Added calls to tag encap sockets to that of the UID for which the encap
socket is being created on behalf of. This ensures that all data
accounting generated for the UDP-encap-ESP socket is correctly billed to
the right UID.
Bug: 62994731
Test: New tests added to IpSecServiceTest.java, passing
Change-Id: I15365ea9c982fd7b4e3cdeff314ddfba2289c86e
A race condition during an Api rename has caused
the name change from reserveSecurityParameterIndex
to allocateSecurityParameterIndex to be wrong in
a test. Fixing.
Bug: 69128142
Test: runtest frameworks-net
Change-Id: I12fb9832cb938dc19f463b1f1124127435d7b173
This is part 2 of 2 of the refcounting refactor for IpSecService
resources.
Switched ManagedResources to use RefcountedResource structure for
managing reference counts and eventual cleanup. Further, resource arrays
and quota management have been aggregated into a UserRecord for better
isolation. UID access checking has been similarly moved into the
UserRecordTracker, and resourceId checking has been rolled into
RefcountedResourceArray's accessor methods.
Bug: 63409385
Test: CTS, all unit tests run on aosp_marlin-eng, new tests added
Change-Id: Iee52dd1c9d2583bb6bfaf65be87569e9d50a5b63
This patch adds (but does not enable the usage of) RefcountedResource
objects to IpSecService, with tests to ensure correct function. This is
patch 1 of a series of patches to refactor the resource management
systems in IpSecService.
RefcountedResource objects allow for management of acyclical dependency
trees, ensuring eventual cleanup when resources are no longer used. This
cleanup may be triggered by binder death or by explicit user action.
Bug: 63409385
Test: New tests written in IpSecServiceRefcountedResourceTest,
explicitly testing the RefcountedResource class
Change-Id: Ib5be7482b2ef5f1c8dec9be68f15e90d8b3aba6d
Throughout the IPsec code (API, system server, netd) we use "reserve"
SPI and "allocate" SPI interchangeably. This renames to use "allocate"
everywhere for self-consistency and consistency with the kernel
(ALLOCSPI).
In javadoc, I am leaving the word "reserve" in several places because it
is still an accurate description of how the method behaves.
Bug: 69128142
Test: TreeHugger should be enough
Change-Id: I8ea603b4612303b0393beef04032671fa53d2106
Improve the Validation of IpSecAlgorithm by
explicitly checking the length in addition to
the truncation length (previously an oversight).
In addition, we now check the lengths during
un-parceling, which will catch someone maliciously
manually building a parcel and passing it, bypassing
the checks in the constructor.
Bug: 68780091
Test: runtest -x IpSecAlgorithmTest.java
Change-Id: I8172762617264d34f47d5144336464510f07a701
This patch does some light refactoring in MacAddress to prepare for
exposing MacAddress in the public api:
- documention is improved
- some method names are renamed
- a toSafeString method is added
- a padding bug in the conversion methods outputting strings for
mac addresses is fixed
Bug: 69390696
Test: runtest frameworks-net
Change-Id: I399a97dabc2dfa8df9c5518c8b12484e43ca05c9
Update public docs to hide the fact that NetworkCapabilities is only
used inside NetworkRequest as an implementation detail.
Take up less room on the wire when passing NetworkCapabilities around
via NetworkRequest.
Sanity check that the roaming state between NetworkInfo and
NetworkCapabilities is in agreement.
Test: bit FrameworksNetTests:android.net.,com.android.server.net.,com.android.server.connectivity.,com.android.server.ConnectivityServiceTest
Bug: 67040695
Change-Id: I982b4c3c41a140934bbad3b8ca8f12dc3814e86c
This patch fixes a regression introduced by commit d5c11bbb65
for logging NetworkEvents when lingering and unlingering a network.
Commit d5c11bbb65 removed an overloaded constructor for the
NetworkEvent class, which caused NetworkEvents with event type of
LINGER or UNLINGER logged in ConnectivityService to have incorrect
event types (set to the network id instead) and incorrect duration
(set as the event type instead).
Bug: 34901696
Test: runtest frameworks-net
Change-Id: Iab97a58ca805413617c8e8b4553404625a820ceb
Also removes netId field from inside NetworkEvent and stop populating
the network_id field of the NetworkEvent field, deprecating it.
Bug: 34901696
Test: runtest frameworks-net,
manually looking at $ adb shell dumpsys connmetrics
Change-Id: I2c36860f976898883714f72f4d18e06da250c6a6
Added notes that keymat length must include 32 bits of salt.
Bug: 68672051
Test: Frameworks-net unit tests & IpSecManager CTS tests run
Change-Id: I0ae0c5be8a45b2374783b3bd1fa8bf930f15e687
Also includes:
- SettingsLib strings used in PrivateDnsModeDialogPreference
interaction in the Settings app
- rename ContentResolver "resolver" in methods working with
DNS resolvers (too confusing)
Test: as follows
- built
- flashed
- booted
- runtest frameworks-net
- no new failures in SettingsBackupTest nor in SettingsProviderTest
- manual interaction with developer option works
Bug: 34953048
Bug: 64133961
Change-Id: Ia7502916db9ffa0792e1e500a35e34d06a88e79d
This patch changes instrumentation of default networks and default
network events:
- stop logging events for default network transitions,
but instead consistently log one event per continuous segment
when one given network was the default, including logging an
event for when there is no default network.
- keep a separate rolling buffer of DefaultNetworkEvent for
dumpsys and bug reports.
These changes allow to simplify post aggregation of default network
event metrics by removing any need to do time series processing.
Instead, metrics and counters can be implemented withouth any ambiguity
by following the recipe:
% of x = sum(duration | x = true) / sum (all durations)
where x can be various conditions such as:
- the default network was validated
- the default network was WiFi
- the default network was IPv6
- there was no default network
- ...
Most importantly, this new logging scheme allows to measure much more
reliably:
- the % of the time that a device had Internet, in the sense that the
default network was validated.
- the time transitions between default networks, keyed by previous and
new transports/link layer, which allows to derive wakelock durations
and wakelock power costs from default network switches.
This patch also simplifies the dumpsys interface of the connmetrics
service and reduces the commands to three:
- "flush" for metrics upload.
- "proto" for printing buffered event in text proto format.
- "list" for listing all events and statistics.
Bug: 34901696
Bug: 65700460
Test: runtest frameworks-net
Change-Id: I0521f1681a60cca07ac3bfd5741d64ce44de4cdd
The "roaming" state of a network really belongs on NetworkCapabilities
instead of being published through NetworkInfo.isRoaming(). One major
reason is to support developers creating NetworkRequests for a
non-roaming network.
Watch for any capability changes that network statistics are
interested in (either metered or roaming) and notify it to perform
an update pass; fixes bug where we previously only triggered on
roaming changes.
Fix bug in VPNs where metered/roaming capabilities of underlying
networks weren't being propagated; this was probably preventing
some jobs from running over unmetered networks, and causing other
jobs to run over roaming networks! Also passes along link bandwidth
information from underlying networks, and propegates any changes
to underlying networks.
Fix race condition by reading prevNc inside lock. Utility methods
correctly calculate min/max link bandwidth values.
Test: bit FrameworksNetTests:android.net.,com.android.server.net.,com.android.server.connectivity.,com.android.server.ConnectivityServiceTest
Bug: 68397798, 16207332
Change-Id: I3e1a6544c902bf3a79356b72d3616af1fd2b0f49
Another CL in this topic moves the classes from
libcore.net.http
to
com.squareup.okhttp.internalandroidapi.
In jarjar'ed build targets, this becomes
com.android.okhttp.internalandroidapi.
This facade constitutes the API via which non-libcore parts
of the Android platform (currently framework) may access
OkHttp. It's moving because libcore.net.http is already
part of libcore, and the overlap of packages is problematic
for builds with EXPERIMENTAL_USE_OPENJDK9 set to true.
Bug: 68220880
Test: Treehugger
Change-Id: Ia79966563cc0b5ab0923d54c21e54b6192d8c990
Exempt-From-Owner-Approval: Jeff Sharkey is an owner, but only one of his accounts is listed as an owner (@android.com vs. @google.com)
Replaced null with empty byte array in createTransportModeTransform
for null auth.getKey, crypt.getKey() and authCrypt.getKey()
Test: Ran CTS test
Bug: 68052730
Change-Id: I5110b1297b4bfbb5766e8ecfd3d64f8110b52945
