This allows us to maintain NetworkStats entries that track
whether the traffic was on the default network.
At the moment, the stats collection code always passes in
DEFAULT_NETWORK_NO. However, this value is a no-op, since it is
not persisted to disk. Only the ident, the uid/set/tag, and the
packet/byte/operation counters are persisted.
A future change will add defaultNetwork to the ident and start
persisting it.
Bug: 35142602
Test: runtest frameworks-net
Change-Id: Ifa291c62c0fa389b88e5561086a29dcd7cee2253
This will allow NetworkStatsService to treat traffic on these
networks differently from traffic where the app selects a network
that is not the default.
Bug: 35142602
Test: runtest frameworks-net
Change-Id: I5ea9d200d9fb153490c6108bb9390bf152f297da
Add a new interface and a new management object,
IpSecTunnelInterface to the IpSecManager surface.
This object will be used to control IPsec tunnels.
-Add IpSecTunnelInterface object
-Add methods to create and use an IpSecTunnelInterface
-Update the IpSecTransform builder to create Tunnel
mode IpSecTransform objects (usable with an IpSecTunnel)
Bug: 36033193
Test: compilation
Change-Id: Ib6948b12c15c93674234dc36288058ae44435b90
Added some extra comments on reference counting and moved a few methods
around. No significant logical changes made in this CL
Bug: 63409385
Test: CTS, Unit tests (both frameworks-base and netd) and binder tests
all pass
Change-Id: I89f1f4a021db48ae406fefefa6aca7406045736c
Because IpSecTransforms are now unidirectional,
and because the only mechanism for removing Transforms
removes it from both directions, the API can no longer
use the Transform parameter to meaningfully validate
that the caller had applied a transform. Since that
functionality was as-yet unimplemented and is now
infeasible, the transform parameter is removed.
Bug: 72079356
Test: cts - IpSecManagerTest; runtest frameworks-net
Change-Id: If19b0d34bdc6daf31a40d6d62bff326dcbca08c0
The version of applyTransportModeTransform() and
removeTransportModeTransform() that accepted
Socket and DatagramSocket were closing the underlying
FDs upon return. It's unclear whether this is due to
a behavior change elsewhere in ParcelFileDescriptor,
but either way, converting to using getFileDescriptor$
and then calling dup() explicitly rather than relying
on ParcelFileDescriptor seems like a better idea anyway.
Bug: 72047396
Test: CTS - IpSecManagerTest.testCreateTransform()
Change-Id: Ia2f02564e1289f25bf113dbb861fcfd2240537a7
Convert the IpSecTransform from being a bi-directional
pair of SAs to a unidirectional single SA. This CL
also removes the concept of "direction from SAs meaning
that a IpSecTransform may now be applied to a socket
in either direction.
-Make transforms unidirectional
-Add Convert allocateSpi() to use destination rather
than direction and remote address
-Remove directionality from builders for IpSecTransform
-Change applyTransportModeTransform() to take a
direction in which to apply the transform object.
-Additional minor naming updates
-Restrict IpSecConfig to only print keys on eng builds
-Move DIRECTION constants to IpSecManager
-Add sourceAddress parameter to IpSecTransform to provide
additional guarantees about the source address of data;
(explicit failure rather than implicit failure).
-Move SPI to the build() method of IpSecTransform
Bug: 71717213
Test: runtest frameworks-net, CTS - IpSecManagerTest
Change-Id: I0824b37f443f4b8c62536d9801238c63ed8f2a1c
Mirrors the design of TimeUnit and ChronoUnit which many developers
are already familiar with, making it easy to pick up and use.
Yes, this is an enum.
Bug: 70915728
Test: bit FrameworksCoreTests:android.util.DataUnitTest
Change-Id: Id0cfdac5c81ed89c3c9ece23c964acba4a4f8471
Adds checks to ensure that users can only set the correct types of
algorithms for the Authentication, Encryption and Authenticated
Encryption algorithms.
Bug: 65223935
Test: Added tests in IpSecConfigTest, and passed on aosp_marlin-eng
Change-Id: I462c77d9eb5710b8d03a48866453649d3b6fc6bf
The mNextResourceId variable is only accessed within synchronized
blocks, so there is no need to use an atomic integer to synchronize
it. This eliminates the misleading notion that the variable is
accessed outside of guarded blocks, which it is not.
Bug: 62279167
Test: cts
Change-Id: I815835622659f54d2d2d33b349b17c632ebced8d
To facilitate error checking we should invalidate
the resource IDs of all objects when we close() them.
Today, the resource ID is invalidated on the Transform
object but not on the SPI or Encap Socket. This CL
unifies the behavior.
Bug: 70641274
Test: cts - IpSecManagerTest
Change-Id: I28caec3e913902c748c6a50b4ef742ccef8b1b09
CTS test should fail if IPV6 Sockets is used on IPV4 address.
Unfortunately its been passing fine due to unhandled catch
exception. This is fixed in this CL.
Bug: 64435904
Test: Ran CTS test to verify ./run_cts.sh
Change-Id: I369c1b5baaa64b64feaa3f298e61f46d1200ea17
Symptom:
System_server crashed due to unsolved "netd" service.
Root cause:
My previous patch was not enough for avoiding this crash.
a00d4b0 Abort connecting to native daemon during shutdown
listenToSocket loop can be finished without throwing exception.
Solution:
It's better to test shutdown condition before reconnection even
though listenToSocket is finished without exception.
Bug: 68742327
Change-Id: Ifdfe43d52bef891f55bd7b07cc1aa0fa248a6030
Move the native implementation of TrafficStats to NetworkStatsService
and apps need to get the NetworkStatsService binder interface from
system_server in order to get the network usage stats since boot. This
implementation can hide the detail of retrieving network traffic
information from apps and the NetworkStatsService can choose which
methoed it use to get the data depending on the kernel version of the
device.
Bug: 30950746
Test: CtsNetTestCases -t android.net.cts.TrafficStatsTest
Change-Id: I53bbefd19aa0b783b9b4b42ea4d76db3e9ec07a3
Encap sockets are currently created as the system server, and should be
fchown'd to the user for whom it was created on behalf of.
Bug: 62994731
Test: New tests added and run to IpSecService
Change-Id: Icc49e709ae588981e69765fdb77537d7ffbac5fe
Added calls to tag encap sockets to that of the UID for which the encap
socket is being created on behalf of. This ensures that all data
accounting generated for the UDP-encap-ESP socket is correctly billed to
the right UID.
Bug: 62994731
Test: New tests added to IpSecServiceTest.java, passing
Change-Id: I15365ea9c982fd7b4e3cdeff314ddfba2289c86e
This enables app A to create a socket, pass it to app B, and have
app B accept blame for the traffic performed on that socket.
Also adds helpful public APIs for tagging raw FileDescriptor sockets
instead of making developers go through shady SocketImpl wrappers.
Test: cts-tradefed run commandAndExit cts-dev -m CtsAppSecurityHostTestCases -t android.appsecurity.cts.AppSecurityTests#testAppFailAccessPrivateData
Bug: 63932076
Change-Id: I08925c843974675fc82e4080cec2eaab9ab7cd41
Merged-In: I08925c843974675fc82e4080cec2eaab9ab7cd41
(cherry picked from commit 4e164f9e94)
