(This rolls forward part of a previous change, now that jarjar was fixed
to not get very slow when the number of rules increases).

Autogenerate connectivity jarjar rules at build time, to avoid issues
with forgotten jarjar rules or hard-to-diagnose errors introduced by
incorrect rules.

This change causes all classes in framework-connectivity(-t) and
service-connectivity to be jarjared into android.net.connectivity, but
still avoids jarjaring classes in com.android.server as before, to keep
it small.
For many classes this differs from the original jarjar rule.

Notes on implementation:

 - connectivity-jarjar-rules now has a subset
   framework-connectivity-jarjar-rules containing only the rules
   necessary for framework-connectivity. This is necessary because
   framework-connectivity cannot depend on rules generated based on
   service-connectivity, as there would be a dependency cycle
   (service-connectivity depends on framework-connectivity); Soong even
   crashes with a stack overflow.

 - framework-wifi.stubs.module_lib is added to
   framework-connectivity-pre-jarjar as it is necessary to build it (it
   is already in impl_only_libs in the defaults).
   It is unclear why framework-connectivity-pre-jarjar could build
   before that (possibly because it was only used as "lib" ?)

 - Fix package-private visibility; for example NattSocketKeepalive,
   TcpSocketKeepalive are not API so should be jarjared, but are used
   by ConnectivityManager which is not jarjared, so they are not in the
   same package after the change. Package-private members in the
   former 2 need to be public to be accessible. Changes in this commit
   are all that is needed, as demonstrated by followup commits that move
   the classes to a different package without further changes, and that
   enforce that no class in an API package gets jarjared.

 - framework-connectivity-internal-test-defaults is separated from
   framework-connectivity-test-defaults, for unit tests that need to
   access internal jarjared classes. Such tests need to use the jarjar
   rules themselves too, so this is only appropriate for connectivity
   internal unit tests.

Test: atest ConnectivityCoverageTests CtsNetTestCases
Bug: 217129444
Change-Id: Ib1bd939b71c0171d945fc01b96195d2f620ff13b

InProcessTethering runs as system_server (uid/gid AID_SYSTEM)
instead of as the network_stack (uid/gid AID_NETWORK_STACK).

Additionally only the network_stack has access to the default
selinux context of /sys/fs/bpf/tethering, which is fs_bpf_tethering,
so we need to use 'fs_bpf_net_shared' instead.

Bug: 190523685
Bug: 236925089
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ibb6ae255dcd8a8e8049be112055f60c3b2cf7df0

(mainly driven by the desire to make it clear this
is about *current* mainline state and not at-T-launch state
of things)

Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I928f91704f78205ffe44611a3d3abe383c4e560b

The objdump -x visible changes between old and new versions of the
mainline shipped .o files are really very minimal: just the inclusion
of a new .BTF section and changes/removals of some 'l' entries from
the symbol table.  However, it turns out a change to symbol ordering
is incompatible with BpfLoader <v0.10 which doesn't know to skip
non-function symbols, and as such enabling btf requires a little
bit of gymnastics.

After:
  $ adbz shell ls -l /apex/com.android.tethering/etc/bpf/*.o
  -rw-r--r-- 1 system system 118352 1969-12-31 16:00 /apex/com.android.tethering/etc/bpf/offload.o
  -rw-r--r-- 1 system system 123424 1969-12-31 16:00 /apex/com.android.tethering/etc/bpf/offload@btf.o
  -rw-r--r-- 1 system system   2232 1969-12-31 16:00 /apex/com.android.tethering/etc/bpf/test.o
  -rw-r--r-- 1 system system   6376 1969-12-31 16:00 /apex/com.android.tethering/etc/bpf/test@btf.o

$ adbz shell logcat -d | egrep offload.*[.]o
07-15 13:10:43.358     0     0 D LibBpfLoader: Loading critical for tethering ELF object /apex/com.android.tethering/etc/bpf/offload.o with license Apache 2.0
07-15 13:10:43.359     0     0 I LibBpfLoader: BpfLoader version 0x00019 ignoring ELF object /apex/com.android.tethering/etc/bpf/offload.o with max ver 0x00019
07-15 13:10:43.359     0     0 I bpfloader: Loaded object: /apex/com.android.tethering/etc/bpf/offload.o
07-15 13:10:43.374     0     0 D LibBpfLoader: Loading critical for tethering ELF object /apex/com.android.tethering/etc/bpf/offload@btf.o with license Apache 2.0
07-15 13:10:43.375     0     0 I LibBpfLoader: BpfLoader version 0x00019 processing ELF object /apex/com.android.tethering/etc/bpf/offload@btf.o with ver [0x00019,0x10000)
07-15 13:10:43.452     0     0 D LibBpfLoader: map_fd found at 0 is 6 in /apex/com.android.tethering/etc/bpf/offload@btf.o
...

Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Id658818d1d42763358747523615b7918d312588e

unregisterNetworkOffer() does not execute synchronously, so it is
possible that NetworkOffer callbacks are received after the offer was
unregistered.

Test: atest EthernetManagerTest && atest EthernetNetworkFactoryTest
Bug: 171872016
Change-Id: I2c50b01176e4968c31f83148f1831b55f8b06908

The core idea here is everything starts unexpected,
and then things are either removed from unexpected
and added to expected, or the reverse.

Test: TreeHugger, but not really, since too many combinations, hopefully any bugs will be found later...
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I44915e2ba459a8c90d9e706d46c6b89d85f0edd7

Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I77f00ba5d4044153f8e52c71ddc1384fccd00af2

Revert the previous change to filter out all non-RTN_THROW routes when
EXCLUDED_ROUTES is disabled, as that behavior is CTS tested for T, and
has been used by T for a while. The previous change already ensured that
there is no behavior change on S, so this is the safest approach.

This fixes HostsideLinkPropertiesGatingTests.

Bug: 239046959
Test: atest LinkPropertiesTest CtsHostsideNetworkTests
Change-Id: I55e078cdc06341f4957fe7bc743c0022b2c7d3da

"{@see" aren't rendered properly. Replace them with "See {@link"
or @see depending on the usage.

Bug: 238753273
Test: make doc-comment-check-docs ; Check the doc result
Change-Id: I70cb2f36e7c5fa8102b5949054df5184d755202c

Starting from T, VpnService supports exclude routes, which will
make the caller to get both of include routes and exclude routes
from LinkProperties#getRoutes(), and it's not expected to get the
exclude routes before T in production code even though the code
returns all routes.

But there is a CTS - LinkPropertiesTest#testRouteAddWithSameKey()
will try to add an exclude route and check if the result of
LinkProperties#getRoutes() contains that exclude route or not.
And the test is failed now since LinkProperties#getRoutes() will
only return include route if compat feature - EXCLUDED_ROUTES is
disabled. (EXCLUDED_ROUTES is enabled starting from target SDK T)

To fix this test failure, let LinkProperties#getRoutes() keeps
returning all routes if SDK is before T. This avoids changing
behavior on S, and even though there is still a behavior change
when upgrading to T, apps are unlikely to be relying on such
behavior, especially outside of tests.

Bug: 238061814
Test: Run "atest CtsNetTestCases:LinkPropertiesTest" on S build
      with mainline module which contains this patch.
Change-Id: Iac4362c4fe347ee3f06d5b21b0325fa69a7f27b6

The minimal required kernel version was changed in:
  https://android-review.googlesource.com/c/platform/packages/modules/Connectivity/+/2141233


  'DscpPolicy Move to kernel 5.15'

Bug: 235559605
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ibc1b1410155a2279ed84ec4cdc475f65dc61b077

tethering-module-utils-srcs filegroup only contains NetdUtils.java
class, import this class from netd-client static lib instead.

Bug: 238960524
Test: m
Change-Id: I7547c3a3a13e564408cdf8e702f3438530763381

The constants are used for the NetworkAgent.sendQosCallbackError system
API, so changing their values changes the behavior of that API. This is
observed when running S CTS against the latest version of the
connectivity module: testQosCallbackOnError fails because a
SocketNotConnectedException ends up being reported, instead of an
UnsupportedOperationException.

Revert the constants to their values before change ID:
I7102ae9ba7cb9e1cc8d06b252aad4dad75860f3e

Bug: 238061856
Test: cts-tradefed run cts -m CtsNetTestCases \
          -t android.net.cts.NetworkAgentTest
      using a CTS v12.1 package.
Change-Id: Iaa12729d9e7dc627a6654a6fa47b8248e0cd3049

Fix: 238753273
Test: make doc-comment-check-docs ; Check the doc result
Change-Id: I41c35b9cb31dcf3a372a61ad84f19295b0bc0ceb

This is a no-op and test only change. Some parameters use many
times, so add common parameters to reduce duplicated code.

Bug: 236788977
Test: atest FrameworksNetTests
Change-Id: I94370817ea87d1da5c30ea2ed467c1746edecba3

Bug: 217624062
Test: atest BpfNetMapsTest
android.net.cts.ConnectivityManagerTest#testFirewallBlocking

Change-Id: I79745231edac77d07571fa1909da5b9e811a69c4

Previously, both the sdk and apex had to specify the same *fragments
property to ensure that building a system image from a prebuilt
version of the module (both APEX and sdk snapshots) would work.

This change avoids the duplication by adding the apex to the sdk which
allows the sdk to automatically export any APIs and related information
provided by the APEX. At the moment that just includes information from
*fragments properties but may expand in future.

Bug: 232401814
Test: # Build snapshots with a fixed build number
      BUILD_NUMBER=fixed packages/modules/common/build/mainline_modules_sdks.sh
      # Remove api diff files as they contain file stamps of generated files so
      # differ every time they are generated.
      find out/dist/mainline-sdks -name \*txt | xargs rm
      # Save the snapshots away.
      mv out/dist/mainline-sdks before-changes
      # Apply this change.
      # Repeat the first two steps above and then run the following to verify
      # that this change had no effect on the generated snapshot contents.
      meld before-changes out/dist/mainline-sdks
Change-Id: Id98a645a2cdb20bc4bcdc18de565691f1ce7f799

Bug: 217624062
Test: atest BpfNetMapsTest HostsideVpnTests#testBlockIncomingPacket
Change-Id: I253c75aaeabe138a4f9d57c226744f5766ef1006

Bug: 217624062
Test: atest BpfNetMapsTest HostsideVpnTests#testBlockIncomingPacket
Change-Id: I8aeb4712c852167d553eb331f32d770582199b13

NetworkStack module utils are duplicated to net-utils-device-common-ip,
delete the module utils source code and use net-utils-device-common-ip
instead.

Bug: 235901424
Test: atest TetheringTests
Change-Id: I19fe72a92d6de1084963c2b3a38d094f8da2a91e

* changes:
  Use java BpfMap in updateUidLockdownRule
  Use java BpfMap in BpfNetMaps#addNiceApp
  Use java BpfMap in BpfNetMaps#removeNiceApp

This reverts commit ae3d3033.

Reason for revert: this cause GTS fail
Bug: 238038401

Change-Id: I3e21321e931f60208cb0befaed38e58b088ff966