Currently, when a network that uses 464xlat is torn down,
NetworkCallbacks will receive onLinkPropertiesChanged after
onLost. This is confusing and incorrect.
The incorrect callback is sent because handleLinkProperties
checks that the netId of the agent still exists, not that the
NetworkAgent is still registered. This is normally correct,
because the NetworkAgent is removed from mNetworkAgentInfos and
the netId are removed from mNetworkForNetId by the same method,
disconnectAndDestroyNetwork.
In this specific case it's not correct, because the call to
handleUpdateLinkProperties is from disconnectAndDestroyNetwork
itself via nai.clatd.update and calls Nat464Xlat#stop.
No other callers of handleUpdateLinkProperties are affected
because:
- EVENT_NETWORK_PROPERTIES_CHANGED is called only by
maybeHandleNetworkAgentMessage, which first checks that the
NetworkAgent is registered.
- handlePrivateDnsSettingsChanged only looks at registered
NetworkAgents (it loops over mNetworkAgentInfos).
- handlePrivateDnsValidationUpdate, handleNat64PrefixEvent and
handleCapportApiDataUpdate call getNetworkAgentInfoForNetId,
which will correctly determine that the agent is no longer
registered, since they run on the handler thread and thus
cannot run at the same time as disconnectAndDestroyNetwork.
The existing code contains a check for the netId being current.
This is intended to ensure that an update from a NetworkAgent
cannot affect another agent with the same Network. This extra
check is not necessary, because code running on the handler
thread can never observe a NetworkAgent in mNetworkAgentInfos
unless mNetworkForNetId maps that NetworkAgent's Network to that
NetworkAgent. This is because mNetworkForNetId is updated by the
same methods as mNetworkAgentInfos, and those updates occur on
the handler thread. So all code on the handler thread will see
those two as consistent.
Bug: 176496580
Test: atest FrameworksNetTests CtsNetTestCases HostsideVpnTests
Original-Change: https://android-review.googlesource.com/1727829
Merged-In: I944f4c6ad36206bdccd85a6ea7ef71324a29c685
Change-Id: I944f4c6ad36206bdccd85a6ea7ef71324a29c685
Ensure that NetworkCallbacks and netd operations are accounted
for. Also add a test for the spurious onLinkPropertiesChanged
callback that is currently send out after onLost.
Bug: 176496580
Test: atest ConnectivityServiceTest
Original-Change: https://android-review.googlesource.com/1729093
Merged-In: I69cf58bc87dfe55ea359a2cd76167d03fe2c953d
Change-Id: I69cf58bc87dfe55ea359a2cd76167d03fe2c953d
- Add default network priority to NetworkRequestInfo.
- The default network priority value is used when issue uid
ranges rules to netd. Netd will use the priority value and uid
ranges to generate corresponding ip rules specific to the given
network preference.
Bug: 171872461
Test: atest FrameworksNetTests
Ignore-AOSP-First: Needs cherry-picks
Change-Id: I0ea71b348492aeb4784d487bed4cfd5d387426ba
- Add more tests for mobile data preferred uids.
- Also address leftover comments on implementation commit.
Bug: 171872461
Test: atest FrameworksNetTests
Ignore-AOSP-First: Needs cherry-picks
Change-Id: I63f65bffc1b8883ddfd774222e26e629d7ea1f94
When private DNS setting was set to opportunistic (mode) and null
(hostname), CtsNetUtils would not restore it.
Make sure that private DNS settings are restored after every test. Also
fail if restore is called without having saved any setting beforehand.
Bug: 190465704
Test: atest CtsNetTestCases
Original-Change: https://android-review.googlesource.com/1729162
Merged-In: Ic5d8d8b729469e0eef89a0b53f166e604264c1ee
Change-Id: Ic5d8d8b729469e0eef89a0b53f166e604264c1ee
This commit:
- Verify AES-CMAC is supported in device that first
launched with SDK beyond R
- Verify IpSecTransforms can be built with AES-CMAC and
traffic flows
Bug: 171083832
Test: atest IpSecManagerTest
Test: AES-CMAC tests are manually enabled and verified
Change-Id: I00d1aa475033810a5f60f0e3fc692be87ff62e13
Merged-In: I00d1aa475033810a5f60f0e3fc692be87ff62e13
(cherry picked from commit 0891de6311)
This CL adds CTS tests that:
- Verify IpSecAlgorithm#getSupportedAlgorithms
- Verify new algorithms are supported in device that first
launched with SDK beyond R
- Verify IpSecTransforms can be built with new algortihms and
traffic flows
Since there is no hardware that first launched with SDK beyond R
at the time of writing this CL, tests for new algorithms were
manually enabled and verified on the pixel with an updated kernel.
Bug: 171083832
Test: atest IpSecManagerTest
Change-Id: Icffbe67fca29b051457dbf863ba3aaf653806a83
Merged-In: Icffbe67fca29b051457dbf863ba3aaf653806a83
(cherry picked from commit 5e692b6ca7)
This CL updates ConnectivityDiagnostics permission checks in
ConnectivityService to only require location permission for Networks
that have TRANSPORT_WIFI. This change is consistent with the location
restrictions required for the transports themselves. Previously,
location permissions were required for all Network types.
Bug: 187310575
Test: atest ConnectivityServiceTest ConnectivityDiagnosticsManagerTest
Change-Id: I48806533e4e705d2d9be45f3b3d3931d9294b167
Merged-In: I48806533e4e705d2d9be45f3b3d3931d9294b167
(cherry picked from commit 0990af5148)
Bug: 186061922
Test: atest CtsNetTestCases:android.net.cts.ConnectivityManagerTest
Test: atest CtsNetTestCasesLatestSdk on R and S device
Merged-In: I5d3e448ed00b9baeb64a08036ecac1f9c8206cc7
Change-Id: I5d3e448ed00b9baeb64a08036ecac1f9c8206cc7
The existing isWifiTetheringSupported only check if tethering side
supports wifi tethering or not but not wifi side. A expected
behavior should include both of them, so add the wifi side check
into the helper function. Also update in the existing caller side
due to a new parameter added.
Bug: 186061922
Test: atest MtsTetheringTestLatestSdk
Megred-In: Id69ac1d30ab2bbf23e870193335b139f54672636
Change-Id: Id69ac1d30ab2bbf23e870193335b139f54672636
Ignore-AOSP-First: cherry-pick
Now, PermissionMonitor reigster observer to listen the change
from all users, but "uids allowed on restricted networks" should
affect to all users instead of per each user. Thus, move the
setting from Settings.Secure to Settings.Global.
Bug: 189705071
Test: atest FrameworksNetTests
Ignore-AOSP-First: Need cherry-pick
Change-Id: Ibea354d8dda1f02652a193820f3f9eb573b9a956
In an effort to make reviewing easier, this implements most of
the infra but only a mostly trivial test.
Ignore-AOSP-First: NetworkScore incomplete in AOSP
Bug: 184037351
Test: this
Change-Id: Ibb9139798ce44d748e87bae79a1e23311ec8d9b6
As API review feedback, setting allowed on restricted networks
should be by uid instead of package name for security reason.
Thus, update the getter/setter to return/accept set of uids.
Bug: 188085693
Test: atest FrameworksNetTests
Ignore-AOSP-First: Needs cherry-picks
Change-Id: I979bf98075e6c9c0ed7e891582843fddb62643cb
It's a follow up of aosp/1652210.
The tests may verify partial NetworkAgent callback behavior.
The existing expectCallback will always expect to see the first
callback in the callback queue, so if tests did not verify all
the happened callback. It cannot verify the callback after
unregister. Add eventuallyExpect to wait for a target callback
and skip the disinterest ones, and verify the unregister
behavior for NetworkAgent callback in one method.
Bug: 178725261
Test: atest android.net.cts.NetworkAgentTest
Change-Id: I66d8e5a0fa1e2245711e8ac90d9daca24802e399
Merged-In: I66d8e5a0fa1e2245711e8ac90d9daca24802e399
(cherry picked from commit 12a6422f47)
This commit allows IKEv2/IPsec VPN to propose more algorithms that
newly added in IpSecAlgorithm. Those new algorithms have stronger
security guarantees and better performances.
This commit also removes algorithm name validation because all
algorithms are URL encoded to ensure no special characters create
problems due to their use by VpnProfile for list or field delimiting
(e.g. rfc7539esp(chacha20,poly1305))
Bug: 185265778
Test: atest FrameworksNetTests, CtsNetTestCases
Test: All new algorithms are manually verified
Change-Id: I1de322c95aacc8924e95bcdbcfdbd1ec441de99c
Merged-In: I1de322c95aacc8924e95bcdbcfdbd1ec441de99c
This CL updates ConnectivityService to check location permissions for
ConnectivityDiagnostics callbacks last in the permission check process.
This minimizes misattribution of location access for networks that an
app is not administering.
This CL also updates ConnectivityDiagnosticsManager documentation to
clearly state that location permissions are required in order to receive
callbacks.
Bug: 187310575
Test: atest ConnectivityDiagnosticsManagerTest
Test: atest ConnectivityServiceTest
Change-Id: I2dbeddac6273e2392ccaeae51a1c7776d6d3da75
Merged-In: I2dbeddac6273e2392ccaeae51a1c7776d6d3da75
(cherry picked from commit f3d0fc49db)
