* Use public stable API to load certificates from keystore.
* Also use grants to allow racoon to use keystore keys without
special exceptions in keystore.
* Use LegacyProfileStore instead of Keystore for storing VPN profiles.
Bug: 175068876
Bug: 171305607
Test: atest android.net.cts.Ikev2VpnTest
atest android.net.cts.IpSecManagerTest
atest com.android.server.connectivity.VpnTest
atest com.android.server.ConnectivityServiceTest
Merged-In: I27975113896ea137260a9f94a34fb1c3ca173fe3
Change-Id: I27975113896ea137260a9f94a34fb1c3ca173fe3
Only part of events will report from DnsResolver through
INetdEventListener. So use IDnsResolverUnsolicitedEventListener
to get exactly supporting events from DnsResolver and it uses
Parcelable object to deliver data which can be more updateable
and extendable in the future.
Bug: 173485754
Test: atest FrameworksNetTests
atest CtsNetTestCases
Change-Id: I8d2e700ae8861ed8ceccd287f3ca5bc2f1ed6dee
Let ConnectivityService talk to Nat464Xlat through NetworkAgnetInfo
directly:
- Nat464Xlat will be created once there is a new network bringing up,
but Netd doesn't expose the method for unregistering unsolicited event.
- ConnectivityService has already registered netd unsolicited event
listener, so Nat464Xlat doesn't need to register unsolicited event
listenser by itself, it can get the unsolicited event from
ConnectivityService directly.
Bug: 174837473
Test: atest FrameworksNetTests
Change-Id: I751526e8ffa7d25591696ecd8d93b1585c4c20c7
UidRange will be a part of connectivity mainline module.
Mainline modules should use strongly-typed UserHandle arguments.
The method also refer to the hidden UserHandle.PER_USER_RANGE
which is not available after UidRange is moved into module.
Thus, replace the usage and remove the createForUser method that
takes userId parameter.
Bug: 170598012
Test: atest FrameworksNetTests
Change-Id: I3f33ea92c4a24342af9ec4b0367c50bb64ce6450
* changes:
Remove unused INetworkManagementService from IpSecService
Use NetdUtils instead of NetworkManagementService in Vpn
Use NetdUtils instead of NetworkManagementService in IpSecService
Repalace the API with SysetmConfigManager#getSystemPermissionUids
and update the design/test accordingly.
Bug: 177188455
Test: atest FrameworksNetTests
Test: atest FrameworksNetIntegrationTests
Test: atest CtsNetTestCases
Change-Id: I8b553b934252b93c60b815715680427a41620054
These cause the tests to crash on eng builds, so disrupt
development.
Test: atest FrameworksNetTests passes on eng build
Change-Id: Ifa5131fdb8f57af812cf688970be6588d2879c29
ag/13210542 was submitted directly into internal and is causing
a merge conflict in NetworkNotificationManagerTest.
Fix the conflict by adding the unused imports.
Test: m
Bug: 175409684
Change-Id: I6eec459a5e5b9900ddeb9e17d90f07432eee1394
userId integers are not public API and code should use UserHandle
instead.
Bug: 170598012
Test: passes existing tests
Change-Id: Ic27b93ccfe6bbc97e7419293ce165fee6cd51e6d
This currently stores the VPN type and a session name, but can be
extended in the future.
Bug: 173331190
Test: added coverage in VpnTest
Test: added coverage in ConnectivityServiceTest
Test: added coverage in NetworkAgentTest
Change-Id: I450858a9fa332c8d896dbdb4c14337d5ec23677f
- Added API to add T&C URL in the CaptivePortalData class, and to
indicate if the source is from Passpoint.
- Added source indication for the Venue URL API.
- Allow the connectivity service to send a new T&C acceptance
notification.
- Updated the merge method to prefer the Capport data over the
network agent data, if the source is not authenticated (not from
Passpoint).
- Propagate the Venue Friendly name to the captive portal activity
to be used instead of SSID, when available.
Bug: 162785447
Test: End-to-end test
Test: atest ConnectivityServiceTest
Test: atest CtsNetTestCasesLatestSdk:CaptivePortalDataTest
Test: atest NetworkNotificationManagerTest
Change-Id: I4e77c3b6c01941b03c46ad32da70c77e0fecac64
NetdUtils has the same method(e.g. setInterfaceUp) as
NetworkManagementService so using the one inside NetdUtils instead
and try to remove NetworkManagementService from Vpn in
the following commit.
Bug: 170598012
Test: atest FrameworksNetTests
Change-Id: I867556478fbc8c8ca8baa4e4c438a47b3beebe39
This temporary hack was necessary due to b/175883995. Now that
that bug is fixed, remove the hack.
Bug: 171529940
Test: test-only change
Change-Id: I48bd594cf3a37575f4888c1be9a1cf535de2e4d2
These tests do not actually work, or at least not as designed.
What happens when they are run is that creating/connecting the
VPN throws an exception. The call to legacyRunnerReady.block()
times out after 10 seconds because the condition variable is
never opened, but the doesn't notice the timeout becasue it
doesn't check the return value of block().
There are two reasons for the VPN not coming up.
1. VpnConfig.getIntentForStatusPanel calls into PendingIntent and
ActivityManager statics, which bypass all the mocks and fail
with an appops denial. Fix this by making it a dependency.
2. The tests are broken due to the UserManager API changes
tracked in b/175883995. Fixing by adding a bit of ad-hoc code
into startLegacyVpn, with a TODO to delete it once the rest of
the UserManager setup code is fixed.
Fix these and check the return value of block(). This ensures
that if any other breakage is added the test will actually fail.
Also check that the throw route survives all the way to the
LinkProperties sent to the agent.
Bug: 173331190
Test: atest com.android.server.connectivity.VpnTest
Change-Id: Ieb7f33bce283ac5ee562a912df8edb9c930ed2b0
This patch addressses the mocked UserManager for the context
of the user which is created by createContextAsUser.
Bug: 171529940
Bug: 175883995
Test: FrameworksNetTests
Change-Id: Ie72d08c765ed7fb7083c0c4b7ee02a43c23d1707
This will be used by a future change that makes the legacy
lockdown VPN pass the underlying network.
Bug: 173331190
Test: tests in subsequent CLs in stack
Change-Id: I09366a7f872ef3d4538962a75b0114a2ecb536e6
* Provide App Developers Qos related info associated to
a bound socket through ConnectivityManager
* Qos sessions are generated and filtered by Network Agents
and sent back through the Connectivity Service to the
API consumer.
* The structure of the code within com.android.server
is designed to support different types of filters in the
the future.
* The first type of Qos Attributes are related to EPS
Bearers in order support RCS.
Bug: 155176305
Test: Added to cts/NetworkAgentTest
Test: Added to ConnectivityServiceTest
Change-Id: I145dd065d9deeee449eb9695ab3f6c8556ee7c09
These fields have been recently audited, confirmed never to be
null, and annotated @NonNull. Ensure that they can never become
null by throwing exceptions in the codepaths that set them.
Also remove some null checks.
Test: atest FrameworksNetTests
Change-Id: I6ce5bb4d69a990f1c857c599b7e50e372352eb87
Makes two new SystemApis:
getRestrictedProfileParent()
canHaveRestrictedProfile()
Temporarily disables VPN Tests that rely on the old APIs until those
tests are updated (b/175883995).
Bug: 171529940
Test: atest FrameworksNetTests:com.android.server.connectivity.VpnTest
Test: Tests for UserManager SystemApis are TODO awaiting completion of new user test infrastructure (b/163890431)
(cherry picked from commit 20ba13f5bc)
Change-Id: I28e39400039631e7d391dc7b0d003e8a38d1f06a
Currently, ConnectivityService calls the IpConnectivityMetrics
service class directly to log default network events. This is
incompatible with ConnectivityService being in a mainline module.
Replace direct access to IIpConnectivityMetrics with public
methods in IpConnectivityLog, which is @SystemApi class.
The new methods are not yet @SystemApi, but they can be made so
if desired. Alternatively, these metrics could be deleted.
Also remove the IpConectivityMetrics service from the
service-connectivity JAR, and go back to starting it from
SystemServer.java, which is what was happening a few hours ago
before aosp/1542626 was merged.
Test: builds, boots
Test: atest FrameworksNetTests
Test: "dumpsys connmetrics" shows events, including default network events
Change-Id: I9d6147d93590363a2f8f83f39f05c03d001b4851
This code is no longer used. Delete it and the tests for it.
One of the tests checks that when a restricted profile is added,
the lockdown UID rules are updated to cover that profile as well.
ConnectivityServiceTest does not currently has coverage for this,
so add it.
Bug: 173331190
Test: moved unit test from VpnTest to ConnectivityServiceTest
Change-Id: Ic350b90946870890bf031668bb5c201037b0bd15
Currently, when an always-on VPN is set in lockdown mode, Vpn
configures prohibit UID rules in netd directly and does not
inform ConnectivityService of the fact.
This means that ConnectivityService cannot send NetworkCallbacks
that tells apps that they are blocked or unblocked. It also means
that ConnectivityService has to take the mVpns lock and call into
Vpn to allow synchronous APIs such as getActiveNetwork to return
BLOCKED if the app is blocked.
Move all this to ConnectivityService:
- Add a setRequireVpnForUids API to ConnectivityManager, and have
that pass the routing rules to netd.
- Update VpnTest to expect calls to ConnectivityManager instead
of to netd.
- Whenever setRequireVpnForUids is called, ensure that
ConnectivityService sends onBlockedStatusChanged to the
affected callbacks.
- Update existing unit tests to check for callbacks.
- Add a way to find the VPN that applies to a given UID without
taking the VPN lock, by instead scanning all connected VPNs.
Use this as a replacement for direct access to mVpns.
For simplicity, and in order to ensure proper ordering between
the NetworkCallbacks sent for VPNs connecting and disconnecting,
process blocked UID ranges on the handler thread. This means that
when setRequireVpnForUids returns, the rule changes might not
have been applied. This shouldn't impact apps using network
connectivity, but it might mean that apps setting an always-on
package, and then immediately checking whether networking is
blocked, will see a behaviour change.
Bug: 173331190
Fix: 175670887
Test: new test coverage in ConnectivityServiceTest
Test: atest MixedDeviceOwnerTest#testAlwaysOnVpn \
MixedDeviceOwnerTest#testAlwaysOnVpnLockDown \
MixedDeviceOwnerTest#testAlwaysOnVpnAcrossReboot \
MixedDeviceOwnerTest#testAlwaysOnVpnPackageUninstalled \
MixedDeviceOwnerTest#testAlwaysOnVpnUnsupportedPackage \
MixedDeviceOwnerTest#testAlwaysOnVpnUnsupportedPackageReplaced \
MixedDeviceOwnerTest#testAlwaysOnVpnPackageLogged \
MixedProfileOwnerTest#testAlwaysOnVpn \
MixedProfileOwnerTest#testAlwaysOnVpnLockDown \
MixedProfileOwnerTest#testAlwaysOnVpnAcrossReboot \
MixedProfileOwnerTest#testAlwaysOnVpnPackageUninstalled \
MixedProfileOwnerTest#testAlwaysOnVpnUnsupportedPackage \
MixedProfileOwnerTest#testAlwaysOnVpnUnsupportedPackageReplaced \
MixedProfileOwnerTest#testAlwaysOnVpnPackageLogged \
MixedManagedProfileOwnerTest#testAlwaysOnVpn \
MixedManagedProfileOwnerTest#testAlwaysOnVpnLockDown \
MixedManagedProfileOwnerTest#testAlwaysOnVpnAcrossReboot \
MixedManagedProfileOwnerTest#testAlwaysOnVpnPackageUninstalled \
MixedManagedProfileOwnerTest#testAlwaysOnVpnUnsupportedPackage \
MixedManagedProfileOwnerTest#testAlwaysOnVpnUnsupportedPackageReplaced \
MixedManagedProfileOwnerTest#testAlwaysOnVpnPackageLogged
Test: atest FrameworksNetTests HostsideVpnTests \
CtsNetTestCases:VpnServiceTest \
CtsNetTestCases:Ikev2VpnTest
Change-Id: Iaca8a7cc343aef52706cff62a7735f338cb1b772
Use two oneway binder interfaces instead.
The interfaces post messages to handlers as was implemented before, but
provide a more strictly defined interface, with less hops between
NetworkAgent, AsyncChannel, and ConnectivityService.
The actual public interface is the NetworkAgent @SystemApi: the binder
interface is an internal implementation detail.
Test: atest FrameworksNetTests CtsNetTestCasesLatestSdk
Bug: 173574274
Merged-In: Ie364ab50f416e7821e70f4539a881eea828e1256
Change-Id: Ie364ab50f416e7821e70f4539a881eea828e1256
This requires mocking lots of new things that weren't mocked
before but is otherwise fairly straightforward.
A few changes to MockVpn are needed as well:
1. Set the VPN's NetworkInfo to CONNECTED, so methods such as
isBlockingUid will work. While I'm at it, set the interface on
the LinkProperties as well to make things a bit more
realistic.
2. Constructs the VpnConfig when registering the agent, not when
the MockVpn is created. This is needed because starting and
stopping lockdown VPN calls prepare, which nulls out mConfig.
But constructing the VpnConfig when registering the agent is
more realistic anyway. The production code does that in
establish, but we can't do that in ConnectivityServiceTest
because some of the test cases don't call establish and call
registerAgent directly.
Bug: 173331190
Test: atest FrameworksNetTests
Change-Id: I827543751dbf5e626a24ec02cd6f50b423f5f761
ConnectivityService is going to become a mainline module which
cannot access hidden APIs. Thus, replace the VPN uid range
controlling APIs from NMS to INetd directly.
Bug: 170598012
Test: atest FrameworksNetTests
Test: atest HostsideVpnTests
Test: manually test to connect to VPN and check the uid range
Change-Id: Ie6656ef36f54c2f14d5a2899e763a29b70a30f5d
UserManager#getUsers() is a hidden API, use getUserHandles() to
get user id instead in PermissionMonitor.
Bug: 171529940
Test: atest FrameworksNetTests
Change-Id: Ic304627688de8e49505a95ebc99628b2e0eafab9
This is essentially a straighforward move of code from Vpn to
ConnectivityService, and from VpnTest to ConnectivityServiceTest.
Bug: 173331190
Test: passes existing tests, moved tests pass
Change-Id: I76daa3abcc777e9c3ba57efb750de0e2e2f3bb74
The existing method is confusing (the argument used to be called
includeDying) and it puts the burden on the caller (which need to
understand what the parameter means).
Furthermore:
- The majority of calls are for getUsers(excludeDying=true).
- The calls for getUsers(excludeDying=false) are equivalent to
calls to getUsers()
Test: m
Test: a VpnTest ConnectivityServiceTest PermissionMonitorTest
Bug: 157921703
Change-Id: Ife767a40b7b7790ba28b5377046de822ddbf275c
Merged-In: Ife767a40b7b7790ba28b5377046de822ddbf275c
(cherry picked from commit 6dc6d2b964)
On top of being a cleanup this is useful for the S Network
Selection project that will need to enrich the Network
Agent API, and as such should not have to support legacy
agents.
Test: FrameworksNetTests NetworkStackTests
Bug: 167544279
Change-Id: Id3e5f6e19829c64074cd6a52c5f950cee56b860b
Replace InterfaceConfiguration with InterfaceConfigurationParcel
for the incoming ConnectivityService mainline since mainline
modules could not use @hide API.
Bug: 170598012
Test: atest FrameworksNetTests
Change-Id: I17ce8741e985fd30e3c8f0c34e79564a82890dc6
Connectivity service module is using some Context @hide APIs but
they are not able to call after CS becomes a mainline module.
Thus, replace them with similar System APIs.
Bug: 170593746
Test: atest FrameworksNetTests
Test: Manully check that receiving intent and starting activity
can work normally.
Change-Id: I0f5b53ce0da4e3fc0f927896e9a9e444048401bd
Connectivity service module is using some AppOpsManager @hide
APIs but they are not able to call after CS become a
mainline module. Thus, replace them with similar System APIs.
Bug: 170593746
Test: atest FrameworksNetTests
Change-Id: I51f66b64fcc3ebdbc2fddff8371eb8d9ff134137
It's confusing that NetworkNotificationManager uses
NotificationManager to put up notifcation which is passed from
ConnectivityService. And that NotificationManager should be
gotten from a context with UserHandle.ALL because the
notification should notify to all users. But the future developer
may not know this and pass incorrect NotificationManager
probably. Therefore, adjust the design that
NetworkNotificationManager will get NotificationManager locally.
Bug: 170593746
Test: atest FrameworksNetTests
Change-Id: Id65c998052b7b223171c5194ea46b49d7e84729d
Connectivity service module is using some NotificationManager
@hide APIs but they are not able to call after CS become a
mainline module. Thus, replace them with similar System APIs.
Bug: 170593746
Test: atest FrameworksNetTests
Change-Id: I2644867cfc01d8d651c7029134294a9d44fdb471
DnsManager does not use MockableSystemProperties to communicate
with netd to configure the dns server anymore. ConnectivityService
does not need to take it into DnsManager as a parameter. Thus,
clean up the unused code.
Bug: 33308258
Test: atest FrameworksNetTests
Change-Id: I2ac89944391f7d1fd5d67f26cf7f2b11a4a4cf84
These have been locked down via SELinux for a while and thus
they should be safe to delete at this point.
Test: atest FrameworksNetTest
Bug: 33308258
Bug: 148724751
Change-Id: I3a1e9c6ad92c8d2367e0048e5d6cd7d06bbc6e80
The method checkInterfacePresent seems that should return if the
interface is present or not, but it actually return an opposite
result. It may confuse the caller. E.g. The override method in
VpnTest assume it always returns true in the test. It will fail
the vpn start flow due to interface gone.
Bug: 169215213
Test: atest FrameworksNetTess
Change-Id: I3e9a64f0900336b8205674b94db68f090b4e9ff9
