Currently, CS destroys sockets of apps under firewall chain restriction
only when the firewall chains get enabled by setFirewallChainEnabled.
This CL updates CS to also destroy sockets of apps when the
setUidFirewallRule and replaceFirewallChain update uid rule and apps
lose network access due to FIREWALL_CHAIN_BACKGROUND.
This socket destruction is delayed until the cell modem is up in the
same way that CS destroys sockets of frozen apps.
Test: CSSocketDestroyTest
Bug: 300681644
Change-Id: I6a6fb5d6d7b71c0949a4195b84d30efef95bff37
Currently, even if apps don't have INTERNET permission and can not use
network, network access is considered not blocked and
ConnectivityService send onBlockedStatusChanged callback with
blocked=false.
This CL introduced BLOCKED_REASON_NETWORK_RESTRICTED and consider
network access from apps targetting W+ on V+ releases is blocked if apps
don't have INTERNET permission.
Permission is set when the user is added or package is installed and
permission is removed when the user is removed or packages is
uninstalled.
So ConnectivityService does not need to monitor permission change to
send onBlockedStatusChanged callback by permission change.
Test: CSBlockedReasonsTest
Bug: 339559837
Change-Id: I58d2a4eddc714e205f5b96219f95b637f2826c58
Currently, CS receives the blocked status change from
NetworkPolicyCallback.
This CL update CS to generate blocked status based on bpf map contents
on V+.
When the data saver and firewal chain status is updated, CS generate new
blocked reasons based on bpf map contents.
U- keeps listening to NetworkPolicyCallback.
Bug: 328732146
Test: testNetworkCallbackMaximum, CSBlockedReasonsTest
Change-Id: I6fa3f1a44eadc67d9cff17133905ef69203c044a
This CL moves mPerUidCounter.incrementCountOrThrow from
NetworkRequestInfo constructor to the caller of NetworkRequestInfo
constructor and stop incrementing counter for internal NetworkRequestInfo
(e.g. per-app default requests).
Also, this CL update CS not to modify perUidCounter when CS updates
apps' track default network request when the per-app default request is
updated since this does not change the number of request for each uids.
Test: testNetworkCallbackMaximum
Bug: 339106399
Change-Id: I82dbeb82b1c762c2c277d5794d54997b57009b6a
delay_destroy_frozen_sockets_version is rolled out to public 100%.
So this CL enables this flag as default with kill switch.
This flag is no-op if destroy_frozen_sockets_version is disabled, and
destroy_frozen_sockets_version is also rolled out to public 100%.
So this CL does not change any behabior on the production devices.
Upcoming CLs will update CS to destroy sockets of apps that are under
FIREWALL_CHAIN_BACKGROUND restriction as well.
So this CL renames flag name from delay_destroy_frozen_sockets_version
to delay_destroy_sockets which is not specific to frozen apps.
Bug: 300681644
Test: TH
Change-Id: Icb9edff4e517fca57408d7d690fe9e172754c35e
In current design, this class is risky because developers might
assume that it's safe to set real device flags with it. This is
unsafe because the class does not restore the previous value.
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.net.NetworkStatsServiceTest
Fix: 339154394
Change-Id: I2a12e7892eaf66e7572928de39e00de3faf5fa60
NETWORKINFO_WITHOUT_INTERNET_BLOCKED compat flag only changed the
behavior of getActiveNetworkInfo that depends on
bpfNetMaps#isUidNetworkingBlocked.
But isUidNetworkingBlocked is used from other APIs(e.g. getActiveNetwork)
This CL update all APIs that depends on isUidNetworkingBlocked to follow
the compat flag to make behavior consistent between APIs.
aosp/3079290 will update onBlockedStatusChanged callback to follow this
compat flag.
Bug: 340773991
Bug: 339780435
Test: TH
Change-Id: If64ec800f21c2adc613884838202e2dece4a8d95
Modified the execution sequence within ClatCoordinator.clatStart() to
configure the local 464xlat read/write sockets before configuring and
bringing up the tun interface. This ensures that upon receiving an
RTM_NEWLINK message for the tun interface up event, the anycast address
is already configured on the physical interface.
Test: TH, manual test on physical device
Change-Id: I558cd370456091b8a61e1137a53305527fb651fd
probed in the repository
There's a scenario where an undesired conflict happens:
1. Register a service and custom host with addresses and public key.
2. Register another service using the same hostname and public key.
While the second registartion is being probed, its KEY RR is considered
as conflicting with the address record of the first registraiton. This
shouldn't be a reasonable behavior because the address record itself is
from the repository itself.
Bug: 336936158
Bug: 336967571
Test: atest CtsNetTestCases:NsdManagerTest FrameworksNetTests:android.net.connectivity.com.android.server.connectivity.mdns.MdnsRecordRepositoryTest
Change-Id: Ibe6c8dd845540eba8f08152be6693be1dbc42ce9
Before aosp/3001087, getNetworkActiveInfo did not return network info
with blocked state for apps without PERMISSION_INTERNET even if the
network is actually blocked.
aosp/3001087 updated getNetworkActiveInfo to return correct blocked
state on V+.
However, this broke some apps that use getNetworkActiveInfo in wrong way
and depends on the previous behavior.
So this CL introduces the compat flag to keep previous behavior for apps
targeting U or older releases.
Test: TH
Bug: 333340911
Change-Id: I0e0950f2148de0ffdb45495903a5a87e0d4c1c0b
The SparseArray.indexOfValue() uses == to compare values,
MulticastRoutingCoordinator uses SparseArray with String type values,
and the indexOfValue function would sometimes return -1 when looking for
a value in the SparseArray.
Added a helper function getIndexForValue in CollectionUtils to get index
by comparing values with equals, and used this function in MulticastRoutingCoordinator.
Updated
MulticastRoutingCoordinatorServiceTest#testMulticastRouting_applyConfigNone_removesMfc
test case to use copies of interface names when updating the multicast
configs, so the test would fail without this fix.
Test: atest NetworkStaticLibTests:com.android.net.moduletests.util.CollectionUtilsTest#testGetIndexForValue
atest android.net.connectivity.com.android.server.connectivity.MulticastRoutingCoordinatorServiceTest#testMulticastRouting_applyConfigNone_removesMfc
Change-Id: I862242d6be01b8552cdd6af6c9691948a9f0bfe0
Follow up CLs will update CS to generate blocked reason from bpf map
instead of asking NPMS.
However, one issue is NPMS set PENALTY_BOX for
BLOCKED_METERED_REASON_USER_RESTRICTED and
BLOCKED_METERED_REASON_ADMIN_DISABLED without telling the reason.
So, CS can not know the reason of PENALTY_BOX.
This CL add new firewall chain and match to distinguish reasons.
NPMS must call setUidFirewallRule with
FIREWALL_CHAIN_METERED_DENY_USER or FIREWALL_CHAIN_METERED_DENY_ADMIN
based on the reason so that CS can know the reason of restriction.
Bug: 332628891
Test: atest com.android.cts.net.HostsideRestrictBackgroundNetworkTests
Change-Id: Ia4ad4bdb345abc22c782630e828edfad2452db36
This CL adds elapsedRealTime() to Dependencies so that in the unit test
we can simulate the elapse of time.
Bug: 336268432
Test: atest FrameworksNetTests:android.net.connectivity.com.android.server.connectivity.mdns.MdnsRecordRepositoryTest
Change-Id: I64cf0ac1772f54edf187cf9ca6351a75b81fd859
ConnectivityServiceTest is deprecated but people sometimes still
add new test methods to it, and getting review feedback to rewrite
tests in CSTest. This wastes resources.
Thus, assert fixed test method count to make it fails locally for
people to aware of it.
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.ConnectivityServiceTest#testTestMethodCount
Bug: N/A
Change-Id: I0a98a0e3fcd97484f372737e7c6fe24743c21834
This CL separates the multicast reply quota for IPv4 and IPv6. Before
this change, when an IPv4 mDNS query and an IPv6 mdns query arrives at
the same time for the same record (which is a common behavior for DNS-SD
resolvers), MdnsRecordRepository will only respond to one of them. The
other response will be throttled silently.
It's especially problematic when the IPv4 query and IPv6 query are sent
by different hosts. One of the hosts will get no reply.
Bug: 335096961
Test: Unit test and verified on a local device.
Change-Id: I0d7a9fad2b43bbfb8b042828295cdf08bf4ae5c8
Also simplify DnsManagerTest by using the autogenerated equals()
method in ResolverParamsParcel instead of a hand-rolled
comparison method.
Test: covered by existing tests
Change-Id: Ie1b1bd011a440be0175420f903f39a4153d2245e
Lorenzo Colitticommited 2024-04-17 23:05:14 +09:00
A Matter device uses a hex as the hostname so it may begin with a digit
which wasn't allowed in NsdService. This CL looses this check to allow
Matter devices to register their services at Android Thread Border
Router.
Bug: 334828525
Test: CI
Change-Id: Ia779791e214158a08c2ec06adf8d5630ec8ea616
* changes:
Make cache duration and max entries configurable
Create TestRule: SetFeatureFlagsRule
Rate-limit on TrafficStats#get*[Bytes|Packets] API calls
Clear TrafficStats cache before getting readings from TrafficStats
Treehugger Robotauthored and Gerrit Code Reviewcommited 2024-04-11 07:26:14 +00:00
In the reportServiceResolutionStop function, the sent query count
is not set. This means it's impossible to track how many queries
are sent when a service is not resolved successfully. To track
this information, add the sent query count to
reportServiceResolutionStop.
Fix: 333302084
Test: atest FrameworksNetTets NsdManagerTest
Change-Id: Ida2a33ea35e9bb7393fe860245eb5ad8578d5ff6
Field trials could be used to find ideal values.
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.net.NetworkStatsServiceTest
Bug: N/A
Change-Id: Ia1304d041a19a81f54b7fdfbbbf1871c7c58a57f
This rule works by reading the annotation and dynamically
invoking a user-specified method before evaluation to handle the feature flag configuration.
Usage:
class MyTestClass {
@get:Rule
val setFeatureFlagsRule = SetFeatureFlagsRule(setFlagsMethod = (name, enabled) -> {
// Custom handling code.
})
// ... test methods with @FeatureFlag annotations
@FeatureFlag("FooBar1", true)
@FeatureFlag("FooBar2", false)
@Test
fun testFooBar() {}
}
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.net.NetworkStatsServiceTest
Bug: N/A
Change-Id: I439e8ee40b8e81b6eb3857925912a3b843e8dfa1
NsdServiceInfo may contain an interface index if it was obtained from a
previous discovery callback which found a service on an interface that
does not belong to any Network.
In that case, subsequent resolve or registerServiceInfoCallback queries
using that NsdServiceInfo should only be done on the matching interface.
Apps may otherwise receive replies from other networks, with different
interface addresses.
As a simple fix, still request sockets from all interfaces in that case,
but only create the MdnsServiceTypeClients on matching sockets.
The sockets are created / cleaned up based on the lifecycle of the
requests, which does not change.
Fixes: 332262554
Test: atest
Change-Id: I2bbb498d4a0d37725f019a4cf5e367fef76fa0e8
This change put a rate-limit on TrafficStats getter APIs to
reduce the need of accessing bpf map. For any caller who calls
this method within 1 second, a stale result will be returned.
One expected outcome is this change would break any test which
relies on immediate change of the result of TrafficStats after
making network traffic. Thus, related tests are fixed in the
counter part CL accordingly.
Test: atest CtsNetTestCases:android.net.cts.TrafficStatsTest --rerun-until-failure 100
Test: atest CtsNetTestCases:android.net.cts.NetworkStatsManagerTest
Test: atest NetworkStackIntegrationTests:android.net.NetworkStatsIntegrationTest
Test: atest ConnectivityCoverageTests:android.net.connectivity.com.android.server.net.NetworkStatsServiceTest
Bug: N/A
Change-Id: Ibd6ae92d7c806481bb8a5124dd231f8f5aa206f2
The BACKGROUND firewall chain has been recently added. We want to
be able to turn it off in case of contingencies with a device-config
flag flip.
The flag is assumed to be boot-stable and its value is read at boot.
When the flag is off, we ignore any operation on this firewall chain.
Additionally, this chain is always considered disabled on versions
upto UPSIDE_DOWN_CAKE.
Note: All firewall chains are in disabled state at boot by default.
Test: atest FrameworksNetTests
Test: Manually, using adb shell device_config commands.
Bug: 331484830
Change-Id: I9ccc483e02e27a584da6714931466a9f2ec95ca9
With satellite transport supported at device and satellite
network to appear under type mobile, considers cellular or
satellite, or combination of both interfaces under mobile interfaces.
Note: getUidStatsForTransport(TRANSPORT_SATELLITE) is not supported,
considering the same interface name could be used by cellular as well,
supporting this might lead to double counting problem.
Bug: 329003473
Test: atest FrameworksNetTests
Change-Id: I85465cedcc5550fa0555dc36b3be364ac90aade1
- Handle onRoleHoldersChanged is not triggered even if the user has a
default app setup and gets deleted scenario.
- Adding ACTION_USER_REMOVED intent filter, to monitor for User
removal. This to used to update satellite fallback uid list
and to keep allowed uid range updated at multi layer request
of track default and satellite transport with Internet
restricted capability
Bug: 326373613
Test: atest FrameworksNetTests
Change-Id: I1f30cd129309486bccbc61802ed600c142077411
Motomu Utsumi
commited 
Lorenzo Colitti
authored and
Gerrit Code Review
commited 
Junyu Lai
commited 
Maciej Żenczykowski
authored and
Yuyang Huang
commited 
Handa Wang
commited 
Kholoud Mohamed
authored and
Yang Sun
authored and
Treehugger Robot
authored and
Android Build Cherrypicker Worker
commited 
Patrick Rohr
authored and
Paul Hu
authored and
Remi NGUYEN VAN
commited 
Chris Desir
authored and
Suprabh Shukla
authored and
Nagendra Prasad Nagarle Basavaraju
authored and