-Id: Icd5f3d40595a0d2a221b016cec70568bf3597c16
Revert submission 2745215-npmsbpf
DroidMonitor: Potential culprit for Bug 307256512 - verifying through ABTD before revert submission. This is part of the standard investigation process, and does not mean your CL will be reverted.
Reason for revert: 307256512
Reverted changes: /q/submissionid:2745215-npmsbpf
Change-Id: I27119a7484453d1369bbdf71ad2479edec7d664f
Jordan Silvaauthored and Gerrit Code Reviewcommited 2023-10-23 13:23:01 +00:00
Currently, data saver switch is controlled in NPMS, which
calls into NetworkManagementService and netd when switching
status. In netd, BandwidthController manipulates the
bw_data_saver chain to control the overall behavior.
However, this code are all platform implementation, which
are not updatable. In order to migrate data saver switch
from iptables to bpf, this API is needed for Connectivity to
change the implementation to directly write bpf in later
patches.
Test: atest CtsHostsideNetworkTests:com.android.cts.net.HostsideRestrictBackgroundNetworkTests
Test: atest FrameworksServicesTests:NetworkManagementServiceTest
Bug: 297836825
Change-Id: I71fa41ca739fef8e191fba91b02758ad5f732d5c
This change adds overriding methods that are essential to compile the
stubs generated from the signature files.
More information and the background for this change is available at
go/add-overriding-one-pager.
Test: m checkapi
Bug: 299366704
Change-Id: Idba307148fd9afa87bfb7e0c89e00d9bd97ec204
Currently, metalava will discard concrete overrides of abstract methods
from the API signature files which causes problems when attempting to
generate stubs from those files and also discards information that may
be important in API reviews. This change is the first step in the
process of changing that behavior.
This change hard codes the current behavior for discarding the concrete
overrides (`add-additional-overrides=no`) into those signature files
that will (or are likely) to be affected by the change in behavior.
That allows the default behavior to be changed for all the other files
without affecting these.
Follow up changes will remove the hard coding from the signature files
and will update the contents which will include the concrete overrides
of the abstract methods.
More information and the background for this change is available at
go/add-overriding-one-pager.
Test: m checkapi
Bug: 299366704
Change-Id: I52c5bbe2e3bbd36019fe44fcb0b2d19876a5a869
registerSystemDefaultNetworkCallback is required by WifiTrackerLib to
detect the system default network for UI purposes. Currently this API is
allowed for holders of the NETWORK_SETTINGS permission, but not
NETWORK_SETUP_WIZARD. Since SUW also uses WifiTrackerLib, we should
allow this API for NETWORK_SETUP_WIZARD as well.
Bug: 230643853
Test: atest ConnectivityServiceTest
Change-Id: Ic01a186f91ed67b4603b6b8964921be7473a483a
Create a new API - setVpnNetworkPreference() for the caller to
set VPN as the preference network.
VPN will be disconnected when its underlying network is gone.
To prevent packets going through an underlying network when the
underlying network is back but VPN is not connected yet, set VPN
as the only preferred network for specific apps.
Bug: 231749077
Test: 1. atest FrameworksNetTests
2. Create a test app to register default network and check if
the VPN is the only default network for the test app.
Change-Id: Iabcd38e2fec2aefedbf78d20e338f222d83a9e7f
Some callers (e.g. iwlan) need to learn about system default
network but they cannot have NETWORK_SETTINGS permission.
To allow them to use this API but prevent from misuse by
unprivileged apps, enforce USE_RESTRICTED_NETWORKS for this API.
Test: atest com.android.server.ConnectivityServiceTest#testRegisterPrivilegedDefaultCallbacksRequireNetworkSettings android.net.cts.ConnectivityManagerTest#testRegisterNetworkCallback
Fix: 242456635
Change-Id: I80ab27445af874328c9c0f4814a8fbf035ae5df4
* changes:
TestNetworkInterface: add support for MacAddress and MTU
TestNetworkService: add support for creating iface without carrier
TestNetworkService: Add support for toggling carrier on tun/tap
TestNetworkService: Fix TestNetworkInterface parcel flags
Patrick Rohrauthored and Gerrit Code Reviewcommited 2022-06-15 20:53:30 +00:00
Both MacAddress and MTU size are often needed in tests and very painful
to get a hold of without system server permissions.
Test: TH
Change-Id: Ie1a91959916ea39277e76aa1b61f38d59a5d2a90
Use int array for included and excluded uids so that uses
same data type as in PreferentialNetworkServiceConfig
Bug: 217365439
Test: ran connectivity service unit tests
Change-Id: I9ac7e6498df2fd20b8397b2c110296e019c7389e
Split the updateXXX methods into an addXXX and removeXXX instead of using
a boolean parameter to indicate whether the uid should be added or removed
Bug: 218494748
Test: atest FrameworksNetTests
Change-Id: I868cf35c8f51b25d8719e618c6c48a5cd642da7f
swapActiveStatsMap is temporary added for the NetworkStatsFactory to
call BpfNetMaps#swapActiveStatsMap in tethering mainline module. Now
NetworkStatsFactory already be mainlined, calling BpfNetMaps#swapActiveStatsMap
directly.
Bug: 218494448
Test: atest ConnectivityCoverageTests
atest FrameworksNetTests
Change-Id: I3358e4ac5fb7ed0964273afdbccd1b4128ca7645
The API won't modify the passed NetworkCapabilities and
LinkProperties, but redactNetworkCapabilitiesForPackage and
redactLinkPropertiesForPackage sound like they will. To reduce
the confusion, rename the API with prefix "getRedacted".
Also modify the javadoc to describe more about what the API will
do if the given UID doesn't have location permission.
Bug: 220367512
Test: atest CtsNetTestCases
Change-Id: I964f1062da1ae96df9b369b911486da1379b8a19
Update API name from getVpnRequiresValidation to
isVpnValidationRequired according to API review feedback.
Test: atest FrameworksNetTests
Bug: 220129160
Change-Id: I1025f4c35b320c14e872eaffd7ed82658a5f3d0c
Some system components like VPN need to know how to redact
NetworkCapabilities & LinkProperties that they received from
the system but need to send to third-party applications with
less privilege than themselves. To make sure the redaction is
consistent, expose system API methods to do it that are wired
to the same redaction code used by ConnectivityService.
Bug: 191413541
Test: atest CtsNetTestCases, which includes new CTS for these
Change-Id: Ia3ae4755b5192884c147d6828f96cedac000a25b
lucaslinauthored and Chalard Jeancommited 2022-02-12 15:21:13 +09:00
The INGRESS_RATE_LIMIT_BYTES_PER_SECOND setting controls the rate limit
for internet networks. If set to -1, no rate limit applies. There is
one global rate limit that will be applied to all networks with
NET_CAPABILITY_INTERNET.
Test: atest ConnectivitySettingsManagerTest
Bug: 157552970
Change-Id: Ia82aa867686d484ce46734f76d4a48bf864eff84
Address API review feedback to change naming of
setExcludedLocalRoutesVpn and getter.
Bug: 217742354
Test: atest FrameworksNetTests
Change-Id: I57bbf55c7aba1c86ec8687d2431a50b37e63c6d0
This adds a new API that lets VPN apps using VpnManager request
that the platform run its basic validation check on the resulting
network.
Bug: 184750836
Test: atest FrameworksNetTests
Change-Id: I00092eee857d3e33529b19461cfd5dd060a0fe20
Chiachang Wangauthored and Chalard Jeancommited 2022-02-08 22:47:26 +09:00
CTS already have basic tests for this since they run the common tests,
which were using these hidden methods already.
Test: CtsNetTestCases
Change-Id: Id5e5b911f5c63bdd3b05e5ac1d3dd89c1c525ab7
Motomu Utsumi
authored and
Gerrit Code Review
commited 
Priyanka Advani
authored and
Jihoon Kang
authored and
Suprabh Shukla
commited 
Junyu Lai
commited 
Jordan Silva
authored and
Paul Duffin
commited 
Quang Luong
commited 
lucaslin
commited 
Chiachang Wang
authored and
Patrick Rohr
authored and
markchien
commited 
Chalard Jean
authored and
Sooraj Sasindran
commited 
Robert Horvath
commited