Commit Graph

793 Commits

Author SHA1 Message Date
Motomu Utsumi
1d9054ba5f Add 3rd deny firewall chain for OEM
Bug: 208371987
Test: atest
CtsNetTestCases:android.net.cts.ConnectivityManagerTest#testFirewallBlocking
ConnectivityServiceTest

Change-Id: Ib521fa02f6a19270cb88a3d85321bda822516c78
2022-06-06 07:47:35 +00:00
Aaron Huang
f4f5de3993 Hold wifi and mobile interfaces since boot in NetworkStatsService
In current design, the interface will be removed from the list if
the network disconnected which will cause getUidStatsForTransport()
returns unexpected snapshot to caller since the list is empty.

This change also remove interface name from all entries before
the method returns the result.

Bug: 231514741
Test: FrameworksNetTests
      manual test
Change-Id: Ie60829a65d0d9b5b63ad353695a820c0586e3665
Merged-In: Ie60829a65d0d9b5b63ad353695a820c0586e3665
2022-06-06 13:19:11 +08:00
Treehugger Robot
6d0b34ecb3 Merge "ClatCoordinatorTest: add test for startClat error handling" 2022-06-03 15:17:10 +00:00
Treehugger Robot
1076248194 Merge "ClatCoordinatorTest: add testDump" 2022-06-03 15:17:06 +00:00
Lorenzo Colitti
337d512081 Merge changes from topic "remove-ethernet-shims"
* changes:
  ethernet: add test for tethered interface callbacks
  ethernet: stop using EthernetManager shims
  ethernet: broadcast state change for server interfaces
  ethernet: increase timeout to deflake tests
2022-06-03 11:51:58 +00:00
Motomu Utsumi
181f7c85fc Merge "Add deny firewall chain for OEM" 2022-06-03 11:06:02 +00:00
Motomu Utsumi
d980149817 Add deny firewall chain for OEM
Bug: 207773349
Bug: 208371987
Test: atest
CtsNetTestCases:android.net.cts.ConnectivityManagerTest#testFirewallBlocking
--iterations 50 && atest ConnectivityServiceTest --iterations 10

Change-Id: I60d5540821abcced03356f366775f16ee369d7f9
2022-06-03 09:10:57 +00:00
Patrick Rohr
f33f276b29 ethernet: broadcast state change for server interfaces
Also update the test to ensure mFactory.hasInterface is mocked to match
mFactory.getInterfaceState: previously it would be called by the factory
in the mocked getInterfaceState, but the new code calls it directly.

Bug: 171872016
Test: atest EthernetManagerTest
Change-Id: I9ac959f181c88a7992991923b98a836f2833fa88
2022-06-03 16:56:39 +09:00
lucaslin
802fa5d0ec Verify if the VPN app has been added into power save whilte list
Bug: 234104087
Test: atest FrameworksNetTests:VpnTest
Change-Id: I2aa99b8ea8dbe668a45782f50a4a0ac82e72b7a2
2022-06-02 20:19:09 +00:00
Hungming Chen
b7bbdbebc6 ClatCoordinator: improve file descriptor clean up in error handling
- Make the file descriptor clean up better when an error happens.
- Remove unused TODO for iptables because it has been
  implemented by another approach. See b/218407445.

Test: atest com.android.server.connectivity.ClatCoordinatorTest
Change-Id: Ib8bfa8875ae774769ab7e416fa7e5fde140f58da
2022-06-02 18:37:15 +08:00
Hungming Chen
171377450f ClatCoordinatorTest: add test for startClat error handling
Used to increase mainline test code coverage for startClat()
which has bunches of code for unwinding the native method failure.

For now, code coverage for startClat(): 51.89% (55/106 lines)

Test: atest com.android.server.connectivity.ClatCoordinatorTest
Change-Id: I398d5863359ff329b06966488053edd9006f17aa
2022-06-02 15:20:14 +08:00
Hungming Chen
af5c235cfc ClatCoordinatorTest: add testDump
Used for verifying the dump content and increasing test coverage.

The test coverage for now:
dump:           0% (0/7 lines)
dumpBpfEgress:  0% (0/13 lines)
dumpBpfIngress: 0% (0/13 lines)

Test: atest com.android.server.connectivity.ClatCoordinatorTest
Change-Id: I5e444e95d50f7ca266555139b3639723773fd83d
2022-06-02 15:20:09 +08:00
Xiao Ma
c0e80ee9f9 Merge "Add IpConfigStore testcase to improve the code coverage." 2022-06-01 07:47:07 +00:00
Xiao Ma
b4a8fd534a Add IpConfigStore testcase to improve the code coverage.
Add new testcase in IpConfigStoreTest to cover the readIpConfiguration
usage, improve the code coverage for connectivity module.

To reduce the flakyness of test, this cl refactors DelayedDiskWriter
constructors by allowing to pass in a Dependencies instance, then
waitForIdle can be used to check if the delayed write operation
associated with the passed-in HandlerThread has completed in tests.

Bug: 234315786
Test: atest com.android.server.net.IpConfigStoreTest
Change-Id: I57c8bd02a771f1cca815252ba502cda0210d1385
2022-06-01 14:47:47 +09:00
Chiachang Wang
c0b2b37faa Merge "Add test coverage for ConnectivityService.dump with arguments" 2022-06-01 05:41:50 +00:00
Remi NGUYEN VAN
5eaefa21bf Merge "Fix service resolve on tethering downstreams" 2022-06-01 05:31:14 +00:00
chiachangwang
9673c4ddad Add test coverage for ConnectivityService.dump with arguments
Test: atest FrameworksNetTests
Change-Id: I389ef6e89a7570cb3e7f8cedab48517c25c4c0b0
2022-06-01 03:58:25 +00:00
Natasha Lee
bcdb3c12ee Merge changes from topic "stats-migration"
* changes:
  Skip PersistentIntTest on S- device
  Don't clobber existing history entries.
  Ensure NetworkStats migrated snapshot is identical
  [MS82.1] Support network stats data migration process
  Add a PersistentInt class.
2022-06-01 03:03:02 +00:00
Remi NGUYEN VAN
1a8ee102d3 Fix service resolve on tethering downstreams
Tethering downstreams do not have NetworkAgents, and although they have
a netid of 99, Networks with netId 99 are not usable by apps for most
connectivity APIs.

Recent refactoring in NsdService adds the Network of a found service
into its NsdServiceInfo, and uses that network to resolve the service.
In that case the Network has netId 99 and resolving the service fails.

Avoid that problem by:
 - Keeping the Network field null when a service is found on a tethering
   downstream; this avoids giving apps a confusing and unusable Network
   with netId 99
 - Using the interface index found during discovery to resolve the
   service, if the app uses the NsdServiceInfo that was obtained from
   discovery to resolve. If not, all interfaces will be used to resolve,
   as per legacy APIs.

Bug: 233979892
Test: atest NsdServiceTest
      Also manual test with 2 devices connected via hotspot
Change-Id: Idd176153b67ccbd1d4f1b1fd66dafaa2f3a9e27a
2022-05-31 13:06:22 +09:00
Treehugger Robot
019e6eb2d7 Merge "Fix crash when decrementing data usage request" 2022-05-27 10:02:33 +00:00
Junyu Lai
a1970dafa1 Fix crash when decrementing data usage request
When unregistering, if the caller process is dead. The system
can unregsiter for the caller. But the request decrement should
be counted onto the caller uid instead of system uid.

Test: NetworkStatsObserversTest#testUnregister_knownRequest_invalidUid_doesNotUnregister
Bug: 233580307
Change-Id: I85aee8f395739929bc7086883ace81ac1ecd0730
Merged-In: I85aee8f395739929bc7086883ace81ac1ecd0730
  (pure cherry-picked from ag/18579047)
2022-05-27 09:50:52 +00:00
Paul Hu
516d5dc0ea Add some non-connectivity-module-test back to ConnectivityCoverageTests
In S, the tests are listed in the non-connectivity-module-test
where their testing files are not in the connectivity module.
But some files move into the connectivity module in T. So some
tests can be removed from non-connectivity-module-test and will
be running on ConnectivityCoverageTests to count their code
coverage.

Also update some tests to make them compatible with
mockito-extended and ignore some tests which need to test with
T apis.

Bug: 234000451
Test: atest FrameworksNetTests ConnectivityCoverageTests
Change-Id: I47fb59334d00ae7fee91c5694548b3cf89b09b2d
2022-05-27 07:16:46 +00:00
Patrick Rohr
345655f7bc Merge "Remove automotive restriction from enable/disableInterface" 2022-05-25 02:00:51 +00:00
Motomu Utsumi
badf2ebed7 Merge "Skip VPN filtering tests on unsupported versions" 2022-05-25 01:22:16 +00:00
Motomu Utsumi
ca314e7f77 Skip VPN filtering tests on unsupported versions
Lockdown filtering rule and interface filtering rule with null interface
were introduced to T+ devices.
So, skip related tests in pre-T devices.

Bug: 232902954
Test: atest ConnectivityServiceTest
Change-Id: I9ee76096c1bd04c9333bc561ffc8064a14780ce5
2022-05-24 13:41:36 +00:00
Patrick Rohr
fd829a5cb2 Remove automotive restriction from enable/disableInterface
Allow calling enable/disableInterface on non-automotive devices. Also,
fixing the naming of these functions to be consistent with the API.

Test: atest EthernetManagerTest
Bug: 171872016
Bug: 225317990
Change-Id: Ic20185a855d0e639582132bf1103e0183f6f78c3
2022-05-24 03:54:38 +00:00
Junyu Lai
1190ea3eb7 Skip PersistentIntTest on S- device
This class is only used in the service runs on T+ devices.
Thus run this test on S- device does not make senses.

Bug: 230289468
Test: atest ConnectivityCoverageTests:PersistentIntTest
      on S device
Change-Id: I97a29df17ef9ee9ab373655f045cdb5c820e06ef
Merged-In: I97a29df17ef9ee9ab373655f045cdb5c820e06ef
  (pure cherry-picked from ag/18486287)
2022-05-24 11:38:20 +08:00
Lorenzo Colitti
ec2fbb7159 Don't clobber existing history entries.
Currently, adding a history to a NetworkStatsCollection.Builder
will overwrite any history that was previously passed in with the
same key. This breaks the importer (which is the primary/only
caller of this code), because the importer re-uses the same
NetworkStatsCollection object to import multiple files.

Instead, simply add any passed-in entries after the ones that
were already there. Require the caller to pass in entries in
order, because NetworkStatsHistory internally assumes that
entris are always sorted.

Bug: 230289468
Test: manually verified this unbreaks the importer
Change-Id: Ic8647ff28fca78d579d5f759f96a864877f8158b
Merged-In: Ic8647ff28fca78d579d5f759f96a864877f8158b
  (pure cherry-picked from ag/18453213)
2022-05-24 11:37:42 +08:00
Remi NGUYEN VAN
c62261f140 Ensure NetworkStats migrated snapshot is identical
Read migration snapshot both from the platform API and the legacy
method, and Log.wtf if they are different. Use the legacy method data if
they are.

This ensures that using the migration API is a no-op, and that errors
are reported (through Log.wtf) if it would not have been if used as-is.

Test: NetworkStatsServiceTest
Bug: 230289468
Change-Id: I857ad18183d63d1aa16e89f89eb24009648720a2
Merged-In: I857ad18183d63d1aa16e89f89eb24009648720a2
  (pure cherry-picked from ag/18452103)
2022-05-24 11:37:12 +08:00
Junyu Lai
a388d4bf06 [MS82.1] Support network stats data migration process
This includes:
1. Provide NetworkStatsRecorder#importCollectionLocked to
   allow caller to write a NetworkStatsCollection object to
   a standalone file.
2. Do not clear the collection in NetworkStatsRecorder#
   CombiningRewriter, this is safe since pending set will
   still be cleared during forcePersistLocked.
3. Implement the migration process, including recovery and
   safety measures.

Test: NetworkStatsServiceTest NetworkStatsCollectionTest
Test: manual test with
      adb shell device_config put tethering \
      netstats_store_files_in_apexdata true
      adb shell device_config put tethering \
      netstats_import_legacy_target_attempts 1
Bug: 230289468
Change-Id: Ic2002cbfd5a6b3c2226fa8dab22481f8ce656574
Merged-In: Ic2002cbfd5a6b3c2226fa8dab22481f8ce656574
  (pure cherry-picked from ag/18367994)
2022-05-24 11:36:36 +08:00
Lorenzo Colitti
2ce66fc8e6 Add a PersistentInt class.
This implements a simple integer written to disk backed by
AtomicFile.

Bug: 230289468
Test: new unit test
Change-Id: I1c73c8ac2429f92153cfba3b006b4374e75e65df
Merged-In: I1c73c8ac2429f92153cfba3b006b4374e75e65df
  (pure cherry-picked from ag/18437645)
2022-05-24 11:35:58 +08:00
Patrick Rohr
826bdb3ec4 Merge changes I8e806b3b,I5e8e4673,Id2a078da
* changes:
  Add CTS tests for EthernetNetworkProvider changes
  Move EthernetNetworkFactory to using the NetworkProvider API
  Improve waiting for interface added or removed
2022-05-24 03:34:25 +00:00
Patrick Rohr
daca9ca74f Move EthernetNetworkFactory to using the NetworkProvider API
This CL makes EthernetNetworkFactory inherit from NetworkProvider rather
than NetworkFactory. The name of the class is purposefully unchanged to
make the code review easier (it will be changed to
EthernetNetworkProvider in a follow up).

As part of the conversion, NetworkInterfaceState now registers a
NetworkOffer when the link comes up and unregisters it when the link
goes down. It updates the existing offer when capabilities change (by
calling registerNetworkOffer with an already registered
NetworkOfferCallback).

This change should fix existing refCount issues. When a NetworkOffer is
first registered, it receives callbacks for all existing requests. This
is the main problem with the NetworkFactory implementation where only
one NetworkOffer is registered when the factory is first created; so
when interfaces come up, they do not receive callbacks for existing
requests.

Test: atest EthernetNetworkTest
Bug: 197548738
Change-Id: I5e8e4673d2ed04bc1a0c8d232a8772edfff65b5d
2022-05-23 15:07:36 -07:00
Yan Yan
5345fa1144 Merge "Throw IAE when Network's LinkProperties is null" 2022-05-23 17:24:07 +00:00
Yan Yan
be3eb3d56a Throw IAE when Network's LinkProperties is null
Improve the setUnderlyingNetwork method by throwing IAE
when Network's LinkProperties is null. Also update the
API doc to give caller more guidance in using this API

Bug: 232309601
Test: UT: IpSecServiceParameterizedTest, IpSecServiceTest,
      IpSecServiceRefcountedResourceTest, IpSecManagerTest, VpnTest
Test: CTS: IpSecManagerTest, IpSecManagerTunnelTest, Ikev2VpnTest
Test: make doc-comment-check-docs
Change-Id: Idab4706b0db42ed2222fb48b168589ed005d2f2f
2022-05-20 17:03:07 -07:00
Xiao Ma
56c6392586 Merge "Move ipconfig file inside apex data directory" 2022-05-20 05:43:40 +00:00
Patrick Rohr
47641d75d9 Move ipconfig file inside apex data directory
In order to support rollbacks, the ethernet ipconfig file needs to be
written to the data apex's data directory. We still need to support
reading from the legacy location to be backwards compatible.

If the apex file path already exists, then read the IP configuration
from there directly, otherwise, check if the legacy file path exists,
if yes, read the legacy IP configuration and copy it to the new apex
file path.

Support for default IpConfiguration is also being removed in this CL.
The default IpConfiguration (configuration entry for interface "0")
was a way to transition from supporting a single interface to
supporting multiple interfaces and was introduced in P. Every device
that has used such a configuration and has connected to an ethernet
network since upgrading to P+ has already removed the "0" config and
has assigned it to the first interface (probably "eth0"). There has
never been an API to set this, but if someone wanted to install a
default IpConfiguration, they could just configure "eth0" instead.

Bug: 224919694
Test: atest EthernetConfigStoreTest --iterations
Test: manually test
      - adb push <fake ipconfig.txt> /data/misc/ethernet/
      - adb reboot
      - read the IP config from legacy path and the same config
        file is created in the apex file path
      - adb reboot
      - read the IP config from the apex file path directly
Change-Id: Ifb82a5d7fa13d17ea8fd3a42a19cd020cb95e26a
2022-05-20 09:20:54 +09:00
Treehugger Robot
36cae536f0 Merge "Changing automotive ethernet allowed UIDs check" 2022-05-19 13:29:16 +00:00
James Mattis
4eff0efb57 Changing automotive ethernet allowed UIDs check
Updating the automotive allowed UIDs check to only work if the
capabilities have a single transport equal to ethernet.

Bug: 229419469
Test: atest FrameworksNetTests
Change-Id: I91e987d6b943a3c5986ab88553a6eef0d479b079
2022-05-18 22:18:14 -07:00
Xiao Ma
94a00dfc64 Fix the ethernet setting API bug.
After turning off the ethernet settings via api, the ethernet service
can still be started when plugging-in the cable. Improve the api by
ignoring the upcoming interface unsolicited event listener callbacks
and register new interface observer once the ethernet setting is enabled
again.

Bug: 231933028
Test: atest testListenEthernetStateChange_unsolicitedEventListener
Change-Id: I1b1cb7d157f023fca82d75592168bd360a6fa6e1
2022-05-18 17:23:32 +09:00
James Mattis
46491d7546 Allow ethernet on automotive to set allowed UIDs
Allow ethernet factories on automotive devices to set the allowed UIDs
on NetworkCapabilities.

Bug: 229419469
Test: atest FrameworksNetTests
Change-Id: I03e7cda75f1c530e0d0e4a756330bc9847a96668
2022-05-17 15:32:13 -07:00
Motomu Utsumi
b08654ca04 Block incoming packets in VPN Lockdown mode.
Currently, even when VPN Lockdown mode is enabled, incoming packets are
not dropped if VPN is not connected.

This commit fixed this issue.
After this commit, If VPN Lockdown mode is enabled, incoming packets
are dropped regardless of the VPN connectivity.

Bug: 206482423
Test: atest TrafficControllerTest ConnectivityServiceTest PermissionMonitorTest
Change-Id: If52ece613c8aac1073355e43b6fb9cb3fcc87d1d
2022-05-16 10:40:59 +00:00
Junyu Lai
ac557274c1 Merge "[MS81] Support remove history before cutoff timestamp" 2022-05-13 22:40:32 +00:00
Junyu Lai
fc938cf026 Merge "Limit data usage request per uid" 2022-05-13 09:06:41 +00:00
Nucca Chen
f889ed7a30 Merge changes from topic "wrap_fd_to_parcelfiledescriptor"
* changes:
  Catch new exceptions from BpfMap
  Revert "Open and close clat bpf map while clat is starting and stoping"
  Revert "ClatCoordinator: replace BpfMap with IBpfMap"
2022-05-12 13:42:23 +00:00
Junyu Lai
306a00316c [MS81] Support remove history before cutoff timestamp
This is needed to ensure corrupted data can be clean up if
the data migration process dones't go well.

Test: NetworkStatsCollectionTest
Bug: 197717846
Change-Id: Ic76ad6f3e96f03791b48988fb2622c9c647ffc7c
2022-05-12 16:31:39 +08:00
Martijn Coenen
021d8b08c1 Modify VPN unit tests to include SDK sandbox UIDs.
VPN configurations in T should automatically include the corresponding
SDK sandbox UID of an application.

The existing tests used a UID range outside the regular application
range, which means the new sandbox UIDs wouldn't be tested. Modified the
UIDs to run in the regular UID range of [10000, 19999]. Changed the
tests to include the SDK sandbox UID where necessary.

Also, changed the entire class to only run on T+, since that is the only
place where the SDK sandbox UIDs will be added. Since VPN code is not
mainline updatable, having coverage on earlier releases doesn't really
help anyway.

Finally, fixed up testNetworkBlockedStatusAlwaysOnVpn() in
ConnectivityServiceTest to include the sandbox UIDs as well.

Bug: 225317905
Test: atest VpnTest
Test: atest ConnectivityServiceTest

Change-Id: I83009344c270e520ac8ad1558c067cf7e46b1d2e
2022-05-12 08:07:29 +00:00
Chiachang Wang
68936325f0 Merge "Address leftover comments" 2022-05-12 06:06:40 +00:00
Chiachang
a023f88193 Address leftover comments
This is a follow-up commit from aosp/2076483. Mainly to update:
1. Update the hex string to human understandable code instead of
   byte code.
2. Use IgnoreUpTo() to do the SDK check
3. Avoid relying on the code being tested

Bug: 192078259
Test: atest FrameworksNetTests
Change-Id: I8973d248a1d30fdcb597677dbf051e146041f905
2022-05-12 02:50:22 +00:00
Junyu Lai
f3c946278c Limit data usage request per uid
Currently, there is no limtation for an app to request
data usage callback, which is dangerous if the app fire
hundreds of thousands requests and potientially this might
cause OOM if the apps don't free them.

Test: atest NetworkStatsObserversTest#testRegister_limit
Bug: 229103088
Change-Id: I8299f46fd47a82ec9b25ba2e0d3c95db5512c331
2022-05-12 08:53:21 +08:00