Test: TreeHugger
Bug: 292156770
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I6e4527a8cb5b5bfc033c5a4d09f0b78080c163c9

Test: TreeHugger
Bug: 292156770
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I0f77220a6c4b13efb5630d7a5ade1db39c59901e

This is written based on observation that
  testStartVpnProfileNoPreviousConsent()
appears to result in the right things happening when running
  adb logcat | egrep --color -i 'Switched from |protect'
ie. it results in:
  I netd    : networkSetProtectDeny(<ctsappuid>) <0.01ms>
  I Vpn     : Switched from android.net.cts to [Legacy VPN]
  I netd    : networkSetProtectAllow(1000) <0.00ms>

Which disallows the CTS uid, and allows AID_SYSTEM.

That in turn appears to be the 'default' state of things.

So this basically copies that logic into tearDown()

Test: atest android.net.cts.{Ikev2VpnTest,VpnServiceTest} --iterations 2
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ic9cca56097d78ae48157e808081de2ebb76635e8

* changes:
  netbpfload: update date in copyright messages, LOG_TAGs, etc.
  netbpfload: remove support for 'loader'
  netbpfload: remove support for 'vendor'
  netbpfload: remove support for 'platform'

* changes:
  bpf: add constants PRIVATE, SHARED, MANDATORY, OPTIONAL
  switch from defines to static consts

For general internet access, a specialized slice is generally
not preferable to a non-specialized network.

Test: new test in this patch
Change-Id: I052ce923300566807999b2f20f5911181fb761dd

Test: N/A
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I8f83d04266caf930701b9725b457333ddae149f2

Test: N/A
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I3d6a6a072cc958c3cb8f49d747a6c6812b37cef5

Test: N/A
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: If088188b4832d37b084846b5ad3db06b8858d856

Test: N/A
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ia0c1f55aa78435737699e0dec0bfddbd977e7392

use them & IGNORE_ON_* LOAD_ON_* as needed.

Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ibadd782d289e6a2ce1467778a1930c6f1b609f98

tm-mainline-prod is no longer in use

Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I8704dccff1432ba811e99a89ea60028fd63365b5

These are unmodified files, without history.
Getting these to do something useful will come later.

Generated via:
  cp //system/bpf/bpfloader/bpfloader.rc netbpfload.rc
  cp //system/bpf/bpfloader/BpfLoader.cpp NetBpfLoad.cpp
  cp //system/bpf/libbpf_android/include/libbpf_android.h loader.h
  cp //system/bpf/libbpf_android/Loader.cpp loader.cpp

Change-Id: I1677b899a51e1289a7a9806d6f5c34450b9e7c47

Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ie0eb8895c2d887b71ba886735ad106c1118ebeac

Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I54a189f0f7b73917aa3fd049fe2eca387aaca250

aconfig soong modules should be used to read the trunk stable flag.
However they are not available in the mainline branch.
So this CL adds the method to check if the trunk stable flag is enabled
or not by directly reading from DeviceConfig.
It's expected that this does not work correctly if flag value is not
stored in the DeviceConfig.
But for the time being, this method can be used to keep development.
Once the mainline branch supports the aconfig soong modules, method
added by this CL must be removed and java_aconfig_library should be
used instead.

Test: adb shell device_config put android_core_networking \
Test: com.android.net.flags.test_feature true
Test: Compares the value from java_aconfig_library and DeviceConfigUtils
Change-Id: I8e35b33a3201192e940e88f96aad3b2b6685b046

- Watches don't support VPN apps.
- The HostsideVpnTests CTS tests are already skipped on watches.
- The tests for VpnManager VPNs do run on watches, but there isn't
  actually a way to start a VpnManager VPN on a watch because there is
  no way to display the consent dialog to the user.
- The VpnService CTS tests verify the VpnService API on watches
  bypassing the consent dialogs.
- Because there is no way to start a VPN app on a watch, there's no
  point requiring the VPN CTS tests to pass.

This CL disables the remaining VPN CTS tests on watches. This allows
watches to disable the VPN service, reducing startup time and memory
usage.

Bug: 286240194
Test: atest CtsNetTestCases FrameworksNetTests
Change-Id: Idb7110232ae7e45cafc265cd4f955c2a6b22361c

Android's clat is for reaching the internet, which in general
never has an ipv4 L3 mtu higher than 1500.

(We could probably hit this on a jumboframe enabled IPv6-only
wifi network [ http://b/292057969#comment18

 ] where RA claims
MTU of 9K [9170])

Bug: 292057969
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I7a32455571458b8a3f1121ad980d54323b2ef06b

* changes:
  Use carrier service changed callbacks when flag is on
  Delete slots as the listeners are unregistered.
  Have a full class (not inline) for privilege listener
  Update the carrier service UID when onCarrierServiceChanged
  Pass the modem count to registerCarrierPrivilegeListeners
  Reorder add/remove/register/unregister carrier listeners

Network tracing was only available on userdebug and eng builds. This
change makes it available on all build types behind a flag.

Bug: 298197881
Test: flash & trace, toggle flag on/off
Change-Id: I75d854aee74adf7e23f7a970b20233790f9b0354

Merge "Add NetworkStackModuleTest exclusion for ConnectivityCoverageTests in TEST_MAPPING." into main

Test: FrameworksNetTests
      Note that carrierPrivilegeAuthenticatorTest is already
      an @Parameterized test with flag = on and off, so it
      already tests both.
Change-Id: I52fcfd3f21a13d7a39952ba828464ce6ef4085c2

For the current code this is a no-op because the new
slots are always computed immediately in the same
critical section.

When the code uses callbacks for the carrier service UID
though, there will no longer be a time where the entire
array is reset. Instead, registering the callback will
immediately trigger the call that populates it again,
which means the value needs to be removed when a SIM
card is removed. Unregistering the callback is a good
time to do this.

Test: CarrierPrivilegeAuthenticatorTest
Change-Id: I6de4abdc57ffa455d7f8e4d35f5dd1e18937e94e

Test: CarrierPrivilegeAuthenticatorTest
Change-Id: I1e8944de203767edf036da3fe77171025e72fcb7

Tests show that when the carrier service package changes, sometimes
neither onCarrierPrivilegesChanged is called nor the
ACTION_MULTI_SIM_CONFIG_CHANGED broadcast is sent.
Because updating synchronously can be done at any time, it's a
strict improvement to also do it onCarrierServiceChanged.

Test: CarrierPrivilegeAuthenticatorTest
Change-Id: I9525bfe074dd686720d50e19be15529b248e9dbb

This is clearer and less dangerous locking-wise

Test: FrameworksNetTests
Change-Id: Ife09fef848144e74ddb02aba3594913899bc9f46

Helper methods in the middle of the class make it harder
and more confusing. This patch moves the helpers out of
the way and regroups the useful methods in a more logical
order.

Test: FrameworkNetTests
Change-Id: I386ef7140c0535c9817a663910c19afeaf70981b