Extend QosFilter address match function for IP address range based on
prefix length.
Bug: 406146808
Bug: 399960748
Flag: com.android.net.flags.qos_filter_ip_range_matching
Test: atest CtsNetTestCases
Test: atest ConnectivityCoverageTests
Change-Id: I78d995fda111d258da9a912c7afa5e472e43437f
Configures an IntRange [0, 255] for the L2CAP BLE PSM. Note that L2CAP
over Bluetooth Classic uses PSM values that exceed this range though is
explicitly not supported.
This CL also changes the value for PSM_ANY from -1 to 0 to make the
IntRange continuous as 0 is not a valid PSM (in both BLE and Classic).
Bug: 388438641
Test: TH
Change-Id: I15a69cfb80545c4f3723d089afd3cf026eec0696
Adds the API surface of the L2capSpecifier. Matching will be implemented
in a follow up change.
Test is *very* basic and will be expanded in follow up (once API is
approved).
Test: atest L2capNetworkSpecifierTest
API-Coverage-Bug: 372936361
Bug: 372936361
Change-Id: I6d36b77c3ae05fb8d251da9e197e82af187ead0c
reserveNetwork allows a requestor to initiate the creation of a network
that requires the system to preallocate resources which can then be
advertised by the requestor on or off device in order to help create the
network.
For example, this API will be used to reserve a IP over L2cap server
network, which requires the system to first create a
BluetoothServerSocket and reserve a PSM (i.e. port). This information is
passed back to the requestor via onReserved() callback and subsequently
advertised via a BLE advertisement. The network is established as soon
as the client connects to the advertised PSM, which will trigger a call
to onAvailable(), just like a regular NetworkRequest.
onReserved() callbacks are exclusive to the reserveNetwork API and are
sent when an NetworkOffer is registered that matches the reservation ID
of an existing request. A reserved offer always follows the reservation
request as it is created in direct response. onReserved() can only be
called once. If for some reason the reservation gets cancelled by the
system (i.e. the NetworkOffer is retracted) or cannot be fulfilled,
onUnavailable() is called. It is up to the app to file a new
NetworkRequest when this happens.
An onReserved() callback is not queued, because
a) it cannot be called more than once for the same reservation,
b) it must always be the first callback, and
c) it only gets cancelled by onUnavailable().
This change does not handle NetworkOffer migrations, such as updating
the score, properly. This must be addressed before the feature can ship
as the yieldToBadWifi logic can update the score on all NetworkOffers.
API-Coverage-Bug: 372936361
Test: Very basic CSNetworkReservationTest; more to follow.
Change-Id: I9b349d469830bf28e006cf403c605574371db267
onReserved() is called in response to a successful Network reservation
with the NetworkCapabilities of the reserved network. onReserved is
called at most once. If the reservation is released, onUnavailable is
called.
Test: TH
API-Coverage-Bug: 372936361
Change-Id: Idcef572ab9d07981799efc349206aadb620e0e69
This is supposed to be used only from the Zygote during the
initialization phase to preload HttpEngine. Currently, the
implementation only preloads a single class which is used to initialize
the backend for HttpEngine.
Bug: 380349437
Change-Id: If3ebcb37e51104a69473491e9f230d1b043c7bd0
On V+, this capability is set by default.
Constrained satellite networks never become the system default network.
Test: CSSatelliteNetworkTest
Bug: 343823469
Change-Id: I020ba48e74f1f180e1807cbe1c066209bedb0454
This reverts commit ee96ba0e60.
Reason for revert: Droidmonitor triggered revert due to b/342557183. Will be verifying through ABTD before submission.
Change-Id: I7e185c3ac11da27c7bb9d95e4221f7dfc22cf48c
Priyanka Advaniauthored and Gerrit Code Reviewcommited 2024-05-24 18:11:45 +00:00
Currently, even if apps don't have INTERNET permission and can not use
network, network access is considered not blocked and
ConnectivityService send onBlockedStatusChanged callback with
blocked=false.
This CL introduced BLOCKED_REASON_NETWORK_RESTRICTED and consider
network access from apps targetting W+ on V+ releases is blocked if apps
don't have INTERNET permission.
Permission is set when the user is added or package is installed and
permission is removed when the user is removed or packages is
uninstalled.
So ConnectivityService does not need to monitor permission change to
send onBlockedStatusChanged callback by permission change.
Test: CSBlockedReasonsTest
Bug: 339559837
Change-Id: I58d2a4eddc714e205f5b96219f95b637f2826c58
FIREWALL_CHAIN_OEM_DENY_x chains were added by aosp/2114533 but
corresponding blocked reasons were not added.
Upcoming aosp/3027488 updates CS to generate blocked reasons based on
bpf map contents.
Without blocked reasons for oem deny chains, onBlockedStatusChanged
callback will have inconsistency from the actual network blocked status.
This CL adds BLOCKED_REASON_OEM_DENY for FIREWALL_CHAIN_OEM_DENY_x chains
Bug: 328732146
Test: TH
Change-Id: I3793aa0e231d32fea5eb202ed69e170f74d66b02
Follow up CLs will update CS to generate blocked reason from bpf map
instead of asking NPMS.
However, one issue is NPMS set PENALTY_BOX for
BLOCKED_METERED_REASON_USER_RESTRICTED and
BLOCKED_METERED_REASON_ADMIN_DISABLED without telling the reason.
So, CS can not know the reason of PENALTY_BOX.
This CL add new firewall chain and match to distinguish reasons.
NPMS must call setUidFirewallRule with
FIREWALL_CHAIN_METERED_DENY_USER or FIREWALL_CHAIN_METERED_DENY_ADMIN
based on the reason so that CS can know the reason of restriction.
Bug: 332628891
Test: atest com.android.cts.net.HostsideRestrictBackgroundNetworkTests
Change-Id: Ia4ad4bdb345abc22c782630e828edfad2452db36
This commit also updates to use V14 dnsresolver APIs which was V13.
Bug: 320514105
Test: m & atest FrameworksNetTests
Change-Id: I6e92f4d99e0eba3b5d1d5e45bf11e5e945ea43f1
This CL allows the Carrier Config app to request restricted WiFi nework
by setting the correspoding subscription ID in the network request.
Bug: 315835605
Test: atest android.net.cts.NetworkRequestTest
atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.connectivity.CarrierPrivilegeAuthenticatorTest
atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.ConnectivityServiceTest
Change-Id: I237e692d092ff5f969ce4b7962f6d58099a6f3a9
Apps that target an SDK before {@link Build.VERSION_CODES.VANILLA_ICE_CREAM}
will not see networks with this capability unless they explicitly set the
NET_CAPABILITY_LOCAL_NETWORK in their NetworkRequests.
In this way, `NET_CAPABILITY_LOCAL_NETWORK` should be public.
Bug: 313000440
Test: None
Change-Id: I44d9cf3ecf5da471a627696f3d2680f35d4b122d
Handa Wangauthored and Motomu Utsumicommited 2024-02-07 17:23:42 +09:00
Currently, the signature file elides overrides of a default method,
as they are not essential for the compilation of the stubs.
However, in some scenarios, the overrides of a default method may be
essential for the compilation of the reverse dependency of the stubs.
In the scenario seen below:
```
// API
interface ApiInterface {
public default void bar() {};
}
class ApiClass implements AnotherParentInterface{
public void bar() {}
}
// App depending on the API
interface AppInterface {
public void bar();
}
public class AppClass extends ApiClass implements AppInterface {
}
```
Removal of `ApiClass.bar()` will lead to not overriding an abstract method
`AppInterface.bar()` compilation error in `AppClass`.
Therefore, this change adds the overrides of a default method to the
signature files.
Test: checkapi
Bug: 299366704
Change-Id: Ie11dbeafc39efec06f605e306c92155e834a6685
A new firewall chain is needed to configure background network
restrictions for apps.
This change only adds the API stubs and traffic controller constants to
make the chain work. Policy changes using this chain will follow in
the framework code.
Test: atest CtsNetTestCases:ConnectivityManagerTest
Test: atest ConnectivityServiceTest
NO_IFTTT=The Lint rule along with the relevant code in Common.h is
being deleted in aosp/2819759
Bug: 304347838
Change-Id: I33e2db6671431f7c576fc931d9f96e684fc1e78a
java_sdk_library has previously internally disabled a few legitimate
issues. As this is being un-done for modules, add baselines for the
pre-existing issues.
Bug: 306806877
Test: m checkapi
Merged-In: Ie764d33196675e1482f30ecfd3d6d22b7fa25c27
Change-Id: Ie764d33196675e1482f30ecfd3d6d22b7fa25c27
Revert submission 2799494-revert-2745215-npmsbpf-OBOPDXREUI
Reason for revert: Need to 1. Merge API first. 2. Wait for prebuilt. 3. Merge the caller.
Reverted changes: /q/submissionid:2799494-revert-2745215-npmsbpf-OBOPDXREUI
Change-Id: Icd5f3d40595a0d2a221b016cec70568bf3597c16
Revert submission 2745215-npmsbpf
DroidMonitor: Potential culprit for Bug 307256512 - verifying through ABTD before revert submission. This is part of the standard investigation process, and does not mean your CL will be reverted.
Reason for revert: 307256512
Reverted changes: /q/submissionid:2745215-npmsbpf
Change-Id: I27119a7484453d1369bbdf71ad2479edec7d664f
Jordan Silvaauthored and Gerrit Code Reviewcommited 2023-10-23 13:23:01 +00:00
Currently, data saver switch is controlled in NPMS, which
calls into NetworkManagementService and netd when switching
status. In netd, BandwidthController manipulates the
bw_data_saver chain to control the overall behavior.
However, this code are all platform implementation, which
are not updatable. In order to migrate data saver switch
from iptables to bpf, this API is needed for Connectivity to
change the implementation to directly write bpf in later
patches.
Test: atest CtsHostsideNetworkTests:com.android.cts.net.HostsideRestrictBackgroundNetworkTests
Test: atest FrameworksServicesTests:NetworkManagementServiceTest
Bug: 297836825
Change-Id: I71fa41ca739fef8e191fba91b02758ad5f732d5c
This change adds overriding methods that are essential to compile the
stubs generated from the signature files.
More information and the background for this change is available at
go/add-overriding-one-pager.
Test: m checkapi
Bug: 299366704
Change-Id: Idba307148fd9afa87bfb7e0c89e00d9bd97ec204
Currently, metalava will discard concrete overrides of abstract methods
from the API signature files which causes problems when attempting to
generate stubs from those files and also discards information that may
be important in API reviews. This change is the first step in the
process of changing that behavior.
This change hard codes the current behavior for discarding the concrete
overrides (`add-additional-overrides=no`) into those signature files
that will (or are likely) to be affected by the change in behavior.
That allows the default behavior to be changed for all the other files
without affecting these.
Follow up changes will remove the hard coding from the signature files
and will update the contents which will include the concrete overrides
of the abstract methods.
More information and the background for this change is available at
go/add-overriding-one-pager.
Test: m checkapi
Bug: 299366704
Change-Id: I52c5bbe2e3bbd36019fe44fcb0b2d19876a5a869
aosp/2384137 added cronet to framework-tethering.
But framework-connectivity is a better place to put cronet since
cronet does not work on R devices (b/270049141) and
framework-tethering is R+, framework-connectivity is S+.
Followup CLs will move some modules (e.g. CronetJavaPrejarjarDefaults)
that use the branch dependent soong variables to framework/Android.bp
Test: TH
Bug: 278070640
Change-Id: I6bc10116759fb9e083c02147908e53022dab740a
As the review feedback, this commits address below concern.
1. The TCP keepalive code doesn't use the network parameter
at all. This parameter doesn't seem meaningful for TCP
keepalives. Starting a TCP keepalive with a non-null underpinned
network should throw IllegalArgumentException.
2. The feedback mention that the start version which takes a
@NonNull network should throw NPE if the network is null. But
Starting a NATT keepalive does not always require a underpinned
network. A new IkeSession started from Vpn will also not assign
the underpinned network at the initial stage which means
underpinned will be null until setNetwork() is called. Thus,
the underpinned network should be @Nullable instead.
Fix: 271797087
Test: atest FrameworksNetTests
Change-Id: Ieb57a7b15a06b2ccd94358b65cc00768c4f62e7d
Take a Network parameter to have an one-to-one mapping between
keepalive and its underpinned network on the automatic keepalive.
Existing design could not really tell which network should the
automatic keepalive check for the TCP socket status if there are
multiple automatic keepalives enabled, e.g. Bothe IWLAN and VPN
on WiFi enable the automatic keepalive. The keepalive for IWLAN
should check if there are any TCP sockets on the IWLAN network
instead of VPN network.
Bug: 259000745
Test: atest FrameworksNetTests
Test: Cts in the follow up commit
Change-Id: I7353f4ef43e8fdad02c4d4a0bb5f6efa7d94c1b4
registerSystemDefaultNetworkCallback is required by WifiTrackerLib to
detect the system default network for UI purposes. Currently this API is
allowed for holders of the NETWORK_SETTINGS permission, but not
NETWORK_SETUP_WIZARD. Since SUW also uses WifiTrackerLib, we should
allow this API for NETWORK_SETUP_WIZARD as well.
Bug: 230643853
Test: atest ConnectivityServiceTest
Change-Id: Ic01a186f91ed67b4603b6b8964921be7473a483a
Add SocketKeepalive.start with parameter to enable dynamic
keepalive mode based on the existence of TCP connections.
This supports IPSec mode to notify KeepaliveTracker to disable
keepalive when keepalive is unnecessary to improve battery life.
Keepalive is controlled by periodically TCP socket status check
for both enable and disable. This is a transition commit and
is expected to be updated based on the socket creation or
destroy.
Bug: 259000745
Test: m ; atest FrameworksNetTests
Change-Id: Ie4d598d69a73c4931c7d0b6dfde0e459e5dca6b4
chiachangwangauthored and Chalard Jeancommited 2023-01-20 13:51:20 +09:00
This commit also updates to use V11 dnsresolver APIs which was V9.
Bug: 262683651
Test: unit tests
Change-Id: Ifbd71157012dc66ec0f377beef9fa59d1c8620b8
Create a new API - setVpnNetworkPreference() for the caller to
set VPN as the preference network.
VPN will be disconnected when its underlying network is gone.
To prevent packets going through an underlying network when the
underlying network is back but VPN is not connected yet, set VPN
as the only preferred network for specific apps.
Bug: 231749077
Test: 1. atest FrameworksNetTests
2. Create a test app to register default network and check if
the VPN is the only default network for the test app.
Change-Id: Iabcd38e2fec2aefedbf78d20e338f222d83a9e7f
Add VpnTransportInfo.areLongLivedTcpConnectionsExpensive() in API
surface to allow privileged apps to know whether the long-lived
TCP connections should be expensive in the VPN network.
This is expected to be used combined with getBypassable()
because connections should always go through a VPN that is not
bypassable.
Bug: 259000745
Test: atest FrameworksNetTests
Change-Id: Ic9bcdf43f252f22d12a1136902cc8bbf9cc731f5
Some callers (e.g. iwlan) need to learn about system default
network but they cannot have NETWORK_SETTINGS permission.
To allow them to use this API but prevent from misuse by
unprivileged apps, enforce USE_RESTRICTED_NETWORKS for this API.
Test: atest com.android.server.ConnectivityServiceTest#testRegisterPrivilegedDefaultCallbacksRequireNetworkSettings android.net.cts.ConnectivityManagerTest#testRegisterNetworkCallback
Fix: 242456635
Change-Id: I80ab27445af874328c9c0f4814a8fbf035ae5df4
Expose API to use QoSCallback for UDP socket.
- Constructor of QosSocketInfo with DatagramSocket
- matchesProtocol(int protocol) in QosFilter
- Constructor of SocketNotConnectedException &
SocketRemoteAddressChangedException
Add CTS test cases for exposed API.
Bug: 233292861
Test: atest CtsNetTestCases
Change-Id: I52ff881b71b31c0f97c08200cd811205c25fcb44
sewookseoauthored and Sewook Seocommited 2022-09-29 08:54:08 +00:00
Revert submission 1387135-st02
Reason for revert: Usage of TYPE_CNAME in a library shared among
modules does not interact well with current module release process
Reverted Changes:
Ib5616c65c:[ST02.2] Use the getters of DnsHeader
I5e58f99b0:[ST02.1] Add TYPE_CNAME constant to DnsResolver
I0c1547cbc:[ST02] Add methods for synthesizing DNS packets
Change-Id: I5aa9f28f1268f966f62041193ceb7c8bef994579
This would be needed for subsequent patches that synthesizing DNS
packets for testing purpose.
Bug: 139774492
Test: atest DnsPacketTest DnsResolverTest
Change-Id: I5e58f99b09b693f167178e56f008be8b42d9417a
* changes:
TestNetworkInterface: add support for MacAddress and MTU
TestNetworkService: add support for creating iface without carrier
TestNetworkService: Add support for toggling carrier on tun/tap
TestNetworkService: Fix TestNetworkInterface parcel flags
Patrick Rohrauthored and Gerrit Code Reviewcommited 2022-06-15 20:53:30 +00:00
Both MacAddress and MTU size are often needed in tests and very painful
to get a hold of without system server permissions.
Test: TH
Change-Id: Ie1a91959916ea39277e76aa1b61f38d59a5d2a90
This change allows tests to mock NetworkAgent, and the methods
required for ensuring that the VPN is migrating properly.
Bug: 235853154
Test: Treehugger
Change-Id: I49333c010cc7f3d60ffd39f853777bfc52de3a89
Benedict Wongauthored and Lorenzo Colitticommited 2022-06-15 09:16:50 +00:00
This change allows tests to mock NetworkAgent, and the methods
required for ensuring that the VPN is migrating properly.
Bug: 235853154
Test: Treehugger
Change-Id: If4de0935a3c8627ca12db52ff223834f9f7237e8
Sewook Seo
commited 
Patrick Rohr
commited 
Mohannad Farrag
commited 
Motomu Utsumi
commited 
Gerrit Code Review
commited 
Priyanka Advani
authored and
Nagendra Prasad Nagarle Basavaraju
commited 
Ying Xu
commited 
Handa Wang
authored and
Jihoon Kang
authored and
Anton Hansson
authored and
Suprabh Shukla
commited 
Junyu Lai
commited 
Jordan Silva
authored and
Paul Duffin
commited 
chiachangwang
commited 
Kangping Dong
authored and
Quang Luong
authored and
Chalard Jean
commited 
lucaslin
commited 
Treehugger Robot
authored and
Remi NGUYEN VAN
commited 
Benedict Wong
authored and
Lorenzo Colitti
commited