The BACKGROUND firewall chain has been recently added. We want to
be able to turn it off in case of contingencies with a device-config
flag flip.
The flag is assumed to be boot-stable and its value is read at boot.
When the flag is off, we ignore any operation on this firewall chain.
Additionally, this chain is always considered disabled on versions
upto UPSIDE_DOWN_CAKE.
Note: All firewall chains are in disabled state at boot by default.
Test: atest FrameworksNetTests
Test: Manually, using adb shell device_config commands.
Bug: 331484830
Change-Id: I9ccc483e02e27a584da6714931466a9f2ec95ca9
NetworkPolicyManager#isUidNetworkingBlocked does not know about some
firewall chains status(e.g. FIREWALL_CHAIN_OEM_DENY_1)
So BpfNetMaps#isUidNetworkingBlocked is more correct but there could be
some behavior difference.
To avoid breaking devices and have longer verification time, this CL
updates to use BpfNetMaps#isUidNetworkingBlocked only on V+ devices.
Bug: 328732146
Test: TH
Change-Id: I60f84a5fff90386103692841dead465652249446
When request_restricted_wifi is enabled CarrierPrivilegeAuthenticator
calls CarrierPrivilegesLost callback passed from ConnectivityService.
But CarrierPrivilegeAuthenticator was using its own handler thread to
receive broadcast and callbacks so CarrierPrivilegesLost callback needed
to post a message to the CS handler.
This CL updates CarrierPrivilegeAuthenticator to use CS handler if
request_restricted_wifi is enabled, and remove the message post in
ConnectivityService.
Test: TH
Change-Id: Ib41304a30e3dd366b0f6f1d7df81145f0e05ece1
When there are addresses that are used by a single VPN interface,
ConnectivityService sets ingress discard rules to drop packets to this
address from the non-Vpn interfaces
Test: FrameworksNetTests
Bug: 295800201
Change-Id: I089d01a38eff3f37a851627fa9e4acefb8d9ad5e
This enforceNetworkStackPermission() should be adopted to check
the required permission but this may be break OEM captive portal
apps. Simply ignore the request if the caller does not have
permission.
This commit also fixes the format issues that is auto-fixed by
ktlint.
Fix: 329385091
Test: ates FrameworksNetTests
Change-Id: Ia973a1078eda3134fc8ff261d3954cd050767880
This CL updates CSTest to use mocked appOpsManager to bypass
checkPackage enforcement so that test can file network request as
SYSTEM_UID
Bug: 314627716
Test: atest ConnectivitySampleMetricsTest
Change-Id: I0a5f3b1bf2c343644e6f5e2a4ec1b0460e2645c4
This reverts commit 41557553f6.
(this is no longer needed, as it rolled out with January module,
while the May module this is targetting already includes an rc,
thus eliminating the need for this warning)
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I90c8abad2f70d65d142f55c18ad2f34018da6615
Maciej Żenczykowskicommited 2024-03-05 19:49:20 -08:00
This CL allows everyone to see the subscriptionIds and the network owner
to see the allowedUids from the NetworkCapabilities.
Bug: 324357121
Test: atest ConnectivityManagerTest
atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.ConnectivityServiceTest
Change-Id: I91e360827d2a9a64625f1d6ae0f808aa327c7d22
Apps that target an SDK before V will not see networks with
NET_CAPABILITY_LOCAL_NETWORK unless they explicitly set this capability
in their network requests.
Bug: 319212206
Test: CSLocalAgentTests
Change-Id: I414b03dfea9a8aac83304c6be501f03d637739b4
The hasNetworkStackPermission() method does not enfore the
permission check. It should be replaced with
enforceNetworkStackPermission().
Bug: 325984919
Test: atest FrameworksNetTests
Change-Id: I9ad0b47190dbc9afd2ee6f5dfc21a4935036733a
Always store the corresponding SubscriptionId together with the Carrier
uid so that when the carrier loses the Privilege, both the uid and
SubscriptionID will be used in the onCarrierPrivilegesLost callback
Bug: 324357121
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.connectivity.CarrierPrivilegeAuthenticatorTest
atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.ConnectivityServiceTest
Change-Id: I28e51c583261a67d4441c6f825ade6781b862ee4
On V, this feature is enabled on all devices.
On U, this feature is enabled if the flag is enabled.
Test: TH
Change-Id: I025b9a8098a0896be51cf06c5b8262243ba439b7
These can be used by manual or automated tests.
Test: Manual by using the `cmd connectivity` shell commands
Test: atest CtsNetTestCases:ConnectivityManagerTest
Test: atest netd_integration_test
Bug: 322562125
Change-Id: I1de55e430141f566e510b37554a9416c4444213b
- Implement handleSetSatelliteNetworkPreference() at ConnectivityService
to create multi layer request with preference order
PREFERENCE_ORDER_SATELLITE_FALLBACK.
- unit test coverage
Bug: 320514105
Test: m and atest FrameworksNetTests
Change-Id: I3f71104f8c3c998599eaab71ae4076985f4bed77
This CL allows the Carrier Config app to request restricted WiFi nework
by setting the correspoding subscription ID in the network request.
Bug: 315835605
Test: atest android.net.cts.NetworkRequestTest
atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.connectivity.CarrierPrivilegeAuthenticatorTest
atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.ConnectivityServiceTest
Change-Id: I237e692d092ff5f969ce4b7962f6d58099a6f3a9
The check*Permission methods are a bit error-prone because people
can forget to check the return value and expect that they behave
like the enforce* methods. This was pointed out before in some bugs.
This change adds @CheckResult annotation to enforce linter warning
and rename methods accordingly.
Test: TH
Fix: 279691948
Change-Id: Ibb0df6540fe0ed40289bb190b790130daaa2f763
Applies multicast routing configs when they are updated in
LocalNetworkConfig, or when local network/upstream network
status changes.
Bug: 281217735
Test: atest CSLocalAgentTests
Change-Id: Ib1c43c645a367d0f91e5cf0a0d9f8e5883be2c40
The original patch (aosp/2891011) incorrectly counted TCP
sockets with keepalive enabled for VPNs. This issue was
caused by the UID range verification. On bypassable VPNs,
the socket mark is always correct. It's possible for an
app that is not in the UID ranges to establish a socket
on the VPN. But that socket should be counted for the
purposes of keepalive. The old code would correctly count
it and the new code will incorrectly not count it. Also,
the UID range verification does not help on non-bypassable
VPNs since the socket mark is always the mark of default
network, not the socket mark of the VPN.
Instead of reverting the entire patch, this commit
removes the UID range mechanism. The code refactoring from
the original commit (which used structured classes to read
socket information) has been kept as it is a valuable
improvement.
Bug: 320842519
Test: atest FrameworksNetTests
Change-Id: I00731796144c982b9fd4d9771f3d0db1f1529a89
This is no-op refactor to move utility methods from
ConnectivityService to a common place.
Test: atest NetworkStaticLibTests#com.android.net.moduletests.util.PermissionUtilsTest#testEnforcePackageNameMatchesUid
Bug: N/A
Change-Id: I5802dedcc91fa6e130a5c534bba5080ca37dbeec
This change includes:
1. Refactor the logic in Tethering#dump into utils class.
2. Move the utils class to a common place which could be referenced
from other sub-modules.
3. Add @MonitorThreadLeak annotation to enforce
there is no thread leak problem.
Test: atest FrameworksNetTests NetworkStaticLibTests
Test: atest ConnectivityCoverageTests:com.android.networkstack.tethering.TetheringTest#testDumpTetheringLog
Test: adb shell dumpsys tethering (with hardcoded exception)
Fix: 312669345
Change-Id: Ia6fdfeeec2110afa0ec9e056e9db3843748845c3
This reverts commit e3245081b1.
Reason for revert: The change is unsafe as it introduces code with writings to a separate thread whose message queue size is unlimited.
Test: atest FrameworksNetTests
Change-Id: I392a30f77cfbcd17f420e29f0944604fd789b10a
This reverts commit c0baea5406.
Reason for revert: Checking if culprit of b/317506400
Change-Id: Icbe9d993c6d4bfdf305f2a4c7b8422095c8846a6
Bug: 317506400
Rename checkSystemBarServicePermission to checkStatusBarServicePermission to be consistent with the actual permission name.
Bug: 307161342
Change-Id: Ib0d353d33f1fc64d298919c107d3bc6691dc0bfe
Test: build
BYPASS_INCLUSIVE_LANGUAGE_REASON=Using public API
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.CSBpfNetMapsTest
(on U and V devices respectively)
Bug: 297836825
Fix: 314858283
Change-Id: Ibeac8cd3a33468c6539234255328affc6b3f8ffe
aosp/2405720 allowed network owner uid to see allowed uids
But this breaked old cts.
This CL reverts the behavior for network owner uid.
Bug: 312093253
Bug: 313025186
Bug: 312196228
Test: TH
Change-Id: Iaa732d22f67ecce7678e68bb8b20cec526116dc9
Check if the bpf loader rc file is differs from the template files when
ConnectivityService starts. Use Log.wtf() to log the file if there is a
diff.
Bug: 312638861
Test: TH
Change-Id: I0b9ed9962ad0954a051a17b01357d04a0e655ff4
In multi-user environment, the App might not be installed by system user.
As a result, the ConnectivityService should use the packageManager from
the user's context to be able to read the property correctly.
Bug: 300274339
Test: TH
Change-Id: I5398c95562bcaf5752270b52f38cca1f02698ba1
In PrivateDnsConfig class, `useTls` is replaced with `mode`.
This CL a corresponding change.
Bug: 240259333
Test: atest ConnectivityCoverageTests
Change-Id: I60c53e52f287fc7fa05543603a62632d934bb2e6
* changes:
Rename hasCarrierPrivilege... to isCarrierServiceUid...
Detect discrepancies in subIds
Allow carrier service UIDs to access their own WiFi networks.
Jean Chalardauthored and Gerrit Code Reviewcommited 2023-11-20 06:55:04 +00:00
Patrick Rohr
authored and
Gerrit Code Review
commited 
Suprabh Shukla
authored and
Motomu Utsumi
commited 
Ying Xu
authored and
Chiachang Wang
authored and
Maciej Żenczykowski
commited 
Nagendra Prasad Nagarle Basavaraju
commited 
Junyu Lai
commited 
Yang Sun
commited 
Danuta Brotikovskaya
commited 
Treehugger Robot
authored and
Karl Shaffer
authored and
Chris Göllner
commited 
Quang Luong
authored and
Yuyang Huang
authored and
Mike Yu
commited 
Jean Chalard
authored and