Add a DeviceConfig flag that will be used to control whether callbacks
should be sent selectively based on whether the receiving method has
been overridden (will be implemented in a future change).
This adds utilities to allow ConnectivityManager to check whether a
ConnectivityService flag is enabled, as that feature will work across
ConnectivityManager and ConnectivityService. ConnectivityManager runs in
app process and does not necessarily have permissions to use
DeviceConfig. Also if it checked DeviceConfig separately from
ConnectivityService, values may be out-of-sync.
Test: atest, and see change using this
Change-Id: I204fa719cc627e84edc5c1e043d947f5ef3f8dee
Add dump raw BPF map command to connectivity service. The result will
be encoded as base64 strings. This is a preparation for Clatd's tests.
Usage:
dumpsys connectivity {clatEgress4RawBpfMap|clatIngress6RawBpfMap}
Bug: 285124667
Test: test with MtsEthernetTetheringTest#testTetherClatBpfOffloadUdp
which will be uploaded in a separated CL
Change-Id: I02c8efadb1c4b861d9bf6168667816b13412dc75
This reverts commit ee96ba0e60.
Reason for revert: Droidmonitor triggered revert due to b/342557183. Will be verifying through ABTD before submission.
Change-Id: I7e185c3ac11da27c7bb9d95e4221f7dfc22cf48c
Priyanka Advaniauthored and Gerrit Code Reviewcommited 2024-05-24 18:11:45 +00:00
Currently, CS destroys sockets of apps under firewall chain restriction
only when the firewall chains get enabled by setFirewallChainEnabled.
This CL updates CS to also destroy sockets of apps when the
setUidFirewallRule and replaceFirewallChain update uid rule and apps
lose network access due to FIREWALL_CHAIN_BACKGROUND.
This socket destruction is delayed until the cell modem is up in the
same way that CS destroys sockets of frozen apps.
Test: CSSocketDestroyTest
Bug: 300681644
Change-Id: I6a6fb5d6d7b71c0949a4195b84d30efef95bff37
Currently, even if apps don't have INTERNET permission and can not use
network, network access is considered not blocked and
ConnectivityService send onBlockedStatusChanged callback with
blocked=false.
This CL introduced BLOCKED_REASON_NETWORK_RESTRICTED and consider
network access from apps targetting W+ on V+ releases is blocked if apps
don't have INTERNET permission.
Permission is set when the user is added or package is installed and
permission is removed when the user is removed or packages is
uninstalled.
So ConnectivityService does not need to monitor permission change to
send onBlockedStatusChanged callback by permission change.
Test: CSBlockedReasonsTest
Bug: 339559837
Change-Id: I58d2a4eddc714e205f5b96219f95b637f2826c58
Currently, CS receives the blocked status change from
NetworkPolicyCallback.
This CL update CS to generate blocked status based on bpf map contents
on V+.
When the data saver and firewal chain status is updated, CS generate new
blocked reasons based on bpf map contents.
U- keeps listening to NetworkPolicyCallback.
Bug: 328732146
Test: testNetworkCallbackMaximum, CSBlockedReasonsTest
Change-Id: I6fa3f1a44eadc67d9cff17133905ef69203c044a
This CL moves mPerUidCounter.incrementCountOrThrow from
NetworkRequestInfo constructor to the caller of NetworkRequestInfo
constructor and stop incrementing counter for internal NetworkRequestInfo
(e.g. per-app default requests).
Also, this CL update CS not to modify perUidCounter when CS updates
apps' track default network request when the per-app default request is
updated since this does not change the number of request for each uids.
Test: testNetworkCallbackMaximum
Bug: 339106399
Change-Id: I82dbeb82b1c762c2c277d5794d54997b57009b6a
This CL is a no-op and does not change any behavior.
Upcoming CL updates CS to destroy socket of background apps.
As a preparation, this CL updates socket destroy code non specific to
frozen apps.
Bug: 300681644
Test: ConnectivityServiceTest
Change-Id: I027766db342bf9a05d4532ecf9a60e6854e9456d
As a preparation to update CS to destroy sockets for background apps,
renamed socket destroy methods to non specific to frozen apps
Bug: 300681644
Test: TH
Change-Id: I64c108aee1ee0d60df30ef055c8c9df8c6562d0f
delay_destroy_frozen_sockets_version is rolled out to public 100%.
So this CL enables this flag as default with kill switch.
This flag is no-op if destroy_frozen_sockets_version is disabled, and
destroy_frozen_sockets_version is also rolled out to public 100%.
So this CL does not change any behabior on the production devices.
Upcoming CLs will update CS to destroy sockets of apps that are under
FIREWALL_CHAIN_BACKGROUND restriction as well.
So this CL renames flag name from delay_destroy_frozen_sockets_version
to delay_destroy_sockets which is not specific to frozen apps.
Bug: 300681644
Test: TH
Change-Id: Icb9edff4e517fca57408d7d690fe9e172754c35e
NETWORKINFO_WITHOUT_INTERNET_BLOCKED compat flag only changed the
behavior of getActiveNetworkInfo that depends on
bpfNetMaps#isUidNetworkingBlocked.
But isUidNetworkingBlocked is used from other APIs(e.g. getActiveNetwork)
This CL update all APIs that depends on isUidNetworkingBlocked to follow
the compat flag to make behavior consistent between APIs.
aosp/3079290 will update onBlockedStatusChanged callback to follow this
compat flag.
Bug: 340773991
Bug: 339780435
Test: TH
Change-Id: If64ec800f21c2adc613884838202e2dece4a8d95
Before aosp/3001087, getNetworkActiveInfo did not return network info
with blocked state for apps without PERMISSION_INTERNET even if the
network is actually blocked.
aosp/3001087 updated getNetworkActiveInfo to return correct blocked
state on V+.
However, this broke some apps that use getNetworkActiveInfo in wrong way
and depends on the previous behavior.
So this CL introduces the compat flag to keep previous behavior for apps
targeting U or older releases.
Test: TH
Bug: 333340911
Change-Id: I0e0950f2148de0ffdb45495903a5a87e0d4c1c0b
Clarify that only the highest priority preference is applied if the uid
is target of multiple preferences.
Test: TH
Change-Id: I55b6a37995bcfe876ed609cf653077df2b5e7615
With this annotation, errorprone build will fail if callers don't check
sdk version before calling any methods in BpfNetMapsUtils.
Bug: 328732146
Test: TH
Change-Id: Ifa52dc1d2766f8d46dfdc4f6ca9dbb963406c084
Follow up CLs will update CS to generate blocked reason from bpf map
instead of asking NPMS.
However, one issue is NPMS set PENALTY_BOX for
BLOCKED_METERED_REASON_USER_RESTRICTED and
BLOCKED_METERED_REASON_ADMIN_DISABLED without telling the reason.
So, CS can not know the reason of PENALTY_BOX.
This CL add new firewall chain and match to distinguish reasons.
NPMS must call setUidFirewallRule with
FIREWALL_CHAIN_METERED_DENY_USER or FIREWALL_CHAIN_METERED_DENY_ADMIN
based on the reason so that CS can know the reason of restriction.
Bug: 332628891
Test: atest com.android.cts.net.HostsideRestrictBackgroundNetworkTests
Change-Id: Ia4ad4bdb345abc22c782630e828edfad2452db36
The BACKGROUND firewall chain has been recently added. We want to
be able to turn it off in case of contingencies with a device-config
flag flip.
The flag is assumed to be boot-stable and its value is read at boot.
When the flag is off, we ignore any operation on this firewall chain.
Additionally, this chain is always considered disabled on versions
upto UPSIDE_DOWN_CAKE.
Note: All firewall chains are in disabled state at boot by default.
Test: atest FrameworksNetTests
Test: Manually, using adb shell device_config commands.
Bug: 331484830
Change-Id: I9ccc483e02e27a584da6714931466a9f2ec95ca9
NetworkPolicyManager#isUidNetworkingBlocked does not know about some
firewall chains status(e.g. FIREWALL_CHAIN_OEM_DENY_1)
So BpfNetMaps#isUidNetworkingBlocked is more correct but there could be
some behavior difference.
To avoid breaking devices and have longer verification time, this CL
updates to use BpfNetMaps#isUidNetworkingBlocked only on V+ devices.
Bug: 328732146
Test: TH
Change-Id: I60f84a5fff90386103692841dead465652249446
When request_restricted_wifi is enabled CarrierPrivilegeAuthenticator
calls CarrierPrivilegesLost callback passed from ConnectivityService.
But CarrierPrivilegeAuthenticator was using its own handler thread to
receive broadcast and callbacks so CarrierPrivilegesLost callback needed
to post a message to the CS handler.
This CL updates CarrierPrivilegeAuthenticator to use CS handler if
request_restricted_wifi is enabled, and remove the message post in
ConnectivityService.
Test: TH
Change-Id: Ib41304a30e3dd366b0f6f1d7df81145f0e05ece1
When there are addresses that are used by a single VPN interface,
ConnectivityService sets ingress discard rules to drop packets to this
address from the non-Vpn interfaces
Test: FrameworksNetTests
Bug: 295800201
Change-Id: I089d01a38eff3f37a851627fa9e4acefb8d9ad5e
This enforceNetworkStackPermission() should be adopted to check
the required permission but this may be break OEM captive portal
apps. Simply ignore the request if the caller does not have
permission.
This commit also fixes the format issues that is auto-fixed by
ktlint.
Fix: 329385091
Test: ates FrameworksNetTests
Change-Id: Ia973a1078eda3134fc8ff261d3954cd050767880
This CL updates CSTest to use mocked appOpsManager to bypass
checkPackage enforcement so that test can file network request as
SYSTEM_UID
Bug: 314627716
Test: atest ConnectivitySampleMetricsTest
Change-Id: I0a5f3b1bf2c343644e6f5e2a4ec1b0460e2645c4
This reverts commit 41557553f6.
(this is no longer needed, as it rolled out with January module,
while the May module this is targetting already includes an rc,
thus eliminating the need for this warning)
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I90c8abad2f70d65d142f55c18ad2f34018da6615
Maciej Żenczykowskicommited 2024-03-05 19:49:20 -08:00
This CL allows everyone to see the subscriptionIds and the network owner
to see the allowedUids from the NetworkCapabilities.
Bug: 324357121
Test: atest ConnectivityManagerTest
atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.ConnectivityServiceTest
Change-Id: I91e360827d2a9a64625f1d6ae0f808aa327c7d22
Apps that target an SDK before V will not see networks with
NET_CAPABILITY_LOCAL_NETWORK unless they explicitly set this capability
in their network requests.
Bug: 319212206
Test: CSLocalAgentTests
Change-Id: I414b03dfea9a8aac83304c6be501f03d637739b4
The hasNetworkStackPermission() method does not enfore the
permission check. It should be replaced with
enforceNetworkStackPermission().
Bug: 325984919
Test: atest FrameworksNetTests
Change-Id: I9ad0b47190dbc9afd2ee6f5dfc21a4935036733a
Always store the corresponding SubscriptionId together with the Carrier
uid so that when the carrier loses the Privilege, both the uid and
SubscriptionID will be used in the onCarrierPrivilegesLost callback
Bug: 324357121
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.connectivity.CarrierPrivilegeAuthenticatorTest
atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.ConnectivityServiceTest
Change-Id: I28e51c583261a67d4441c6f825ade6781b862ee4
On V, this feature is enabled on all devices.
On U, this feature is enabled if the flag is enabled.
Test: TH
Change-Id: I025b9a8098a0896be51cf06c5b8262243ba439b7
These can be used by manual or automated tests.
Test: Manual by using the `cmd connectivity` shell commands
Test: atest CtsNetTestCases:ConnectivityManagerTest
Test: atest netd_integration_test
Bug: 322562125
Change-Id: I1de55e430141f566e510b37554a9416c4444213b
- Implement handleSetSatelliteNetworkPreference() at ConnectivityService
to create multi layer request with preference order
PREFERENCE_ORDER_SATELLITE_FALLBACK.
- unit test coverage
Bug: 320514105
Test: m and atest FrameworksNetTests
Change-Id: I3f71104f8c3c998599eaab71ae4076985f4bed77
This CL allows the Carrier Config app to request restricted WiFi nework
by setting the correspoding subscription ID in the network request.
Bug: 315835605
Test: atest android.net.cts.NetworkRequestTest
atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.connectivity.CarrierPrivilegeAuthenticatorTest
atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.ConnectivityServiceTest
Change-Id: I237e692d092ff5f969ce4b7962f6d58099a6f3a9
The check*Permission methods are a bit error-prone because people
can forget to check the return value and expect that they behave
like the enforce* methods. This was pointed out before in some bugs.
This change adds @CheckResult annotation to enforce linter warning
and rename methods accordingly.
Test: TH
Fix: 279691948
Change-Id: Ibb0df6540fe0ed40289bb190b790130daaa2f763
Remi NGUYEN VAN
commited 
Gerrit Code Review
commited 
Maciej Żenczykowski
authored and
KH Shi
commited 
Treehugger Robot
authored and
Motomu Utsumi
authored and
Priyanka Advani
authored and
Kholoud Mohamed
authored and
Android Build Cherrypicker Worker
commited 
Patrick Rohr
authored and
Suprabh Shukla
authored and
Ying Xu
authored and
Chiachang Wang
authored and
Nagendra Prasad Nagarle Basavaraju
commited 
Junyu Lai
commited