-Add a reserveSecurityParamterIndex() function that allows the
system to select an SPI.
-Disallow INVALID_SECURITY_PARAMETER_INDEX from being passed as
an explicit SPI request.
-Remove the ALGO_ prefix from constants in IpSecAlgorithm
Bug: 36073210
Test: Updated CTS tests still pass on bullhead
Change-Id: Ic94809996076b0718f153f550b82192fe7048a2e
-Remove Int-based SPI usage from the IpSecTransform.Builder
This is essentially a less-safe method overload, and it is both
unnecessary and difficult to implement: the cross-validation
between SPI and Transform is actually useful, and the kernel
requires two different mechanisms to use an unreserved vs a
reserved (alloc'd) SPI: CREATESA vs UPDATESA, which makes this
hard to support. API Council has questioned the value of this,
and they are right: everything points to "remove this". In the
future, if we find that SPI reservation is overhead, we can
always add it back.
-Hiding the TunnelMode builder method and application/remove
methods. These will not land by the time the next API
stabilizes, so better to hide them now that this is a
near-certainty. Expectation is to un-hide them in the subsequent
API bump.
Bug: 36073210
Test: Compilation, verified nobody is calling these stubs
Change-Id: Ic1a3f2cf7128633318ac175d6b56b45eb8d21cab
(cherry picked from commit 48b566557d5a66d4476008b3c59b815eb78cb373)
To make the SPI reservation more semantically consistent with the
transform creation API, and to ensure that we always create SPI
reservations relative to a well-known remote, we should take the
SPI request relative to a remote (rather than to a destination).
This necessitates that we now consider direction separately, which
is used for keying the SA-Id.
Bug: 36073210
Test: compilation
Change-Id: I81e955c20128c1f8e04fd68eb26669561f827a78
(cherry picked from commit c4f879925b58b1b5ca9a3cfdc898c20cbf56355a)
-Add IpSecService with the necessary glue to connect to netd
-Add code to retrieve IpSecService from System Server
Bug: 30984788
Test: b/34812052, b/34811227
Change-Id: I4cdcb643421141202f77a0e2f87a37012de0cd92
(cherry picked from commit 28084d89ec136b56f5012be33a0dea147962f9f6)
This change introduces new methods on DumpUtils that can check if the
caller has DUMP and/or PACKAGE_USAGE_STATS access. It then moves all
existing dump() methods to use these checks so that we emit
consistent error messages.
Test: cts-tradefed run commandAndExit cts-dev -m CtsSecurityTestCases -t android.security.cts.ServicePermissionsTest
Bug: 32806790
Change-Id: Iaff6b9506818ee082b1e169c89ebe1001b3bfeca
Symptom:
NPE occurred while performing NetworkStatsService.removeUidsLocked().
Root cause:
NetworkStatsService refers to mUidRecorder at
NetworkStatsService.removeUidsLocked() when mUserReceiver received
Intent.ACTION_USER_REMOVED.
However NetworkStatsService sets mUidRecorder to null without
unregistering mUserReceiver when mShutdownReceiver received
Intent.ACTION_SHUTDOWN.
Therefore NPE occurred when mUserReceiver received
Intent.ACTION_USER_REMOVED after mShutdownReceiver received
Intent.ACTION_SHUTDOWN.
Solution:
Unregister mUserReceiver before setting mUidRecorder to null when
mShutdownReceiver received Intent.ACTION_SHUTDOWN.
Bug: 36015339
Change-Id: I9279e4c6ae07d94e7ec519c40b2d973c84d8fef1
This CL adds an API to set up an IPSec Security Association
and Security Policy to perform Transport-Mode and Tunnel-Mode encapuslation
of IP Packets.
Bug: 30984788
Bug: 34811752
Test: 34812052, 34811227
Change-Id: Ic9f63c7bb366302a24baa3e1b79020210910ac0a
* commit 'a19056c35d16ddb5a6c1d3343729701b8939f1e1': (35 commits)
NetworkMonitor: send one DNS probe per web probe
NetworkMonitor metrics: add first validation information
APF: also drop any ICMPv6 RSs
ConnectivityServiceTest: fix testAvoidBadWifiSettings
Fix ConnectivityServiceTest testRequestBenchmark
Switch over to new "time.android.com" NTP pool.
Define API for metering network stats buckets.
Refactored NetworkStatsServiceTest to use Mockito instead of EasyMock.
Use @Ignore to explicitly disable a @Test method.
Fixed NetworkStatsServiceTest and converted it to JUnit4.
VPN network stat accounting changes.
ConnectivityThread: use lazy holder idiom
ConnectivityManager: use ConnectivityThread looper
ConnectivityManager: a simpler CallbackHandler
Indicate the NsdServiceInfo attributes are only filled in for a resolved service.
Add a null check for the OnStartTetheringCallback.
TokenBucket for rate-limiting and throttling
IpConnectivityMetrics reads buffer size in settings
CaptivePortalLogin: set mixed content policy to compatibility.
Add IP conn metrics to dumpsys and bug reports
...
Dependent on ag/1550196 where API is defined.
Bug: 31015360
Bug: 26545374
Test: runtest --path
frameworks/base/core/tests/coretests/src/android/net/NetworkStatsTest.java,
other test classes.
(cherry picked from commit 357f8fabc8)
Change-Id: I46da93ba4afa968facf98f7c3d844fd0c469095a
This is a continuation of b/26545374, since now we can also set the
metered bit with NetworkScorer. The tracking of metered state changes
will be implemented in a seperate CL.
Bug: 31015360
Bug: 26545374
Test: N/A
(cherry picked from commit ed7fcb4d26)
Change-Id: I6a2fcc8577d62daa8823dff9e0128a5cf39ede7b
Properly account for VPN apps that make heavy use of the tun
interface. Prior to this change a VPN app could be incorrectly charged
for more data than it actually used if it sent more traffic through
the tun interface than the underlying interface.
This change excludes VPN app traffic on the tun interface from the
adjustment pool and doesn't redistribute traffic to the VPN app.
Instead all of the redistributed traffic is deducted from the VPN app
which effectively represents any overhead incurred by the VPN app.
BUG: 30557871
(cherry picked from commit 12255e3655)
Change-Id: I06f01aa8fe5fdc06b2d36cfb9c68feb244c2e5de
Network usage is tracked by the kernel at the UID level, which is
granular enough for normal apps, but large components (such as the
system server) are impossible to debug without adding additional
socket tagging to help identify subsystems within a UID.
To help ensure that system components tag all their network traffic,
this change offers a new StrictMode option to detect and report
untagged sockets.
Test: builds, boots, all common traffic tagged
Bug: 30943431, 30414041
Change-Id: I825c7941076054732264690247de2863342638e2
Dependent on ag/1550196 where API is defined.
Bug: 31015360
Bug: 26545374
Test: runtest --path
frameworks/base/core/tests/coretests/src/android/net/NetworkStatsTest.java,
other test classes.
(cherry picked from commit 357f8fabc8)
(cherry picked from commit 92b6175069)
Change-Id: I79e401fc4159264a075febba82bd8c295b8e677f
This is a continuation of b/26545374, since now we can also set the
metered bit with NetworkScorer. The tracking of metered state changes
will be implemented in a seperate CL.
Bug: 31015360
Bug: 26545374
Test: N/A
(cherry picked from commit ed7fcb4d26)
(cherry picked from commit ebace40092)
Change-Id: I01ebb270c5bf7f2383e8923cce72545ca1bee118
This will provide stack trace information from the system process
which should enable us to more easily track down where the crash is
occurring.
Test: Builds locally
Bug: 33427276
Change-Id: I584a568fc038771afb28a534e2eefe2f763ed5e1
* changes:
DO NOT MERGE: frameworks-test: adding missing @SmallTest
DO NOT MERGE: Netd events: record connect() success/errno
DO NOT MERGE: Add missing dependency.
DO NOT MERGE: Show notification for always-on app VPN
DO NOT MERGE: Implement metered tracking for NetworkStats summary queries.
DO NOT MERGE: NetworkMonitor: send one DNS probe per web probe
DO NOT MERGE: NetworkMonitor metrics: add first validation information
DO NOT MERGE: APF: also drop any ICMPv6 RSs
DO NOT MERGE: ConnectivityServiceTest: fix testAvoidBadWifiSettings
DO NOT MERGE: Fix ConnectivityServiceTest testRequestBenchmark
DO NOT MERGE: Switch over to new "time.android.com" NTP pool.
DO NOT MERGE: Define API for metering network stats buckets.
DO NOT MERGE: Refactored NetworkStatsServiceTest to use Mockito instead of EasyMock.
DO NOT MERGE: Use @Ignore to explicitly disable a @Test method.
DO NOT MERGE: Fixed NetworkStatsServiceTest and converted it to JUnit4.
DO NOT MERGE: VPN network stat accounting changes.
DO NOT MERGE: ConnectivityThread: use lazy holder idiom
DO NOT MERGE: ConnectivityManager: use ConnectivityThread looper
DO NOT MERGE: ConnectivityManager: a simpler CallbackHandler
DO NOT MERGE: Indicate the NsdServiceInfo attributes are only filled in for a resolved service.
DO NOT MERGE: Add a null check for the OnStartTetheringCallback.
Dependent on ag/1550196 where API is defined.
Bug: 31015360
Bug: 26545374
Test: runtest --path
frameworks/base/core/tests/coretests/src/android/net/NetworkStatsTest.java,
other test classes.
(cherry picked from commit 357f8fabc8)
Change-Id: I46da93ba4afa968facf98f7c3d844fd0c469095a
This is a continuation of b/26545374, since now we can also set the
metered bit with NetworkScorer. The tracking of metered state changes
will be implemented in a seperate CL.
Bug: 31015360
Bug: 26545374
Test: N/A
(cherry picked from commit ed7fcb4d26)
Change-Id: I6a2fcc8577d62daa8823dff9e0128a5cf39ede7b
Properly account for VPN apps that make heavy use of the tun
interface. Prior to this change a VPN app could be incorrectly charged
for more data than it actually used if it sent more traffic through
the tun interface than the underlying interface.
This change excludes VPN app traffic on the tun interface from the
adjustment pool and doesn't redistribute traffic to the VPN app.
Instead all of the redistributed traffic is deducted from the VPN app
which effectively represents any overhead incurred by the VPN app.
BUG: 30557871
(cherry picked from commit 12255e3655)
Change-Id: I06f01aa8fe5fdc06b2d36cfb9c68feb244c2e5de
Introduce a new internal flag MATCH_ANY_USER for genuine uses
of searching through all apps on the device.
Some temporary accommodations for Launchers that reach across
to the work profile until we have a new LauncherApps API to do
that officially.
Bug: 31000380
Test: CTS tests added
Change-Id: I2e43dc49d6c2e11814a8f8d1eb07ef557f31af34
