Commit Graph

2197 Commits

Author SHA1 Message Date
Patrick Rohr
bbef873e3e Merge changes from topic "restricted-networking-mode" am: 1d156cb04e am: 83711b9a0b am: 5fda0bd0af
Original change: https://android-review.googlesource.com/c/platform/frameworks/base/+/1505234

Change-Id: Ia175efd2e152ea4b04feddf3bdc159adca2edab5
2020-12-03 12:39:44 +00:00
Patrick Rohr
66978d1090 Clean Up NetworkManagementService Tests am: e7c4a3e7b5 am: 34d43318e1 am: 9653c209c6
Original change: https://android-review.googlesource.com/c/platform/frameworks/base/+/1505233

Change-Id: I24c7401ae08da82ad8e03db1b507abe50e92dd1b
2020-12-03 12:39:27 +00:00
Patrick Rohr
34d43318e1 Clean Up NetworkManagementService Tests am: e7c4a3e7b5
Original change: https://android-review.googlesource.com/c/platform/frameworks/base/+/1505233

Change-Id: Ia14b1784f36d54f0ba73d5841afedcf8a55a18f2
2020-12-03 11:36:15 +00:00
Patrick Rohr
1d156cb04e Merge changes from topic "restricted-networking-mode"
* changes:
  Add Restricted Mode Firewall Chain
  Clean Up NetworkManagementService Tests
2020-12-03 10:50:25 +00:00
Remi NGUYEN VAN
f6271f533e Merge "Do not query CS in NetworkProvider constructor" am: 6a6e5f8479 am: 0d1b3960e8 am: bcd4d930bc
Original change: https://android-review.googlesource.com/c/platform/frameworks/base/+/1512873

Change-Id: I194f6fed28011702dd86676e5aa422129a903d9c
2020-12-03 03:47:02 +00:00
Remi NGUYEN VAN
6a6e5f8479 Merge "Do not query CS in NetworkProvider constructor" 2020-12-03 01:48:01 +00:00
Lorenzo Colitti
d58b4ea78c Merge changes Ic5a3e169,I76daa3ab am: fac6ce5e4d am: 642fe3bb2b am: 4a0fe09eec
Original change: https://android-review.googlesource.com/c/platform/frameworks/base/+/1512888

Change-Id: If54ea6526d4426e6e52eec40c72f3ddd625842fe
2020-12-02 06:42:39 +00:00
Lorenzo Colitti
fac6ce5e4d Merge changes Ic5a3e169,I76daa3ab
* changes:
  Refactor applyUnderlyingCapabilities and its test.
  Move applyUnderlyingCapabilities to ConnectivityService.
2020-12-02 04:55:12 +00:00
Lorenzo Colitti
8750be0016 Refactor applyUnderlyingCapabilities and its test.
This reduces verbose assertions and makes the test more compact.
I'm not sure whether it's actually more valuable, since the
current code, while more verbose, is probably more
straightforward to understand.

Also add a test for passing in a null underlying network (i.e.,
follow default network). This requires a minor refactoring in
ConnectivityService because the applyUnderlyingCapabilities does
not currently treat null specially.

Bug: 173331190
Test: test-only change
Change-Id: Ic5a3e16969ea9e1a529706850f148cb0d5fd8e09
2020-12-02 00:45:57 +09:00
Lorenzo Colitti
cd6d42bd1e Move applyUnderlyingCapabilities to ConnectivityService.
This is essentially a straighforward move of code from Vpn to
ConnectivityService, and from VpnTest to ConnectivityServiceTest.

Bug: 173331190
Test: passes existing tests, moved tests pass
Change-Id: I76daa3abcc777e9c3ba57efb750de0e2e2f3bb74
2020-12-01 23:23:47 +09:00
Felipe Leme
ed14cda477 Deprecated UserManager.getUsers(excludeDying) / added getAliveUsers()
The existing method is confusing (the argument used to be called
includeDying) and it puts the burden on the caller (which need to
understand what the parameter means).

Furthermore:

- The majority of calls are for getUsers(excludeDying=true).
- The calls for getUsers(excludeDying=false) are equivalent to
  calls to getUsers()

Test: m
Test: a VpnTest ConnectivityServiceTest PermissionMonitorTest

Bug: 157921703
Change-Id: Ife767a40b7b7790ba28b5377046de822ddbf275c
Merged-In: Ife767a40b7b7790ba28b5377046de822ddbf275c
(cherry picked from commit 72eeb557e7)
2020-12-01 15:25:52 +08:00
Remi NGUYEN VAN
f5417ce9b6 Merge "Run OemNetworkPreferencesTest with DevSdkIgnoreRunner" am: 8384c693d1 am: 5bfbc47c2c am: 8a30831e98
Original change: https://android-review.googlesource.com/c/platform/frameworks/base/+/1512665

Change-Id: Id5562e4d66f50a0c2ee9d863982f38523c5602b7
2020-12-01 02:43:58 +00:00
Remi NGUYEN VAN
8384c693d1 Merge "Run OemNetworkPreferencesTest with DevSdkIgnoreRunner" 2020-12-01 01:33:42 +00:00
Patrick Rohr
7146229936 Add Restricted Mode Firewall Chain
Adding new allowlist firewall chain to support restricted networking
mode. See go/restricted-networking-mode.

Bug: b/157505406
Bug: b/170323408
Test: atest NetworkManagementServiceTest
Change-Id: I8e39b3d7b129ad74224d0c1311135b7b48f6514f
2020-11-30 18:36:02 +01:00
Patrick Rohr
e7c4a3e7b5 Clean Up NetworkManagementService Tests
Cleaning up tests, so I can easily add more for restricted networking
mode.
I merged the NetworkManagementInternalTests with the
NetworkManagementServiceTests.

Test: atest NetworkManagementServiceTest
Change-Id: If8c3cc1883cfb2524eeb78e23165fc868130f0e7
2020-11-30 18:35:44 +01:00
Lorenzo Colitti
c1e4f02f37 Merge changes If2201f39,Ia1c366c5 am: fd0e9821fb am: 95e7eba65a am: 8ff435aced
Original change: https://android-review.googlesource.com/c/platform/frameworks/base/+/1509889

Change-Id: Ic2857aae38dfa7ccf9996689e198f9e175045462
2020-11-30 15:59:20 +00:00
Lorenzo Colitti
c8f90ba551 Merge changes I982543cd,I41c3bf6c,Id3e5f6e1 am: 4fe79a3ff9 am: db7c229729 am: d5450e378b
Original change: https://android-review.googlesource.com/c/platform/frameworks/base/+/1511316

Change-Id: I91ccdc9a5f4426d9c1623b869c0411b9af203c36
2020-11-30 15:05:48 +00:00
Lorenzo Colitti
fd0e9821fb Merge changes If2201f39,Ia1c366c5
* changes:
  Stop calling Vpn#updateCapabilities in CS.
  Stop accessing VPNs in checkConnectivityDiagnosticsPermissions.
2020-11-30 14:14:38 +00:00
Lorenzo Colitti
4fe79a3ff9 Merge changes I982543cd,I41c3bf6c,Id3e5f6e1
* changes:
  Add a provider to VPN
  Small VPN cleanup
  Migrate VPN to the public NetworkAgent API.
2020-11-30 13:48:26 +00:00
Chalard Jean
8c7cb6449c Add a provider to VPN
Test: FrameworksNetTests NetworkStackTests
Change-Id: I982543cdee358bb62d3b56a7fd9d71dc18908b65
2020-11-30 16:15:19 +09:00
Chalard Jean
fd64bac5b6 Migrate VPN to the public NetworkAgent API.
On top of being a cleanup this is useful for the S Network
Selection project that will need to enrich the Network
Agent API, and as such should not have to support legacy
agents.

Test: FrameworksNetTests NetworkStackTests
Bug: 167544279
Change-Id: Id3e5f6e19829c64074cd6a52c5f950cee56b860b
2020-11-30 16:15:18 +09:00
Remi NGUYEN VAN
7820e22137 Do not query CS in NetworkProvider constructor
ConnectivityService may not be available in a NetworkProvider
constructor, if it is created (but still unused) before
ConnectivityService starts.

As ConnectivityManager is only necessary in
declareNetworkRequestUnfulfillable, which should not be called often,
just query ConnectivityManager at that point.

This is necessary for VcnManagementService, which is started before
ConnectivityService and creates its NetworkProvider in its constructor.
Fortunately VcnManagementService does not call
declareNetworkRequestUnfulfillable at this point.

ConnectivityManager may be migrated to classic service getters that
cache "null" when the service was not available the first time it is
queried, so no system service must query it before it starts.

Bug: 171540887
Test: atest FrameworksNetTests:NetworkProviderTest
Change-Id: I8dadcd0e1360a9464192f330493e13aa69dd9fe2
2020-11-30 12:42:15 +09:00
Treehugger Robot
eb2296e64d Merge "Adding @IgnoreUpTo to OemNetworkPreferencesTest" am: 9a9e45ad72 am: b32ead42ae am: ef777466b6
Original change: https://android-review.googlesource.com/c/platform/frameworks/base/+/1511772

Change-Id: Ib3782ba72d93d0fe647a6433dda4cdc51a645fb0
2020-11-30 02:55:00 +00:00
Remi NGUYEN VAN
535d328def Run OemNetworkPreferencesTest with DevSdkIgnoreRunner
The class-level @IgnoreUpTo annotation only applies with that runner.

Change-Id: I065618f2345c1d91de2fa1f2f558e5ed5b066f3e
Fixes: 174268969
Bug: 171505922
Test: atest FrameworksNetTests:android.net.OemNetworkPreferencesTest
2020-11-30 01:42:24 +00:00
Treehugger Robot
9a9e45ad72 Merge "Adding @IgnoreUpTo to OemNetworkPreferencesTest" 2020-11-30 01:38:19 +00:00
Lorenzo Colitti
3286928783 Move applying underlying caps from Vpn to ConnectivityService. am: 220987b38d am: a27c332849 am: ed3589c104
Original change: https://android-review.googlesource.com/c/platform/frameworks/base/+/1501815

Change-Id: I924998ffa45ba630d8688007878f339264e7108e
2020-11-28 04:50:46 +00:00
Lorenzo Colitti
aceffad3b2 Stop calling Vpn#updateCapabilities in CS.
Instead, make Vpn#onUserAdded and Vpn#onUserRemoved notify CS
of UID range changes through the VPN's NetworkAgent.

After this change, ConnectivityService no longer touches the
VPN's NetworkCapabilities directly, which is a much cleaner
design.

Bug: 173331190
Test: passes existing tests in ConnectivityServiceTest
Change-Id: If2201f392cdb5f00c89a97683ad4ce6bda7b89e5
2020-11-27 15:35:39 +09:00
Lorenzo Colitti
220987b38d Move applying underlying caps from Vpn to ConnectivityService.
Add support to ConnectivityService to track underlying networks
directly instead of through the Vpn class.

1. Communicate all information necessary to propagate underlying
   network capabilities to ConnectivityService via NetworkAgent.
   This includes:
   a. Underlying networks:
      - Add SystemApi for NetworkAgent to declare its underlying
        networks to ConnectivityService, and use it in Vpn.
      - Add a new declaredUnderlyingNetworks member to
        NetworkAgentInfo and store the underlying networks in it.
	Move propagation of underlying network capabilities to
	mixInCapabilities, which is a natural place for it.
   b. "Always metered" bit:
      - Communicate this to ConnectivityService via the existing
        NOT_METERED capability. Store it in a new declaredMetered
	boolean in NetworkAgentInfo to separate it cleanly from
	the NOT_METERED bit in the capabilities, which depends on
	whether the underlying networks are metered or not. In
	order to ensure that this is only ever changed when a NC
	update is received from a NetworkAgent, define a new
	processCapabilitiesFromAgent similar to the existing
        processLinkPropertiesFromAgent.

2. Ensure that propagating underlying network capabilities does
   not read the VPN's NetworkCapabilities. In order to do this,
   ensure that all relevant information on underlying networks
   and metering is sent to ConnectivityService at NetworkAgent
   registration time. CS still calls Vpn#updateCapabilities when
   a user is added/removed, but that is deleted in a future CL.

3. Slightly generalize propagating underlying network
   capabilities because there may be other network types that
   also have underlying networks that aren't VPNs (e.g., VCN).
   - Introduce a new supportsUnderlyingNetworks() boolean method
     in NetworkAgentInfo.
   - Rename updateAllVpnsCapabilities to
     propagateUnderlyingNetworkCapabilities.

This commit does not move the actual logic of calculating the
underlying capabilities out of Vpn.java. That can be done in a
subsequent change once CS stops calling getUnderlyingNetworks().

This commit also does not modify any of the other code in CS that
directly accesses VPNs' underlying networks.

Bug: 173331190
Test: passes existing tests in ConnectivityServiceTest
Test: CTS test in r.android.com/1511114
Test: atest CtsNetTestCases:Ikev2VpnTest HostsideVpnTests
Change-Id: I5f76cb1aa4866efed3d5c4590e931fdb0e994f8d
2020-11-27 15:35:38 +09:00
Lorenzo Colitti
82f9a007c1 Stop accessing VPNs in checkConnectivityDiagnosticsPermissions.
Currently, checkConnectivityDiagnosticsPermissions takes the VPN
lock to examine the VPN's underlying networks. Use the underlying
network data that is available in ConnectivityService instead.

Bug: 173331190
Test: passes existing tests in ConnectivityServiceTest
Change-Id: Ia1c366c5e9974d4d2c4b38030e66c007d62020ff
2020-11-27 15:35:38 +09:00
Treehugger Robot
6f3776b34a Merge changes Id4632e1b,I31985822,Ibbf96a25 am: b459e5166d am: 7814aeda39 am: 22c43689ce
Original change: https://android-review.googlesource.com/c/platform/frameworks/base/+/1511309

Change-Id: Ife8d852541eb8c96e9ada8d7037441514b7237bc
2020-11-26 05:33:56 +00:00
Treehugger Robot
b459e5166d Merge changes Id4632e1b,I31985822,Ibbf96a25
* changes:
  Test passing an underlying network array with null network in it.
  Make testVpnNetworkActive more deterministic.
  Add a test for restricted profile added/removed with VPN up.
2020-11-26 03:40:44 +00:00
Lorenzo Colitti
c64d177ed9 Test passing an underlying network array with null network in it.
Current code treats these nulls as if they weren't there.

Bug: 173331190
Test: test-only change
Change-Id: Id4632e1b004c09910b4b7613f7233d2c19e2f0ac
2020-11-26 10:33:23 +09:00
Lorenzo Colitti
621f5a9e8f Make testVpnNetworkActive more deterministic.
This test is a bit brittle because it sets the underlying
networks while the VPN is undergoing validation by
NetworkMonitor. The test does attempt to disable validation,
but that's not actually possible - the only thing that's possible
is to tell NetworkMonitor to validate immediately without sending
any probes. So the underlying network change races with the
validation. I'm not sure why the test isn't flaky. It might be
because both the network change and the validation result in a
capabilities change, and the test expects "a capabilities change"
without expressing what change that should be.

Make this a bit more predictable by ensuring that the network
validates before the underlying networks are set.

This is useful because an upcoming CL will change the way
underlying network capabilities are propagated. With this test
CL, both the old and the new code pass.

Bug: 173331190
Test: test-only change
Change-Id: I319858228e8d097c0b60a107029f296385f91269
2020-11-26 10:33:23 +09:00
Lorenzo Colitti
97ade70ce8 Add a test for restricted profile added/removed with VPN up.
Bug: 173331190
Test: test-only change
Change-Id: Ibbf96a259a73068d110a159d54059720121117cc
2020-11-26 10:33:23 +09:00
James Mattis
c5b14c2b8a Adding @IgnoreUpTo to OemNetworkPreferencesTest
Adding @IgnoreUpTo to OemNetworkPreferencesTest so that it can run as
part of MTS.

Bug: 174268969
Bug: 171505922
Test: atest FrameworksNetTests:android.net.OemNetworkPreferencesTest
Change-Id: If7fb039c2cdb061f803c8a59e826e485e1f1c761
2020-11-25 15:34:11 -08:00
Lucas Lin
2353b9f131 Merge "Ignore verifying canBeSatisfiedBy() on Android Q" am: dad3c929a3 am: 8203949d52 am: 828066d4ea
Original change: https://android-review.googlesource.com/c/platform/frameworks/base/+/1508137

Change-Id: Ia8e016d294f163ea00a540b78e4e9041da223594
2020-11-24 05:40:16 +00:00
Lucas Lin
dad3c929a3 Merge "Ignore verifying canBeSatisfiedBy() on Android Q" 2020-11-24 03:38:34 +00:00
lucaslin
aa00183916 Ignore verifying canBeSatisfiedBy() on Android Q
The method - satisfiedBy() has changed to canBeSatisfiedBy()
starting from Android R, so the method - canBeSatisfiedBy()
cannot be found when running this test on Android Q.
Ignore verifying canBeSatisfiedBy() on Android Q to fix this
problem.

Bug: 173911834
Test: Run MatchAllNetworkSpecifierTest on Android Q, R, S.
Change-Id: Ibe317b56f82d3ea100b1d78c3907dce4f2fd964d
2020-11-23 23:40:23 +08:00
James Mattis
231417f27c Merge changes Ibed6cdd4,I51e3c00d,Ibf37f94b am: 6e4b94388a am: d7bc7d7e29 am: 0905ca74db
Original change: https://android-review.googlesource.com/c/platform/frameworks/base/+/1498660

Change-Id: I68386af717aa15099a09f45b57d945f352396f3b
2020-11-21 02:04:15 +00:00
James Mattis
f8eb49ab6b Update requestsSortedById() to sort by collection
Update requestsSortedById() to sort NetworkRequestInfo by their
nested collection of NetworkRequest objects vs a single request.
Before the NetworkRequestInfo with the request with the lowest
requestId would be sorted to the top. Now the NetworkRequestInfo
which contains the request with the lowest requestId will be
sorted to the top.

Bug: 173292541
Bug: 171991028
Test: atest FrameworksNetTests
Change-Id: I51e3c00d59443e37ddbf168c423d13df8d14fa64
2020-11-19 17:04:02 -08:00
Lorenzo Colitti
cecb2bfcf4 Merge "Make MockVpn more realistic and easier to use." am: 0dd10f43c7 am: c927d555cd am: 49156dc401 am: d591886ab8
Original change: https://android-review.googlesource.com/c/platform/frameworks/base/+/1501814

Change-Id: I1beca5148b05724042e3c2415015f2ffa3ed2be5
2020-11-19 12:31:03 +00:00
Lorenzo Colitti
7992b7baa6 Merge changes I3711b362,I49421183,Icc0701cb,I2f5ccc1d am: 40b4ef6dd7 am: 49038a76c2 am: 3968347b84 am: 3dea488951
Original change: https://android-review.googlesource.com/c/platform/frameworks/base/+/1501951

Change-Id: I5c7847bac88b574737ab80e5a20e9e22afb5b2e4
2020-11-19 12:30:34 +00:00
Lorenzo Colitti
0dd10f43c7 Merge "Make MockVpn more realistic and easier to use." 2020-11-19 10:32:19 +00:00
Lorenzo Colitti
40b4ef6dd7 Merge changes I3711b362,I49421183,Icc0701cb,I2f5ccc1d
* changes:
  Increase test coverage for VPN info sent to NetworkStatsService.
  Simplify MockVpn.
  Test a VPN with an underlying network that does not yet exist.
  Minor fixes to NetworkCapabilities#toString.
2020-11-19 10:20:00 +00:00
Lorenzo Colitti
925d1a9a82 Make MockVpn more realistic and easier to use.
MockVpn is very difficult to use because it requires the test
caller keeping track of both the MockVpn object and an
accompanying TestNetworkAgentWrapper.

It's also not very realistic: for example, connect() doesn't
actually connect anything, it just makes it so that if
ConnectivityService tries to update the capabilities, the attempt
will not be ignored. Also, unlike the real code in Vpn, it
connects with empty NetworkCapabilities (in particular, with
empty UID ranges).

Make this easier to use and a bit more realistic by:
- Allowing TestNetworkAgentWrapper to take a "NetworkCapabilities
  template" that will form the initial capabilities sent when the
  agent registers with ConnectivityService. This allows the VPN
  to register its agent with its UID ranges already set, like the
  production code does.
- Providing separate methods to register the NetworkAgent and
  mark it connected for cases where the test needs to make
  changes to the NetworkAgent before connecting (e.g., poking
  NetworkMonitor).
- Putting the TestNetworkAgentWrapper inside MockVpn and driving
  it through MockVpn's methods. In order not to have too many
  wrapper functions (and because we can't delegate like in
  Kotlin), there's still an agent() method that returns the
  TestNetworkAgentWrapper.

Bug: 173331190
Test: test-only change
Change-Id: I749ff325bc13ac96f512270b86d1f67686eec378
2020-11-19 16:23:07 +09:00
Lorenzo Colitti
fdce3dde08 Increase test coverage for VPN info sent to NetworkStatsService.
Bug: 173331190
Test: test-only change
Change-Id: I3711b362f31cb92b759e9f5c9d244fb88d9bd5e7
2020-11-19 14:56:50 +09:00
Lorenzo Colitti
d97d6e304b Simplify MockVpn.
This CL removes four methods in MockVpn by slightly changing the
test code to leverage the actual methods implemented by the
(production) Vpn superclass.

This works because setting mInterface results in
isRunningLocked() returning true, which makes a number of methods
behave as if the VPN is connected (which is what the test
expects).

The more realistic behaviour exposes a minor bug in the treatment
of underlying networks. Add a TODO to fix it.

Bug: 173331190
Test: test-only change
Change-Id: I49421183538ba61ca790af71e309ece36b653bf9
2020-11-19 14:53:53 +09:00
Lorenzo Colitti
e50c0f8af4 Test a VPN with an underlying network that does not yet exist.
This test checks that if a VPN declares an underlying network
that does not exist, the capabilities of that network are applied
to the VPN as soon as the network starts to exist.

Bug: 173331190
Test: test-only change
Change-Id: Icc0701cb4cea7d91f7738c1e426e94cd26686b74
2020-11-19 14:46:32 +09:00
Chiachang Wang
bb26bd6f94 Merge "Replace InterfaceConfiguration usage with stable aidl" am: c0c71a50d6 am: 75cd8abbc7 am: 4ff4b9910f am: 50e11a6414
Original change: https://android-review.googlesource.com/c/platform/frameworks/base/+/1488356

Change-Id: I60b7d3c863121e4f766913c4b536795f6cc3b758
2020-11-18 10:47:38 +00:00
Chiachang Wang
c0c71a50d6 Merge "Replace InterfaceConfiguration usage with stable aidl" 2020-11-18 09:05:59 +00:00