Local net protections is introduced in B as a developer opt-in, on dev
builds; the feature flag is meant to be used when enforcement begins in
2026
Bug: 396116600
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.connectivity.PermissionMonitorTest
Change-Id: Id5e7a7cf825f10f90edd600ea2567cfe6efd2e98
Most of the maps used by BpfNetMaps are configuration maps that
in production code are only written to by BpfNetMaps. Move these
maps to SingleWriterBpfMap to take advantage of caching.
Specifically, the following are only written by BpfNetMaps in
production code:
- sConfigurationMap
- sUidOwnerMap
- sUidPermissionMap
- sDataSaverEnabledMap
- sIngressDiscardMap
Additionally:
- firewall.cpp writes to sConfigurationMap, sUidOwnerMap, and
sDataSaverEnabledMap, but that code only runs in tests because
it requires root privileges.
- NetworkStackBpfNetMaps also uses sConfigurationMap,
sUidOwnerMap and sDataSaverEnabledMap, but it opens all of them
with BPF_F_RDONLY so cannot write to them.
sCookieTagMap is left uncached because it's also written to by
netd (as part of socket tagging) and ClatCoordinator.
Fix: 343166906
Test: no-op replacement, covered by existing tests
Change-Id: Ie2619949477323d557b8906cf082e86a78512847
Lorenzo Colitticommited 2024-06-05 06:48:50 +00:00
Before aosp/3001087, getNetworkActiveInfo did not return network info
with blocked state for apps without PERMISSION_INTERNET even if the
network is actually blocked.
aosp/3001087 updated getNetworkActiveInfo to return correct blocked
state on V+.
However, this broke some apps that use getNetworkActiveInfo in wrong way
and depends on the previous behavior.
So this CL introduces the compat flag to keep previous behavior for apps
targeting U or older releases.
Test: TH
Bug: 333340911
Change-Id: I0e0950f2148de0ffdb45495903a5a87e0d4c1c0b
With this annotation, errorprone build will fail if callers don't check
sdk version before calling any methods in BpfNetMapsUtils.
Bug: 328732146
Test: TH
Change-Id: Ifa52dc1d2766f8d46dfdc4f6ca9dbb963406c084
Follow up CLs will update CS to generate blocked reason from bpf map
instead of asking NPMS.
However, one issue is NPMS set PENALTY_BOX for
BLOCKED_METERED_REASON_USER_RESTRICTED and
BLOCKED_METERED_REASON_ADMIN_DISABLED without telling the reason.
So, CS can not know the reason of PENALTY_BOX.
This CL add new firewall chain and match to distinguish reasons.
NPMS must call setUidFirewallRule with
FIREWALL_CHAIN_METERED_DENY_USER or FIREWALL_CHAIN_METERED_DENY_ADMIN
based on the reason so that CS can know the reason of restriction.
Bug: 332628891
Test: atest com.android.cts.net.HostsideRestrictBackgroundNetworkTests
Change-Id: Ia4ad4bdb345abc22c782630e828edfad2452db36
NetworkPolicyManager#isUidNetworkingBlocked does not know about some
firewall chains status(e.g. FIREWALL_CHAIN_OEM_DENY_1)
So BpfNetMaps#isUidNetworkingBlocked is more correct but there could be
some behavior difference.
To avoid breaking devices and have longer verification time, this CL
updates to use BpfNetMaps#isUidNetworkingBlocked only on V+ devices.
Bug: 328732146
Test: TH
Change-Id: I60f84a5fff90386103692841dead465652249446
This CL also adds @RequiresApi(Build.VERSION_CODES.UPSIDE_DOWN_CAKE)
to NetworkStackBpfNetMaps
Bug: 328732146
Test: TH
Change-Id: Ifa4cffd046164405b8b49d2e2ee9f27240bec6fa
BpfNetMapsReader is loaded to bootclasspath. So this class should not
contain unnecessary codes.
To make this clear, this CL renames to NetowrkStackBpfNetMaps and add
comments
Bug: 328732146
Test: TH
Change-Id: I557627c9fae087eb6119c2ae31d46526fa9e5d7e
netd.o bpf program was mainlined in T
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I6d2b34e26f5640840b74d4c761b01668e44dc9d6
Maciej Żenczykowskicommited 2024-01-25 15:15:26 -08:00
we can't use java for this, because pre-U-QPR2 does not include:
https://android-review.googlesource.com/c/platform/system/sepolicy/+/2821590
system_server dontaudit key_socket getopt
so we'll spew lots of:
11-08 07:52:43.776 1469 1469 I auditd : type=1400 audit(0.0:4): avc: denied { getopt } for comm="system_server" scontext=u:r:system_server:s0 tcontext=u:r:system_server:s0 tclass=key_socket permissive=0
11-08 07:52:44.360 1469 1469 I auditd : type=1400 audit(0.0:5): avc: denied { getopt } for comm="NetworkStats" scontext=u:r:system_server:s0 tcontext=u:r:system_server:s0 tclass=key_socket permissive=0
11-08 07:52:44.508 1469 1469 I auditd : type=1400 audit(0.0:7): avc: denied { getopt } for comm="android.bg" scontext=u:r:system_server:s0 tcontext=u:r:system_server:s0 tclass=key_socket permissive=0
and the like.
This is due to Java's Os.close() in:
libcore/luni/src/main/java/libcore/io/BlockGuardOs.java;l=100
calling:
if (fd.isSocket$()) if (isLingerSocket(fd)) ...
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ib87fa5e8f0dfd9fbbccb25fb58a9fa78d6a07111
Maciej Żenczykowskicommited 2023-11-09 11:08:58 +00:00
skDestroyListener is always running with Java code so removed the
unnecessary check.
Bug: 217624062
Test: TH
Change-Id: Ie1a36c3c736005ec4821c5e9c9983998f7042afa
BpfNetMaps uses java library for updating bpf map as the default code
path.
This is already released to 100% production without any issues.
So this CL removes the old code path from BpfNetMaps.
Note that native_init only opens the bpf maps if sEnableJavaBpfMap is
true.
But if sEnableJavaBpfMap is true, no native code in TrafficController
access the bpf map.
So this CL can remove native_init.
Following CL will remove the nativce codes for old code path.
Bug: 217624062
Test: NetworkStaticLibsTests
Change-Id: Ifba198d9e6f93b53fd1dbf3b2aafb644da0b147d
This is needed for data stall detection mechanism in NetworkStack
to get the information about whether the network is blocked for
a given uid and conditions. Because the API will be called
frequently from NetworkStack to resolve all status for all uids
on the device, the API cannot call into the service which
creates IPC. Instead, the API need to directly access bpf maps
in the user process to retrieve the status. In this case the
user process is the network stack, the access control is provided
by linux file permission and selinux.
Test: atest FrameworksNetTests:android.net.connectivity.android.net.BpfNetMapsReaderTest
Test: atest FrameworksNetTests:android.net.connectivity.android.net.ConnectivityManagerTest
NO_IFTTT=Refactor only change for firewall chains definitions
Bug: 297836825
Change-Id: Iaf983b71ec98cbfe5152dcfade8a3120f938f135
The information is needed by modules who want to know whether a
specific UID is blocked by Data Saver feature.
1. Add a one-element map data_saver_enabled_map.
2. Update current data saver setting to the map.
Bug: 288340533
Test: atest FrameworksNetTests:android.net.connectivity.com.android.serv
er.BpfNetMapsTest
Test: atest bpf_existence_test
Change-Id: I981da4b569247c33cba2d365cb6f2691f673474e
A helper class to *read* java BpfMaps. This is designed to
provide direct bpf access in the caller process through
ConnectivityManager APIs.
The change also removes any statical link to
net-utils-device-common-struct from service-connectivity.
This is because net-utils-device-common-struct is already
included in framework-connectivity. Including it again in
service-connectivity would create a r8 build fail by circular
dependency.
Test: atest FrameworksNetTests:android.net.connectivity.com.android.server.BpfNetMapsTest
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.net.module.util.StructTest
Test: atest FrameworksNetTests:android.net.connectivity.android.net.BpfNetMapsReaderTest
Bug: 297836825
Change-Id: I7a6d2eb816d0dc7343167bddd672806b199f44fe
If the flag value is unset or 0, isFeatureEnabled return false and
isFeatureNotChickenedOut return true.
If the flag value is -1 (force disable), both return false.
If the flag value is other values, both query the package version and
return `flagValue <= packageVersion`
Now the only difference is a default behavior when the flag is not set
or 0.
So isFeatureEnabled and isFeatureNotChickenedOut can use the same flag.
This CL also fixes the issue in rollback.
Before this CL, isFeatureNotChickenedOut did not check the module
version and could have a issue if there is a rollback.
Test: NetworkStaticLibsTests
Bug: 279108992
Change-Id: I12d6ebadff3aee7b7c614aca4eb0a34ef0db9857
This is a no-op refactoring that splits constants and utility
methods into standalone classes which will be shared with
a bpf reader class in subsequent CLs.
NO_IFTTT=No-op refactoring
Test: atest FrameworksNetTests:android.net.connectivity.com.android.server.BpfNetMapsTest
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.net.module.util.StructTest
Bug: 297836825
Change-Id: I6d7ea044e43180ae001573009a166be74ebe6a5d
Experiment to verify bpf map operations refactoring showed no
change of map size metrics and no system health regressions.
So this CL update BpfNetMaps to always use new code path with kill
switch.
Test: m
Bug: 217624062
Change-Id: Ic17470ac5c075884871ea2df2c13c054f5ac2929
Build/TestCop - revert this if you see failures (just document where).
It erroneously(?) doesn't appear to cause any failures in TH
on aosp/master.
Bug: 291519274
Change-Id: I78b049302ae9bd2a8db8c03e79388dc4e51e110f
Maciej Żenczykowskicommited 2023-07-18 20:09:20 +00:00
From service-connectivity, NAMESPACE_TETHERING must be used, as
NAMESPACE_CONNECTIVITY is used for the NetworkStack module. Also the
isFeatureEnabled with module name must be used, otherwise the "android"
package version is queried instead of the tethering module version.
BpfNetMaps is using flag value 1 to workaround this issue.
flags in NsdService, AutomaticOnOffKeepaliveTracker, and ConnectivityFlags
were not pushed currently.
So, this change has no effect to devices.
Bug: 279108992
Test: TH
Change-Id: I2b4b6a13c048c20beef52b1f43b9e21aca0c637a
Upcoming CLs use this method to add chain status to failure log of
ConnectivityManagerTest#testFirewallBlocking which is a flaky test
Test: atest BpfNetMapsTest
Bug: 262141231
Change-Id: Ib130a28c708f675c79b889bf293dfe6b0f8d7f60
Having SdkLevel.isAtLeastU() as a default value of
DeviceConfigUtils.isFeatureEnabled could result confusing behavior.
For example, when flag value is pushed to only the T device and the T
device with the flag is ugraded to U, this device could disable java bpf
map while the device keeps the flag value.
This CL prevents above confusing behavior.
Bug: 246218229
Test: atest BpfNetMaps
Change-Id: I615603c337bb94101dccac77ea0e6fa857041259
Information in the dump does not change
....
current ownerMatch configuration: 516 DOZABLE_MATCH OEM_DENY_1_MATCH
....
Bug: 217624062
Test: dumpsys connectivity trafficcontroller, atest BpfNetMapsTest
Change-Id: I5f7b56e4ba03256414f49d0e82d65477fb97f05a
Information in the dump does not change
....
current statsMap configuration: 0 SELECT_MAP_A
....
Bug: 217624062
Test: dumpsys connectivity trafficcontroller, atest BpfNetMapsTest
Change-Id: I42a844227f258b91ba5b368d8e8abf82a773a801
Jacque Li
commited 
Sarup Dalwani
authored and
Treehugger Robot
authored and
Gerrit Code Review
commited 
Motomu Utsumi
commited 
Maciej Żenczykowski
commited 
Lorenzo Colitti
commited 
Patrick Rohr
authored and
Junyu Lai
commited 
Ken Chen
commited