Adds checks to ensure that users can only set the correct types of
algorithms for the Authentication, Encryption and Authenticated
Encryption algorithms.
Bug: 65223935
Test: Added tests in IpSecConfigTest, and passed on aosp_marlin-eng
Change-Id: I462c77d9eb5710b8d03a48866453649d3b6fc6bf
Encap sockets are currently created as the system server, and should be
fchown'd to the user for whom it was created on behalf of.
Bug: 62994731
Test: New tests added and run to IpSecService
Change-Id: Icc49e709ae588981e69765fdb77537d7ffbac5fe
Added calls to tag encap sockets to that of the UID for which the encap
socket is being created on behalf of. This ensures that all data
accounting generated for the UDP-encap-ESP socket is correctly billed to
the right UID.
Bug: 62994731
Test: New tests added to IpSecServiceTest.java, passing
Change-Id: I15365ea9c982fd7b4e3cdeff314ddfba2289c86e
A race condition during an Api rename has caused
the name change from reserveSecurityParameterIndex
to allocateSecurityParameterIndex to be wrong in
a test. Fixing.
Bug: 69128142
Test: runtest frameworks-net
Change-Id: I12fb9832cb938dc19f463b1f1124127435d7b173
This is part 2 of 2 of the refcounting refactor for IpSecService
resources.
Switched ManagedResources to use RefcountedResource structure for
managing reference counts and eventual cleanup. Further, resource arrays
and quota management have been aggregated into a UserRecord for better
isolation. UID access checking has been similarly moved into the
UserRecordTracker, and resourceId checking has been rolled into
RefcountedResourceArray's accessor methods.
Bug: 63409385
Test: CTS, all unit tests run on aosp_marlin-eng, new tests added
Change-Id: Iee52dd1c9d2583bb6bfaf65be87569e9d50a5b63
This patch adds (but does not enable the usage of) RefcountedResource
objects to IpSecService, with tests to ensure correct function. This is
patch 1 of a series of patches to refactor the resource management
systems in IpSecService.
RefcountedResource objects allow for management of acyclical dependency
trees, ensuring eventual cleanup when resources are no longer used. This
cleanup may be triggered by binder death or by explicit user action.
Bug: 63409385
Test: New tests written in IpSecServiceRefcountedResourceTest,
explicitly testing the RefcountedResource class
Change-Id: Ib5be7482b2ef5f1c8dec9be68f15e90d8b3aba6d
Throughout the IPsec code (API, system server, netd) we use "reserve"
SPI and "allocate" SPI interchangeably. This renames to use "allocate"
everywhere for self-consistency and consistency with the kernel
(ALLOCSPI).
In javadoc, I am leaving the word "reserve" in several places because it
is still an accurate description of how the method behaves.
Bug: 69128142
Test: TreeHugger should be enough
Change-Id: I8ea603b4612303b0393beef04032671fa53d2106
Also removes netId field from inside NetworkEvent and stop populating
the network_id field of the NetworkEvent field, deprecating it.
Bug: 34901696
Test: runtest frameworks-net,
manually looking at $ adb shell dumpsys connmetrics
Change-Id: I2c36860f976898883714f72f4d18e06da250c6a6
Added notes that keymat length must include 32 bits of salt.
Bug: 68672051
Test: Frameworks-net unit tests & IpSecManager CTS tests run
Change-Id: I0ae0c5be8a45b2374783b3bd1fa8bf930f15e687
This patch changes instrumentation of default networks and default
network events:
- stop logging events for default network transitions,
but instead consistently log one event per continuous segment
when one given network was the default, including logging an
event for when there is no default network.
- keep a separate rolling buffer of DefaultNetworkEvent for
dumpsys and bug reports.
These changes allow to simplify post aggregation of default network
event metrics by removing any need to do time series processing.
Instead, metrics and counters can be implemented withouth any ambiguity
by following the recipe:
% of x = sum(duration | x = true) / sum (all durations)
where x can be various conditions such as:
- the default network was validated
- the default network was WiFi
- the default network was IPv6
- there was no default network
- ...
Most importantly, this new logging scheme allows to measure much more
reliably:
- the % of the time that a device had Internet, in the sense that the
default network was validated.
- the time transitions between default networks, keyed by previous and
new transports/link layer, which allows to derive wakelock durations
and wakelock power costs from default network switches.
This patch also simplifies the dumpsys interface of the connmetrics
service and reduces the commands to three:
- "flush" for metrics upload.
- "proto" for printing buffered event in text proto format.
- "list" for listing all events and statistics.
Bug: 34901696
Bug: 65700460
Test: runtest frameworks-net
Change-Id: I0521f1681a60cca07ac3bfd5741d64ce44de4cdd
The "roaming" state of a network really belongs on NetworkCapabilities
instead of being published through NetworkInfo.isRoaming(). One major
reason is to support developers creating NetworkRequests for a
non-roaming network.
Watch for any capability changes that network statistics are
interested in (either metered or roaming) and notify it to perform
an update pass; fixes bug where we previously only triggered on
roaming changes.
Fix bug in VPNs where metered/roaming capabilities of underlying
networks weren't being propagated; this was probably preventing
some jobs from running over unmetered networks, and causing other
jobs to run over roaming networks! Also passes along link bandwidth
information from underlying networks, and propegates any changes
to underlying networks.
Fix race condition by reading prevNc inside lock. Utility methods
correctly calculate min/max link bandwidth values.
Test: bit FrameworksNetTests:android.net.,com.android.server.net.,com.android.server.connectivity.,com.android.server.ConnectivityServiceTest
Bug: 68397798, 16207332
Change-Id: I3e1a6544c902bf3a79356b72d3616af1fd2b0f49
Replaced null with empty byte array in createTransportModeTransform
for null auth.getKey, crypt.getKey() and authCrypt.getKey()
Test: Ran CTS test
Bug: 68052730
Change-Id: I5110b1297b4bfbb5766e8ecfd3d64f8110b52945
This patch takes advantage of the direct DefaultNetworkMetrics interface
between ConnectivityService and IpConnectivityMetrics and removes the
Parcelable interface from DefaultNetworkEvent.
IpConnectivityMetrics, IpConnectivityEventBuilder and associated tests
are updated as necessary.
Bug: 34901696
Test: runtest frameworks-net
Change-Id: I59b6e04fc126051320d08a422cfbd4d27042123e
This patch extracts the logging of DefaultNetworkEvent from inside
ConnectivityService and move it to a new DefaultNetworkMetrics class.
The DefaultNetworkMetrics is a singleton owned by the
IpConnectivityMetrics singleton implementing the metrics service for
core networking. ConnectivityService has access to this singleton via
LocalServices.
This class layout will allow to remove the Parcelable interface of
DefaultNetworkEvent and will instead let the IpConnectivityMetrics
service grab metrics from the DefaultNetworkMetrics directly.
Bug: 34901696
Test: runtest frameworks-net
Change-Id: I55694d89124272732aba114198776462372de18b
When binding to a random port, the port number was not being
returned, so the user is incorrectly receiving a port of zero.
Return the port number that was ultimately bound.
Bug: 67662580
Test: Ran CTS test on aosp_angler-eng
Change-Id: I22f4e5cdc83d43dc453788889990feb34e451bd3
Allows native AES-GCM-ESP to be used as an IPSec transport/tunnel mode
algorithm with kernel support
Bug: 63589918
Test: IPsecService tests added, existing ones pass
Change-Id: Ie1a9a902be205f269aa37bf956198f2e5b177c21
Although commit 2a84d1cbcf fixed some flakyness issues in
testNetworkCallbackMaximum so that it became stable when ran on its own,
it introduced a new source of random failures because instead of
registering callbacks after callbacks until a limit was reached, commit
2a84d1cbcf changed the test logic to push the assertions right up to
the theoretical limit.
More precisely when registering and unregistering PendingIntents in a
loop, not introducing some delay for checking that previous
PendingIntents have been effectively unregistered can cause the test to
fail. This patch fixes this issue.
Bug: 32561414
Bug: 62918393
Test: runtest frameworks-net
testNetworkCallbackMaximum now succeeds 100 in a row on sailfish
Change-Id: I086817a738ab99fd53ba76ca8faada6151f46472
This patch is a batch of mechanical changes to test classes to migrate
away from AndroidTestCase and TestCase.
Bug: 62918393
Test: runtest frameworks-net
Change-Id: I74134609e511f22c4d9ecd65780e981f9ba7ae3f
Test: Pulled out of a client app ; the client app is behaving
Test: identically to how it was behaving before. Wrote unit
Test: tests in frameworks-net.
Change-Id: I397137748a95c65cee2e1e1b243a1a260e83a6f7
-Split IpSecServiceTest into parameterized
and single tests.
-Add IPv6 parameters
Bug: 66954381
Test: this
Change-Id: Ib98c112560014f73bccc3d2842c31d297c7a07ef
All of the input to IpSecService over the Binder
interface needs to be validated both for sanity
and for safety.
-Sanity check all the parameters coming from binder.
-Added setters for IpSecConfig to decouple the test
from the IpSecManager. This was needed because the
input validation caused the tests to fail due to a
null parameter that was previously un-tested.
-Added the mode flag to the IpSecConfig bundle this
oversight was found during testing.
-Expose the getResourceId() methods for testing in
UdpEncapsulationSocket, SecurityParameterIndex, and
IpSecTransform classes.
-Remove the unneeded getIpSecConfig() from
IpSecTransform: unneeded now that we can synthesize
configs.
Bug: 38397094
Test: runtest frameworks-net
Change-Id: I5241fc7fbfa9816d54219acd8d81a9f7eef10dd4
Registered requests are not keyed by PendingIntents in
ConnectivityService, which means that unregistering a request with a
PendingIntent causes a linear search in all registered requests.
testNetworkRequestMaximum was registering too many PendingIntents
simultaneously, causing the unregistration loop to have n^2
complexity and to take a long time to take effect.
To make the unregistering loop less likely to trigger a timeout on
waitForIdle, this patch changes the test to not register MAX_REQUEST
number of PendingIntent, but instead mixes a small number of
PendingIntents with NetworkCallbacks to reach MAX_REQUEST number of
simultaneously registered requests.
When unregistering these requests, callbacks are unregistered first.
Bug: 32561414
Test: runtest frameworks-net
Change-Id: I48b882c884abe20b388190b7f28baee293446f37
Continuous test dashboards report that quit() can crash sometimes
due to mThread being null.
This patch adds a null guard in tearDown().
Bug: 32561414
Test: runtest frameworks-net
Change-Id: If66fb47e31e77d25b4741a786f12eb78f0b9102e
This only worked on broadcom devices, and was superseded in
M by a wifi HAL call made by IpManager.
Test: bullhead builds, boots
Change-Id: I711cae7dafe171c2c8b4e84a229adbcad27f3d14
On some devices, support for TYPE_ETHERNET is not specified in
the networkAttributes config resource, even though the device is
capable of supporting Ethernet (e.g., via USB host adapters).
This leads to Ethernet working but various connectivity APIs
behaving as if it was not - for example, no CONNECTIVITY_ACTION
broadcasts will be issues when it connects or disconnects.
Ensure that ConnectivityService always treats Ethernet as
available if the service is running. Currently the service is
started if the device supports FEATURE_ETHERNET or
FEATURE_USB_HOST.
Bug: 37359230
Test: bullhead builds, boots
Test: ConnectivityServiceTest passes
Test: Ethernet is available even if removed from networkAttributes resource
Test: ConnectivityManagerTest CTS test passes
Change-Id: I58801bf4f0bbdc3ff6345ec6bfdc911ce045c8ab
