Commit Graph

898 Commits

Author SHA1 Message Date
Remi NGUYEN VAN
49d6b5d80b Merge "Add jarjar rules generator" 2022-06-17 01:09:11 +00:00
Motomu Utsumi
5d787feef0 Merge changes Ic6ff7a3d,Iff9b9792
* changes:
  Refactor code and improve tests for VPN filtering
  Remove LOCKDOWN from FirewallChain IntDef
2022-06-16 01:32:20 +00:00
Patrick Rohr
929368eb1a Merge changes Ie1a91959,Ic189b2c0,I39d70e0a,Ibb5f1402
* changes:
  TestNetworkInterface: add support for MacAddress and MTU
  TestNetworkService: add support for creating iface without carrier
  TestNetworkService: Add support for toggling carrier on tun/tap
  TestNetworkService: Fix TestNetworkInterface parcel flags
2022-06-15 20:53:30 +00:00
Patrick Rohr
88f97f4fba TestNetworkInterface: add support for MacAddress and MTU
Both MacAddress and MTU size are often needed in tests and very painful
to get a hold of without system server permissions.

Test: TH
Change-Id: Ie1a91959916ea39277e76aa1b61f38d59a5d2a90
2022-06-15 10:25:45 -07:00
Patrick Rohr
2b726efdc0 TestNetworkService: add support for creating iface without carrier
Disabling the carrier of a tun/tap interface before the interface is
brought up is useful in testing.

Test: atest EthernetManagerTest
Change-Id: Ic189b2c0eda76e3f58c3f664e5f5d18c2d7e6e96
2022-06-15 10:25:45 -07:00
Patrick Rohr
bbd16c57a0 TestNetworkService: Add support for toggling carrier on tun/tap
Adds support for setting carrier to on/off for a tun/tap interface. It
turns out that TUNSETCARRIER is also usable by tap interfaces, and
TUNSETLINK does not work as expected.

Test: atest EthernetManagerTest
Change-Id: I39d70e0a65a34e7a4c4df70c53e4cc781a24a213
2022-06-15 10:17:42 -07:00
Benedict Wong
0815c8c66a Unfinalize additional methods in NetworkAgent
This change allows tests to mock NetworkAgent, and the methods
required for ensuring that the VPN is migrating properly.

Bug: 235853154
Test: Treehugger
Change-Id: I49333c010cc7f3d60ffd39f853777bfc52de3a89
2022-06-15 09:16:50 +00:00
Patrick Rohr
2ebff8a777 TestNetworkService: Fix TestNetworkInterface parcel flags
PARCELABLE_WRITE_RETURN_VALUE will close the fd when writeParcelable is
called. This is not always preferable (specifically, if
TestNetworkInterface is passed as an "in" parameter).
writeParcelable(FileDescriptor, ...) should therefore use the flags
passed to writeToParcel which should be correct for all cases.

Test: atest EthernetManagerTest
Change-Id: Ibb5f14028a3d686157504da3657a18ec0bc28110
2022-06-14 10:23:53 -07:00
Remi NGUYEN VAN
11f162b5f8 Add jarjar rules generator
(This rolls forward part of a previous change, now that jarjar was fixed
to not get very slow when the number of rules increases).

Jarjar rules are hard to keep in sync with code, and hard to maintain
manually as the distinction between what should and should not be
jarjared is not always clear. This results in unsafe binaries that are
manually maintained, and developer frustration when something fails due
to incorrect jarjar rules.

Add utility to autogenerate jarjar rules, which can be run at build time
time (via a genrule) instead. The generator scans pre-jarjar
intermediate artifacts, and outputs jarjar rules for every class to put
it in a package specific to the module. The only exceptions are:

 - Classes that are API (module-lib API is the largest API surface of
   the module, so module-lib API stubs would typically be used)
 - Classes that have unsupportedappusage symbols
 - Classes that are excluded manually (for example, because they have
   hardcoded external references, like for
   ConnectivityServiceInitializer in SystemServer).

Bug: 217129444
Test: atest jarjar-rules-generator-test;

Change-Id: I3493957e39a661b6c2e330944e7c3023b8f3203e
2022-06-14 09:11:27 +00:00
Benedict Wong
33acb90622 Make setUnderlyingNetwork() non-final
This change allows tests to mock NetworkAgent, and the methods
required for ensuring that the VPN is migrating properly.

Bug: 235853154
Test: Treehugger
Change-Id: If4de0935a3c8627ca12db52ff223834f9f7237e8
2022-06-14 02:07:50 +00:00
Treehugger Robot
662f414c99 Merge "Make FIREWALL_CHAIN_OEM_DENY API" 2022-06-13 02:12:30 +00:00
Motomu Utsumi
62385c884f Make FIREWALL_CHAIN_OEM_DENY API
Bug: 208371987
Test: m
Change-Id: Ie0c2ad862c02f9fd4561869cf5a1adc44f1be11b
2022-06-12 11:37:19 +00:00
Motomu Utsumi
8b42e6d431 Remove LOCKDOWN from FirewallChain IntDef
LOCKDOWN_VPN was in the FirewallChain IntDef but this was not a right
place because LOCKDOWN_VPN was not a valid value for Connectivity APIs
that take an argument annotated with @FirewallChain(setUidFirewallRule,
setFirewallChainEnabled, replaceFirewallChain).

LOCKDOWN_VPN was in the FirewallChain IntDef because
BpfNetMaps#setUidRule was used to add/remove LOCKDOWN_VPN entries.
This commit adds BpfNetMaps#updateUidLockdownRule and uses this to
add/remove LOCKDOWN_VPN entries instead of BpfNetMaps#setUidRule and
removes LOCKDOWN from FirewallChain.

Bug: 206482423
Test: atest TrafficControllerTest ConnectivityServiceTest
PermissionMonitorTest HostsideVpnTests#testBlockIncomingPacket

Change-Id: Iff9b9792fc0f208f153e10e396c6d5034b412d7c
2022-06-10 02:49:25 +00:00
Vinh Tran
6d8c1d7916 Replace gensrcs with java_library to deprecate depfile in gensrcs
The depfile concept in Soong and Ninja isn't applicable in Bazel because
Bazel requires listing the deps explicitly. This CL changes the module
type from gensrcs to java_library with proto.type set to "stream".

The end goal is to eventually deprecate depfile in gensrcs to ensure all
gensrcs modules are convertable to Bazel.

Test: CI
Bug: 179452413
Change-Id: I921324e6260b7de6329a1ff445b6326643a9c526
2022-06-08 01:26:16 -04:00
Motomu Utsumi
1d9054ba5f Add 3rd deny firewall chain for OEM
Bug: 208371987
Test: atest
CtsNetTestCases:android.net.cts.ConnectivityManagerTest#testFirewallBlocking
ConnectivityServiceTest

Change-Id: Ib521fa02f6a19270cb88a3d85321bda822516c78
2022-06-06 07:47:35 +00:00
Motomu Utsumi
d980149817 Add deny firewall chain for OEM
Bug: 207773349
Bug: 208371987
Test: atest
CtsNetTestCases:android.net.cts.ConnectivityManagerTest#testFirewallBlocking
--iterations 50 && atest ConnectivityServiceTest --iterations 10

Change-Id: I60d5540821abcced03356f366775f16ee369d7f9
2022-06-03 09:10:57 +00:00
Iván Budnik
6373153fcd Revert "NetworkRequest.Builder should create a defensive copy of capabilities"
This reverts commit f1ab80ea62.

Reason for revert: DroidMonitor: Potential culprit for Bug 233698500 - verifying through ABTD before revert submission. This is part of the standard investigation process, and does not mean your CL will be reverted.

Change-Id: I7de63e0a3656194b94b29e28862c62fc300dfdfa
2022-05-24 09:24:16 +00:00
Patrick Rohr
f1ab80ea62 NetworkRequest.Builder should create a defensive copy of capabilities
This broke my tests in unexpected ways as creating a new
NetworkRequest.Builder() changed the static request object.

Test: TH && atest EthernetManagerTest
Change-Id: Ia6c39145cf92a2795f7fc2f4efbcb46d193f6b72
2022-05-20 12:00:36 -07:00
Colin Cross
708b1ab707 Merge changes Ide01c994,Ia9f12a7b
* changes:
  Revert "Autogenerate connectivity jarjar rules"
  Revert "Clarify comment in gen_jarjar.py"
2022-05-18 18:34:32 +00:00
Colin Cross
ece3171cf0 Revert "Autogenerate connectivity jarjar rules"
This reverts commit 53eb35cd82.

Reason for revert: b/233081774, caused long build times in FrameworkNetTests

Change-Id: Ide01c994f694b55fc0e87bb0e81584ac44196e68
2022-05-18 18:30:27 +00:00
Motomu Utsumi
f6131c483b Merge changes If52ece61,Iedf344f6
* changes:
  Block incoming packets in VPN Lockdown mode.
  Refactor VPN interface filtering necessity check
2022-05-17 01:42:00 +00:00
Motomu Utsumi
b08654ca04 Block incoming packets in VPN Lockdown mode.
Currently, even when VPN Lockdown mode is enabled, incoming packets are
not dropped if VPN is not connected.

This commit fixed this issue.
After this commit, If VPN Lockdown mode is enabled, incoming packets
are dropped regardless of the VPN connectivity.

Bug: 206482423
Test: atest TrafficControllerTest ConnectivityServiceTest PermissionMonitorTest
Change-Id: If52ece613c8aac1073355e43b6fb9cb3fcc87d1d
2022-05-16 10:40:59 +00:00
Remi NGUYEN VAN
4cd92adf0e Merge "Autogenerate connectivity jarjar rules" 2022-05-16 09:06:33 +00:00
Remi NGUYEN VAN
53eb35cd82 Autogenerate connectivity jarjar rules
Jarjar rules are hard to keep in sync with code, and hard to maintain
manually as the distinction between what should and should not be
jarjared is not always clear. This results in unsafe binaries that are
manually maintained, and developer frustration when something fails due
to incorrect jarjar rules.

Autogenerate jarjar rules at build time instead. This is achieved by
introducing a jarjar-rules-generator python-based library, which scans
pre-jarjar intermediate artifacts, and outputs jarjar rules for every
class to put it in a package specific to the module. The only exceptions
are:

 - Classes that are API (module-lib API is the largest API surface of
   the module)
 - Classes that have unsupportedappusage symbols
 - Classes that are excluded manually (for example, because they have
   hardcoded external references, like for
   ConnectivityServiceInitializer in SystemServer).

This change causes all classes in framework-connectivity(-t) and
service-connectivity to be jarjared into android.net.connectivity, but
still avoids jarjaring classes in com.android.server as before, to keep
it small.
For many classes this differs from the original jarjar rule.

Notes on implementation:

 - connectivity-jarjar-rules now has a subset
   framework-connectivity-jarjar-rules containing only the rules
   necessary for framework-connectivity. This is necessary because
   framework-connectivity cannot depend on rules generated based on
   service-connectivity, as there would be a dependency cycle
   (service-connectivity depends on framework-connectivity); Soong even
   crashes with a stack overflow.

 - framework-wifi.stubs.module_lib is added to
   framework-connectivity-pre-jarjar as it is necessary to build it (it
   is already in impl_only_libs in the defaults).
   It is unclear why framework-connectivity-pre-jarjar could build
   before that (possibly because it was only used as "lib" ?)

 - Fix package-private visibility; for example NattSocketKeepalive,
   TcpSocketKeepalive are not API so should be jarjared, but are used
   by ConnectivityManager which is not jarjared, so they are not in the
   same package after the change. Package-private members in the
   former 2 need to be public to be accessible. Changes in this commit
   are all that is needed, as demonstrated by followup commits that move
   the classes to a different package without further changes, and that
   enforce that no class in an API package gets jarjared.

 - framework-connectivity-internal-test-defaults is separated from
   framework-connectivity-test-defaults, for unit tests that need to
   access internal jarjared classes. Such tests need to use the jarjar
   rules themselves too, so this is only appropriate for connectivity
   internal unit tests.

Test: atest ConnectivityCoverageTests CtsNetTestCases
Bug: 217129444
Change-Id: Ied17c3955ea2fda130089265d02908937ad8af1e
2022-05-13 17:30:06 +09:00
Lorenzo Colitti
42791188b2 Merge "Do not remove profile network preference for different uids" 2022-05-09 09:40:52 +00:00
Sewook Seo
047423fd34 Merge "Support QosCallback for UDP socket -Filter" 2022-05-06 20:46:26 +00:00
Sooraj Sasindran
9cc129f37d Do not remove profile network preference for different uids
Multiple enterprise slice can be setup within single user profile based
on different uids. So do not remove profile network preference with same
user profile but with different uids

Bug: 229644102
Test: manual system test and ConnectivityServciceTest
Change-Id: I897b643e01240958fff575de9e15182069efc698
2022-05-06 00:58:33 -07:00
Prerana Patil
a1c6dbbd53 Merge "Update VPN isolation code for excluded routes" 2022-05-03 17:40:12 +00:00
Mark Chien
8e3b96b61f Merge "Fix ConnectivityManager memory leak" 2022-05-03 02:46:05 +00:00
Prerana
2b97bbebf4 Update VPN isolation code for excluded routes
Bug: 230058738
Test: atest LinkPropertiesTest

Result: https://paste.googleplex.com/4706859672928256

Change-Id: I970fca6b0e2cd358e9bd77152563d13367867c74
2022-04-29 22:23:02 +00:00
Treehugger Robot
134d5ec884 Merge "Fix targetSdkVersion gate for EXCLUDED_ROUTES compat change" 2022-04-29 08:57:25 +00:00
markchien
d201566169 Fix ConnectivityManager memory leak
ConnectivityManager have a self reference static instance. This
causes a leak if context is refernce from a static variable. Using
the applicationContext, which will never be freed for the life of the
application, for the sInstance static instance.

Bug: 202978965
Test: atest ConnectivityManagerTest
Change-Id: I87206e1bfbb1f877b5a10f5fdbc25e2f9f11bef4
2022-04-29 08:01:23 +00:00
Taras Antoshchuk
af3c360ed4 Fix targetSdkVersion gate for EXCLUDED_ROUTES compat change
Bug: 230726333
Test: check Developer options > App Compat Changes
Change-Id: Ia80efd07e6a8c6e6cc043411fbc2b56b07b4dd06
2022-04-28 15:47:29 +02:00
Treehugger Robot
8eda07cff7 Merge "Make a defensive copy when sending NetworkInfo change" 2022-04-28 09:29:27 +00:00
Paul Hu
0869af65b4 Make a defensive copy when sending NetworkInfo change
The issue scenario is:
- Telephony registers a network agent and calls markConnected().
- NetworkAgent set mNetworkInfo to CONNECTED and call
  queueOrSendNetworkInfo() with mNetworkInfo, but NetworkAgent
  don't actually send a message to CS yet because the agent is
  not registered.
- Telephony calls unregister because the cellular network is
  disconnected.
- NetworkAgent set mNetworkInfo to DISCONNECTED, overwriting the
  previous CONNECTED state, and then call queueOrSendNetworkInfo
  again with mNetworkInfo. Again this doesn't send any message
  because the agent is not connected.
- EVENT_AGENT_CONNECTED arrives. NetworkAgent replies all the
  messages in mPreConnectedQueue, but NetworkAgent send two
  DISCONNECTED NetworkInfos eventually.

The CONNECTED state should be sent to CS instead of latest state
DISCONNECTED. Thus, make a defensive copy when sending
NetworkInfo change to prevent state overwriting.

Without the NetworkAgent fix, the test will fail with no
onAvailable callback. Because the Network has never been martk as
CONNECTED.

Bug: 228623362
Test: atest FrameworksNetTests CtsNetTestCases
Change-Id: I11681743d3ff87ff9affd0b7e766894dc5111028
2022-04-28 14:57:43 +08:00
Xiao Ma
7d7e7cd1fe Merge "Add a method to create a TAP interface with a given interface name." 2022-04-22 13:10:19 +00:00
Xiao Ma
8bbb8089d7 Add a method to create a TAP interface with a given interface name.
Add a method that allows the caller to specify whether to create a
tap interface with a given specific interface name instead of the
default one. So far only the given name that starts with "v4-testtap"
or "v4-testtun" prefix is allowed. That's helpful to create a clat
interface which always has "v4-" clat prefix in the IpClient integration
test, to verify the callbacks happend on adding/removing clat interface.

Bug: 163492391
Test: atest CtsNetTestCases
Change-Id: I9ea7013fce919cafb719998a123164b5507f9ac0
2022-04-21 16:57:22 +09:00
sewookseo
afc22b02e2 Support QosCallback for UDP socket -Filter
Add matchProtocol() to QosFilter.
Add remoteAddress check to validate().
Add exception EX_TYPE_FILTER_SOCKET_REMOTE_ADDRESS_CHANGED
Don't send ParcelFileDescriptor to QosProvider for security reason

Bug: 203146631
Test: atest & verified on LTE test equipment
Change-Id: I7102ae9ba7cb9e1cc8d06b252aad4dad75860f3e
2022-04-20 22:46:21 +00:00
Taras Antoshchuk
ac8935bee7 Merge "Filter out excluded routes in LinkProperties" 2022-04-13 12:29:24 +00:00
Chiachang Wang
620ea6f1fc Merge "Add protection for setLocalRoutesExcludedForVpn" 2022-04-13 04:19:42 +00:00
Taras Antoshchuk
30d41e59bc Filter out excluded routes in LinkProperties
Gate presence of excluded routes in LinkProperties on target sdk T.

Bug: 186082280
Test: atest LinkPropertiesTest
Change-Id: If8fdb468a0a4968c5f2a878b7aacfeb4f7d9a9e5
2022-04-13 01:17:56 +02:00
paulhu
541b72d03b Add MDnsManager
- Have MDnsManager to manage mdns native service binder call.
- Register it as a system service for NsdService.
- NsdService will use aidl to communicate with mdns, so add the
  relevant lib to framework-connectivity
- Add jarjar rule for mdns-aidl-interface classes.

Bug: 209894875
Test: atest FrameworksNetTests CtsNetTestCases
Change-Id: Ibc8b726c01a15015b450caf94d0afed570117b7f
2022-04-04 15:02:17 +00:00
Sewook Seo
2304205a58 Merge "Support QosCallback with UDP socket" 2022-03-30 20:01:45 +00:00
Lucas Lin
41ed965e68 Merge "Add @RequiresPermission for setUnderlyingNetworks" 2022-03-29 15:34:17 +00:00
markchien
011a7f51c1 Improve JavaDoc for FirewallRule constants
Bug: 226946569
Test: TH
Change-Id: I8366bd58194e24da7ea74bf398aae196482d0151
2022-03-29 12:28:25 +08:00
Treehugger Robot
3d4de57752 Merge "Api review: change updateFirewallRule to setUidFirewallRule" 2022-03-29 03:41:02 +00:00
sewookseo
82657d70d7 Support QosCallback with UDP socket
Add a constructor for QosSocketInfo using DatagramSocket.

Bug: 203146631
Test: atest & verified on LTE test equipment
Change-Id: I85c091a65610a96d721e4f0b07631867cda4db8a
2022-03-29 02:38:05 +00:00
Remi NGUYEN VAN
700ffc994f Merge history of ConnectivityT
Renamed files/directories:
ConnectivityT/service/Android.bp --> service-t/Sources.bp
ConnectivityT/framework-t/Android.bp --> framework-t/Sources.bp
ConnectivityT/framework-t/aidl-export --> framework/aidl-export
ConnectivityT/service --> service-t
ConnectivityT/framework-t --> framework-t
ConnectivityT/tests --> tests
ConnectivityT/OWNERS --> (removed)

BUG: 222234190
TEST: TH
Ignore-AOSP-First: Move with history done per-branch
Merged-In: I81893df9f327abb84f1561b2b33027a2d23a4d65
Merged-In: I67c703e3f7aa9d5787f032a79ed62e45412baf4f
Change-Id: I27a91f1a94f9d807f92762436f533c4b0d0114d5
2022-03-25 11:02:45 +00:00
markchien
3c04e66da0 Api review: change updateFirewallRule to setUidFirewallRule
Bug: 218494748
Test: TH

Change-Id: I52a02ebe109b687359f579c16fded4af3c9cd242
Merged-In: I52a02ebe109b687359f579c16fded4af3c9cd242
2022-03-25 18:49:08 +08:00
Lorenzo Colitti
fbe1576139 Move the DscpPolicy status constants and IntDef to NetworkAgent.
As requested by API council.

Also fix lint errors in the test.

Fix: 217366078
Test: existing tests modified in this CL
Change-Id: I8f7cd0e78bf29aeb52ec6a08a5d635d25fa2205d
2022-03-25 01:06:46 +09:00