In some scenarios, Wi-Fi connectivity is disrupted after roam. If an application reacts to network errors by calling reportNetworkConnectivity(false), validation will immediately fail and the device will switch to cell data.
Add a way to ignore these validation failures for up to 10 seconds after Wi-Fi roams.
Bug: 216567577
Test: new unit tests
Change-Id: I58de486533bcc7c6e32b23536ae15bccb779e394
In S, the behaviour of createTunInterface and createTapInterface
changed so that they bring up the interface before returning it.
This makes it difficult to test code that brings interfaces up
itself, such as IpClient or EthernetManager, because the tests
cannot predict whether that code will see the interface up
or not. This leads to flaky tests and can even make it impossible
to reliably test some behaviour.
Add a method that allows the caller to specify whether to bring
up the interface or not.
Test: new codepath tested by other CL in topic
Test: existing codepaths already well-covered
Change-Id: I0f7698f4dad132f201db4203e65a78c6af564ab2
Lorenzo Colittiauthored and Xiao Macommited 2022-03-17 13:42:34 +00:00
* changes:
Fix the NPE thrown when starting Ethernet service in OS lower than T.
Remove the stub ethernet service from Connectivity module.
Update hidden API files for EthernetManager API move.
Provide a stub ethernet service to build in sc-mainline-prod.
Build ethernet framework source into framework-connectivity-tiramisu
Patrick Rohrauthored and Gerrit Code Reviewcommited 2022-03-16 16:03:30 +00:00
Use int array for included and excluded uids so that uses
same data type as in PreferentialNetworkServiceConfig
Bug: 217365439
Test: ran connectivity service unit tests
Change-Id: I9ac7e6498df2fd20b8397b2c110296e019c7389e
Applications may have an additional SDK sandbox process that should run
with the same network policy as the app itself. There is a 1:1 mapping
between appId and the SDK sandbox process that belongs to it; use that
mapping to set the same policy for SDK sandbox processes as for the app
that they belong to.
Bug: 215012578
Test: atest com.android.server.PermissionMonitorTest
Change-Id: Ibd2ada09c94d46e048f5731b90a721d8e85d3289
This is useful for link layers that disconnect but know they will
reconnect to a similar network soon, and do not want the device
to switch to another network until the reconnect happens. An
example is wifi switching to another network that is on a
different subnet without the device switching to cellular data.
This works by immediately destroying the network, so the link
layer can reuse the same interface name for the new network. It
would be possible to delay destroying the network until the new
network connects, but in practice this does not seem useful,
because the if the link layer reuses the interface, then the
interface will be undergoing reconfiguration, and will likely
not be usable for app traffic.
This CL also moves the call to onNetworkDestroyed into
destroyNativeNetwork. This is needed to ensure that the new
API calls onNetworkDestroyed even though most teardown
operations have not happened. This causes onNetworkDestroyed to
happen before the netId is marked free, but that shouldn't cause
any behavioural changes because netId allocation is an
implementation detail of ConnectivityService and is not
observable by apps or system components.
Bug: 216567577
Test: builds, boots
Test: atest FrameworksNetTests FrameworksNetIntegrationTests
Test: atest CtsNetTestCases:android.net.cts.ConnectivityManagerTest
Test: atest CtsNetTestCases:android.net.cts.NetworkAgentTest#testDestroyAndAwaitReplacement
Change-Id: I9f9e022fef66b31a29cce560413321075e992756
Lorenzo Colitticommited 2022-03-14 21:52:37 +09:00
Rate-limiting cannot work because the BPF program is in the
mainline version of netd.c, which is placed into net_shared
and thus cannot run pre-T.
Disable it entirely to ensure no impact on S.
Test: atest ConnectivityCoverageTests:com.android.server.ConnectivityServiceTest on AOSP
Test: atest ConnectivityCoverageTests:com.android.server.ConnectivityServiceTest on S
Change-Id: I47521a100f8287ecdece25e810db8f3cade46778
Lorenzo Colitticommited 2022-03-07 12:21:40 +00:00
Most of the methods in BpfNetMaps are only used on T+ devices,
where BpfNetMaps never calls into netd. Remove the code in these
methods that calls into netd, because that code can never run.
The code was only written in the first place because it was
necessary when TrafficController had not yet moved to mainline.
The list of methods is:
- addNaughtyApp
- removeNaughtyApp
- addNiceApp
- removeNiceApp
- setChildChain
- replaceUidChain
- setUidRule
Test: treehugger
Change-Id: Ie7d210be2f7983178f5aa550370b9476de66e988
Lorenzo Colittiauthored and markchiencommited 2022-03-07 12:56:18 +08:00
swapActiveStatsMap is temporary added for the NetworkStatsFactory to
call BpfNetMaps#swapActiveStatsMap in tethering mainline module. Now
NetworkStatsFactory already be mainlined, calling BpfNetMaps#swapActiveStatsMap
directly.
Bug: 218494448
Test: atest ConnectivityCoverageTests
atest FrameworksNetTests
Change-Id: I3358e4ac5fb7ed0964273afdbccd1b4128ca7645
The tc police filter attaches to the clsact qdisc, so the rate limit
cannot be enabled before the qdisc is added to the interface.
The clsact qdisc is added as part of INetd#networkAddInterface, which is
called from inside updateLinkProperties.
Test: atest FrameworksNetTests:ConnectivityServiceTest
Change-Id: I0713605ff3684f8271eb3f0e29ab7116561963f1
The API won't modify the passed NetworkCapabilities and
LinkProperties, but redactNetworkCapabilitiesForPackage and
redactLinkPropertiesForPackage sound like they will. To reduce
the confusion, rename the API with prefix "getRedacted".
Also modify the javadoc to describe more about what the API will
do if the given UID doesn't have location permission.
Bug: 220367512
Test: atest CtsNetTestCases
Change-Id: I964f1062da1ae96df9b369b911486da1379b8a19
LinkProperties.getRoutes() can now return throw routes as well so we
need to check the route type before consuming it if we only intend to
use unicast routes.
Test: none
Bug: 186082280
Change-Id: I2a35170f8002a16c49584c7f85cd02f0c34f35b0
Taras Antoshchukauthored and Muhammad Hasan Khancommited 2022-02-28 21:30:15 +00:00
This is being added as the lowest priority score factor, just
above the tie-breakers. It ensures that a network that has been
destroyed will lose to another identical network that has not
been destroyed, but will otherwise be scored identically.
The flag is a CS-managed flag that is stored in NetworkAgentInfo.
Currently it is always false, but it will be populated in
future CLs.
Bug: 216567577
Test: atest FrameworksNetTests
Change-Id: Ib1cd342ab7dfc4df45715da19b743d711fe8d605
Lorenzo Colitticommited 2022-02-22 16:39:44 +09:00
These don't break compilation because NetworkAgentInfo doesn't
expose any APIs and thus doesn't generate javadoc, but they
are flagged by the IDE.
Test: treehugger
Change-Id: I2b63c24b2afbc98950f53c38f80d27474aab0622
Lorenzo Colitticommited 2022-02-22 16:39:44 +09:00
This makes the code easier to maintain because we do not need to
manually add string representations, and because it will throw at
static initialization time if the clas contains duplicate
POLICY_xxx values. The memory overhead is likely negligible.
Bug: 216567577
Test: new coverage in FullScoreTest
Change-Id: Iab23d414c8e28ff7f26060ad44fa996f277d361f
Lorenzo Colitticommited 2022-02-19 19:45:43 +09:00
Currently, there are two EVENT_NETWORK_TESTED message types in
ConnectivityService. One is used by the ConnectivityService
handler to process validation results, and one is used by
ConnectivityDiagnosticsHandler to send connectivity reports.
The two messages have different contents so it is confusing that
they have the same integer and the same name. Rename the second
one to CMD_SEND_CONNECTIVITY_REPORT.
Test: atest ConnectivityServiceTest
Test: atest CtsNetTestCases:android.net.cts.ConnectivityDiagnosticsManagerTest
Change-Id: I77d63dad477315e1fcc7225a5ef03aff2bed8c35
Lorenzo Colitticommited 2022-02-19 02:24:02 +09:00
TestNetworkAgentWrapper does not set the interface name in its
LinkProperties causing logwtf to fail tests on -eng build.
Test: atest FrameworksNetTests:ConnectivityServiceTest on -eng build
Change-Id: Ieba0453ce897aa1052cb98f1de4c7bb099383c8d
Add some happy path logging that informs about active rate limits.
Test: TreeHugger
Bug: 218840346
Change-Id: Iddd50583ca2e90afe83a5c68611418fa794afb3f
All NetworkMonitor messages contain the netId of the source
NetworkMonitor. But the netId is in various places in the
message. It's most frequently in arg2, but sometimes it's boxed
into an Integer in obj, and sometimes it's in another object.
Always pass the netId into arg2. This allows us to write
common code at the beginning of the function that extracts the
netId and nai, and performs common actions on all messages.
Bug: 216567577
Test: atest FrameworksNetTests FrameworksNetIntegrationTests
Test: atest CtsNetTestCases:ConnectivityManageTest
Test: atest CtsNetTestCases:NetworkAgentTest
Change-Id: Idbbe3cddfc5475a2d56df387f840439dc4c9514c
Lorenzo Colitticommited 2022-02-18 00:28:01 +09:00
Some system components like VPN need to know how to redact
NetworkCapabilities & LinkProperties that they received from
the system but need to send to third-party applications with
less privilege than themselves. To make sure the redaction is
consistent, expose system API methods to do it that are wired
to the same redaction code used by ConnectivityService.
Bug: 191413541
Test: atest CtsNetTestCases, which includes new CTS for these
Change-Id: Ia3ae4755b5192884c147d6828f96cedac000a25b
lucaslinauthored and Chalard Jeancommited 2022-02-12 15:21:13 +09:00
Adds ingress rate limiting functionality to ConnectivityService. The tc
rate limit is installed before we tell netd about the interface, and
removed after the network is removed from netd. When the setting
changes, the old rate limit needs to be removed before a new one can be
added (unfortunately, we cannot use NLM_F_REPLACE when configuring the
tc-police filter).
Currently, this functionality is always enabled, but may or may not work
based on kernel support.
Bug: 157552970
Test: atest FrameworksNetTests:ConnectivityServiceTest
Change-Id: I4e64b2c40490f061e42b40a1b1b3a6618c3d1a87
When the network is a VPN, NetworkMonitor needs to know whether
the VPN requests validation, and that information is stored in
NetworkAgentConfig. Pass it.
Test: FrameworksNetTests
Change-Id: I3616f0796b69ce054d92213aafdef43ba7041596
Martijn Coenen
authored and
Gerrit Code Review
commited 
Lorenzo Colitti
authored and
he_won.hwang
commited 
Xiao Ma
commited 
Taras Antoshchuk
authored and
Chalard Jean
authored and
Sooraj Sasindran
commited 
Patrick Rohr
authored and
Lucas Lin
authored and
Treehugger Robot
authored and
Maciej Żenczykowski
authored and
Mark Chien
authored and
Hungming Chen
commited 
Muhammad Hasan Khan
commited 
Ken Chen
commited