When a fully-routed VPN is running, we want to prevent normal apps
under the VPN from receiving packets originating from any local non-VPN
interfaces. This is achieved by using eBPF to create a per-UID input
interface whitelist and populate the whitelist such that all
non-bypassable apps under a VPN can only receive packets from the VPN's
TUN interface (and loopback implicitly)
This is the framework part of the change that build the whitelist.
The whitelist needs to be updated in the following cases:
* When a VPN is connected and disconnected
This will cover the change to allowBypass bit, since that can't be
changed without reconnecting.
* When a VPN's NetworkCapabilites is changed (whitelist/blacklist app changes)
* When a new app is installed
* When an existing app is removed
* When a VPN becomes fully-routed or is no longer fully-routed
New user/profile creation will automatically result in a whitelist app change
transition so it doesn't need to be handled specially here.
Due to the limitation of the kernel IPSec interacting with eBPF (sk_buf->ifindex
does not point to the virtual tunnel interface for kernel IPSec), the whitelist
will only apply to app VPNs but not legacy VPN connections, to prevent breaking
connectivity with kernel IPSec entirely.
Test: atest PermissionMonitorTest
Test: atest android.net.RouteInfoTest
Test: atest com.android.server.ConnectivityServiceTest
Test: atest HostsideVpnTests
Bug: 114231106
Merged-In: I5af81bc80dadd086261ba4b1eb706cc873bb7cfa
Change-Id: I5af81bc80dadd086261ba4b1eb706cc873bb7cfa
(cherry picked from commit 65968ea16bf49f678d4a43c220e1d67393170459)
To address the API review feedback provided by
the API council.
Bug: 129261432
Test: atest DnsResolverTest
Merged-In: I5737cf293264bf9d492e7bd56b62bee4d49002eb
(cherry picked from commit 454fe010dcacd38211b857d2b235ed37269e3b7e)
Change-Id: I429dd93285f50314e9d757f4ec8539a3ba40e61b
This follow-up change performs some cleanup changes without affecting
functionality
Bug: 72950854
Test: Compiles, CTS tests using this pass
Change-Id: Ic7394f24f11d713c9374b438182e29d2a02ea236
Merged-In: Ic7394f24f11d713c9374b438182e29d2a02ea236
(cherry picked from commit 7df36ed96a807f258aef43e558ef127b27b90756)
The SocketUtils.attach*Filter and SocketUtils.addArpEntry methods
were added there because they could not be added as JNI inside
the NetworkStack. This was not possible because on Go devices,
the NetworkStack was a jar library. But now, Go also uses an APK.
Hence, move these methods to the NetworkStack.
Fixes: 129433183
Merged-In: I66d7b3e4fbfa32bb0bc853e8cf9399031daff8a9
(cherry picked from commit fe71be2b04a3213828dc0347a1dd4a3675d20562)
Change-Id: Ice433a41469e784385f19498c154345d7b9c69b5
- Add documentation to CaptivePortal#logEvent
- Add paragraph breaks to StaticIpConfiguration class javadoc
- Format javadoc for API documentation
- Move setters to a builder and hide fields for apps targeting P or
older
- Document StaticIpConfiguration getters and builder setters
- Add documentation for StaticIpConfiguration#getRoutes
Bug: 129362244
Bug: 129433304
Test: built, flashed, booted, WiFi working
Test: atest FrameworksNetTests NetworkStackTests
Change-Id: Ia66c1097f01ca87d02eba3456547aedb1e480186
- Restrict unprivileged apps to use
NetworkRequest.Builder#setSignalStrength.
- Remove the "throws NullPointerException" in
CaptivePortalProbeSpec constructor.
- Remove the null check in LinkProperties.
- Add annotataion into all ConnectivityManager.NetworkCallback
methods.
Change-Id: Id275cac1d6a30d7515cd7b113394f5e8a0179314
Fix: 129097486
Test: atest FrameworksNetTests
This method was removed as part of addressing API council feedback in b/129261432
Add back previous DnsResolver#query which is already being used by developers.
Bug: 129395490
Test: atest DnsResolverTest
Change-Id: Ic956db204f3940d39d42e1b11dda39e57d356fad
This problem might cause double-close fd and result in app crash
or unexpected behaviour
Bug: 129317069
Test: atest DnsResolverTest
manual test with delaying response callback/cancel
Change-Id: I223234f527edafc51d34fa6be390419c05def8d8
Currently, socketKeepalive implementation is accepting null fd
due to backward compatibility with legacy packet keepalive API.
However, due to lack of the fd, the service cannot guarantee the
port is not reused by another app if the caller release the port
for any reason.
Thus, grant the null fd access only for priviledged apps.
This commit also address some comments from aosp/918533.
Bug: 126699232
Test: atest FrameworksNetTests
Change-Id: I0baf582ff4ca8af6082c3754e8dfbcd867f39792
Per API review, change the use of FileDescriptor to
ParcelFileDescriptor.
This change also fix nullability according to API review
feedbacks.
Fix: 126698610
Fix: 126699425
Fix: 126699232
Fix: 126700278
Test: 1. m -j
2. atest FrameworksNetTests --generate-new-metrics 50
3. m -j doc-comment-check-docs
Change-Id: I19476c50dd1ca290bf3f41973829da2bd229796a
Add nullability annotations on the following methods:
- StaticIpConfiguration#getRoutes
- ValidationProbeEvent#getProbeName
Test: m
Bug: 128935825
Change-Id: I1c17d200f3125e684c4e4d67b2f7f079eda310b6
- Remove CaptivePortal constructor from SystemApi. This constructor was
added in Q timeframe and ends up being unnecessary since
CaptivePortal creation was refactored to ConnectivityService because
of visibility issues on ICaptivePortal.
- Rename getAvoidBadWifi to shouldAvoidBadWifi
- Add permission annotation for shouldAvoidBadWifi
(already merged in internal as:
I09545c00af3519dbf141dd5951b28f49e37b3e80)
Test: flashed, WiFi and captive portal works
Bug: 128935314
Bug: 128935673
Merged-In: I09545c00af3519dbf141dd5951b28f49e37b3e80
Change-Id: I7395d4a4db6a64398a827692aee1956c011873e5
- Remove CaptivePortal constructor from SystemApi. This constructor was
added in Q timeframe and ends up being unnecessary since
CaptivePortal creation was refactored to ConnectivityService because
of visibility issues on ICaptivePortal.
- Rename getAvoidBadWifi to shouldAvoidBadWifi
- Add permission annotation for shouldAvoidBadWifi
Test: flashed, WiFi and captive portal works
Bug: 128935314
Bug: 128935673
(clean cherry-pick of AOSP I7395d4a4db6a64398a827692aee1956c011873e5)
Change-Id: I09545c00af3519dbf141dd5951b28f49e37b3e80
The framework cannot return URLs used by the updatable NetworkStack,
which may use configurable URLs, changing URLs, or mechanisms not
involving URLs to detect captive portals. NetworkMonitor has already
been using random fallback URLs for a while that do not match the value
returned by ConnectivityManager#getCaptivePortalServerUrl.
With this change, the default value returned by the framework is
configured in framework resources as
config_networkDefaultCaptivePortalServerUrl. NetworkMonitor behavior may
change as it is an updatable component, but the current URL is
configured in NetworkMonitor resources as
config_captive_portal_http_url.
Test: flashed, booted, WiFi and captive portal working
Test: ConnectivityManager#getCaptivePortalServerUrl returns correct
value.
Bug: 127908503
Change-Id: I371dedc5b22efa909d7fd58e1ebe9b8aaced9780
1. Some API's argument/return value must be marked either
@NonNull or @Nullable.
2. Change some system APIs to public APIs.
3. Modify the method name
Bug: 126700123
Bug: 126702339
Bug: 126699682
Bug: 118296575
Bug: 126699216
Bug: 126699675
Bug: 126699429
Bug: 126699193
Bug: 123586045
Test: atest FrameworksNetTests
Change-Id: Iaa2832cdcf83758ed0fec81b954a0c63bc5a7bf6
* changes:
Remove the framework dependency on netd_aidl_parcelables-java.
Move TcpKeepalivePacketData out of the framework.
Stop using netd parcelables in the framework.
