The API surface of com.android.dynsystem is already protected by
privileged permission android.permission.INSTALL_DYNAMIC_SYSTEM,
which is only granted to system apps or priv apps.
Thus the feature flag check here is redundant, because eligible
callers of this API (system app) can also set the feature flag.

Bug: 176795908
Test: Presubmit
Test: Test DSU installation Intent
Change-Id: Iedac8763372ef6f11754d3f272f70753fb3d4829
Merged-In: Iedac8763372ef6f11754d3f272f70753fb3d4829

* changes:
  NetworkWatchlistServiceTests: update IIpConnectivityMetrics.
  Stop using IIpConnectivityMetrics in ConnectivityService.

This reverts commit 22419568.

Reason for revert: 177065099

Change-Id: Id47cc94591eefbc276f77ae8601bb6d52cfa2f63

This reverts commit 2b1b3b28.

Reason for revert: b/177065099

Change-Id: I0ac8d525c9f36ace5e65ffb2305f75fef0b6dc65

This reverts commit ac6bbdb6.

Reason for revert: b/177065099

Change-Id: I11d8a498f25b3e734a28f160a6b65c5b5720a38d

Bug: 171801262
Test: Boot with and without overlay set and check ifconfig
Change-Id: I1fd332caf3e09924abcfec9c2c137363be7873e4

* changes:
  Prevent clearing Restricted Mode uid state when other rules change
  Add shell command to query Restricted Mode state
  Add Restricted Mode settings observer to NetworkPolicyManagerService

Bug: 157505406
Test: atest NetworkPolicyManagerServiceTest &&
      atest com.android.cts.net.HostsideRestrictBackgroundNetworkTests
Change-Id: I3437d222116a0860c8192d30b185560a73c043a7

This will be used in the CTS test to query the state of the Restricted
Mode.

Test: adb shell cmd netpolicy get restricted-mode
Bug: 170323671
Bug: 175281879
Change-Id: Ic25b5835d48a4b54eb9f2b4817244651ea09bd60

This allows to enable / disable restricted mode at runtime.

Test: adb shell settings put global restricted_networking_mode 1
Bug: 170322816
Bug: 157505406
Change-Id: Ie9456f6a0b8d6d4e8e4bdfc3f6954e247fd9c5fb
Merged-In: Ie9456f6a0b8d6d4e8e4bdfc3f6954e247fd9c5fb

* changes:
  Add Restricted Mode handling to NetworkPolicyManager
  Refactor updating rules for all apps in NetworkPolicyManagerService

Netd currently calls maybeCloseSockets before adding/removing users for
network. The task should be moved from netd to CS. In this way, we can
handle WiFi lingering more easily in the future.

Test: atest HostsideVpnTests
Test: atest FrameworksNetTests
Change-Id: Icf8125e8552c89da367a67f48611ed193a1a343d

IIpConnectivityMetrics is gaining two new methods. Update the
subclass of that class used in NetworkWatchlistServiceTests to
reflect the new methods.

Bug: 171540887
Test: m FrameworksServicesTests
Change-Id: I3eb82680b6b3dd6b457095a484cf55560ff1088b

Currently, ConnectivityService calls the IpConnectivityMetrics
service class directly to log default network events. This is
incompatible with ConnectivityService being in a mainline module.
Replace direct access to IIpConnectivityMetrics with public
methods in IpConnectivityLog, which is @SystemApi class.

The new methods are not yet @SystemApi, but they can be made so
if desired. Alternatively, these metrics could be deleted.

Also remove the IpConectivityMetrics service from the
service-connectivity JAR, and go back to starting it from
SystemServer.java, which is what was happening a few hours ago
before aosp/1542626 was merged.

Test: builds, boots
Test: atest FrameworksNetTests
Test: "dumpsys connmetrics" shows events, including default network events
Change-Id: I9d6147d93590363a2f8f83f39f05c03d001b4851

Adds Restricted Mode functionality to NetworkPolicyManager. When this
mode is turned on (via setting), only apps with
android.permission.CONNECTIVITY_USE_RESTRICTED_NETWORKS will be able to
use the network. For all other apps, the network will be blocked by the
firewall. This is controlled by a new allowlist firewall chain
fw_restricted_mode.

As a first step, this implementation still requires a reboot after the
enabling / disabling the mode to take effect. I will provide the dynamic
configuration in the next CL.

Test: atest CtsHostsideNetworkTests && atest
NetworkPolicyManagerServiceTest
Bug: 170322816
Bug: 157505406
Bug: 170322455
Bug: 175281879

Exempt-From-Owner-Approval: Change already merged on internal gerrit.
Change-Id: I0731fa842c69683953baaf9ec3a9a03454f4c607
Merged-In: I0731fa842c69683953baaf9ec3a9a03454f4c607

This gives more flexibility to the user (e.g. will allow restricted
networking mode to update all firewall rules at once) and removes some
unnecessary code.

Bug: 170322816
Bug: 157505406
Test: atest NeworkPolicyManagerServiceTest
Change-Id: Id31a60ad37c280bfb4f5bacf63aafe9de28c5e62
Merged-In: Id31a60ad37c280bfb4f5bacf63aafe9de28c5e62

The RCS publishing device's capabilities APIs are exposed to be the SystemAPI and add the CTS for these APIs.

bug: 174187744
Test: atest -c CtsTelephonyTestCases:android.telephony.ims.cts.ImsServiceTest
Change-Id: I731dbe64614b91efa0002ffccb638b4a10f7c5f4

Connectivity service is going to become a mainline module which
will not able to access hidden APIs. NetworkPolicyManagerInternal
is a internal serivce that CS can't be access after be a mainline
module. Thus, replace NPMI#isUidNetworkingBlocked() to similar
method NPMS#isUidNetworkingBlocked() and create new API
NPM#isUidNetworkingBlocked() to support CS usage.

Bug: 170598012
Test: atest FrameworksNetTests
Test: atest FrameworksCoreTests:NetworkPolicyManagerTest
Test: atest FrameworksServicesTests:NetworkPolicyManagerServiceTest
Test: atest CtsNetTestCases
Test: atest CtsHostsideNetworkTests
Change-Id: Ic3427c71c395de787320f303c9513874b4d64f98

Extend CaptivePortalData with a member to hold the venue friendly
name. If CaptivePortalData is initialized by both the network
agent and Capport, merge the two objects to include the venue
friendly name and prioritize the venue URL from the network
agent.

Bug: 162783305
Test: atest ConnectivityServiceTest
Test: atest CtsNetTestCasesLatestSdk:CaptivePortalDataTest
Test: End-to-end test
Change-Id: I4fdf356be42237c5b6c0ae5bacfd3cec4726861b

Part 1 was aosp/1546301.
Two parts are required due to b/175318571.

Test: N/A
Change-Id: I1a89f7d26da70dce36d1e891a8e8ebc4042dc56c