Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5f20903f authored by Remi NGUYEN VAN's avatar Remi NGUYEN VAN Committed by Gerrit Code Review
Browse files

Merge "Refine DNS private IP probes"

parents 1e13c9b2 48565ecf

common/captiveportal/src/android/net/captiveportal/CaptivePortalProbeResult.java

+5 −4
Original line number Diff line number Diff line
@@ -36,10 +36,11 @@ public final class CaptivePortalProbeResult { 
     */

    public static final int PARTIAL_CODE = -1;



    // DNS response with private IP on the probe URL means the network, especially Wi-Fi network is

    // not connected to the Internet. This code represents the result of a single probe, for correct

    // logging of the probe results. The result of the whole evaluation would typically be FAILED if

    // one of the probes returns this status.

    // DNS response with private IP on the probe URL suggests that the network, especially Wi-Fi

    // network is not connected to the Internet. This code represents the result of a single probe,

    // for correct logging of the probe results. The result of the whole evaluation would typically

    // be FAILED if one of the probes returns this status.

    // This logic is only used if the config_force_dns_probe_private_ip_no_internet flag is set.

    public static final int DNS_PRIVATE_IP_RESPONSE_CODE = -2;



    @NonNull

src/android/net/util/NetworkStackUtils.java

+8 −0
Original line number Diff line number Diff line
@@ -385,4 +385,12 @@ public class NetworkStackUtils { 
                (address instanceof Inet6Address) ? "[%s]:%d" : "%s:%d",

                        address.getHostAddress(), port);

    }



    /**

     * Return true if the provided address is non-null and an IPv6 Unique Local Address (RFC4193).

     */

    public static boolean isIPv6ULA(@Nullable InetAddress addr) {

        return addr instanceof Inet6Address

                && ((addr.getAddress()[0] & 0xfe) == 0xfc);

    }

}

src/com/android/server/connectivity/NetworkMonitor.java

+13 −11
Original line number Diff line number Diff line
@@ -72,6 +72,7 @@ import static android.net.util.NetworkStackUtils.DEFAULT_CAPTIVE_PORTAL_HTTP_URL 
import static android.net.util.NetworkStackUtils.DISMISS_PORTAL_IN_VALIDATED_NETWORK;

import static android.net.util.NetworkStackUtils.DNS_PROBE_PRIVATE_IP_NO_INTERNET_VERSION;

import static android.net.util.NetworkStackUtils.isEmpty;

import static android.net.util.NetworkStackUtils.isIPv6ULA;

import static android.provider.DeviceConfig.NAMESPACE_CONNECTIVITY;



import static com.android.networkstack.apishim.ConstantsShim.DETECTION_METHOD_DNS_EVENTS;
@@ -427,7 +428,7 @@ public class NetworkMonitor extends StateMachine { 
    private boolean mAcceptPartialConnectivity = false;

    private final EvaluationState mEvaluationState = new EvaluationState();



    private final boolean mPrivateIpNotPortalEnabled;

    private final boolean mPrivateIpNoInternetEnabled;



    private int getCallbackVersion(INetworkMonitorCallbacks cb) {

        int version;
@@ -490,7 +491,7 @@ public class NetworkMonitor extends StateMachine { 
        // CHECKSTYLE:ON IndentationCheck



        mIsCaptivePortalCheckEnabled = getIsCaptivePortalCheckEnabled();

        mPrivateIpNotPortalEnabled = getIsPrivateIpNotPortalEnabled();

        mPrivateIpNoInternetEnabled = getIsPrivateIpNoInternetEnabled();

        mUseHttps = getUseHttpsValidation();

        mCaptivePortalUserAgent = getCaptivePortalUserAgent();

        mCaptivePortalHttpsUrls = makeCaptivePortalHttpsUrls();
@@ -1441,7 +1442,7 @@ public class NetworkMonitor extends StateMachine { 
        return mode != CAPTIVE_PORTAL_MODE_IGNORE;

    }



    private boolean getIsPrivateIpNotPortalEnabled() {

    private boolean getIsPrivateIpNoInternetEnabled() {

        return mDependencies.isFeatureEnabled(mContext, DNS_PROBE_PRIVATE_IP_NO_INTERNET_VERSION)

                || mContext.getResources().getBoolean(

                        R.bool.config_force_dns_probe_private_ip_no_internet);
@@ -1919,9 +1920,9 @@ public class NetworkMonitor extends StateMachine { 
        // information to callers that does not make sense because the state machine has already

        // changed state.

        final InetAddress[] resolvedAddr = sendDnsProbe(host);

        // The private IP logic only applies to the HTTP probe, not the HTTPS probe (which would

        // fail anyway) or the PAC probe.

        if (mPrivateIpNotPortalEnabled && probeType == ValidationProbeEvent.PROBE_HTTP

        // The private IP logic only applies to captive portal detection (the HTTP probe), not

        // network validation (the HTTPS probe, which would likely fail anyway) or the PAC probe.

        if (mPrivateIpNoInternetEnabled && probeType == ValidationProbeEvent.PROBE_HTTP

                && (proxy == null) && hasPrivateIpAddress(resolvedAddr)) {

            return CaptivePortalProbeResult.PRIVATE_IP;

        }
@@ -1959,8 +1960,7 @@ public class NetworkMonitor extends StateMachine { 
    }



    /**

     * Check if any of the provided IP addresses include a private IP, as defined by

     * {@link com.android.server.util.NetworkStackConstants#PRIVATE_IPV4_RANGES}.

     * Check if any of the provided IP addresses include a private IP.

     * @return true if an IP address is private.

     */

    private static boolean hasPrivateIpAddress(@Nullable InetAddress[] addresses) {
@@ -1968,7 +1968,8 @@ public class NetworkMonitor extends StateMachine { 
            return false;

        }

        for (InetAddress address : addresses) {

            if (address.isLinkLocalAddress() || address.isSiteLocalAddress()) {

            if (address.isLinkLocalAddress() || address.isSiteLocalAddress()

                    || isIPv6ULA(address)) {

                return true;

            }

        }
@@ -2343,10 +2344,11 @@ public class NetworkMonitor extends StateMachine { 
        }

        // Consider a DNS response with a private IP address on the HTTP probe as an indication that

        // the network is not connected to the Internet, and have the whole evaluation fail in that

        // case.

        // case, instead of potentially detecting a captive portal. This logic only affects portal

        // detection, not network validation.

        // This only applies if the DNS probe completed within PROBE_TIMEOUT_MS, as the fallback

        // probe should not be delayed by this check.

        if (mPrivateIpNotPortalEnabled && (httpResult.isDnsPrivateIpResponse())) {

        if (mPrivateIpNoInternetEnabled && (httpResult.isDnsPrivateIpResponse())) {

            validationLog("DNS response to the URL is private IP");

            return CaptivePortalProbeResult.FAILED;

        }

tests/unit/src/android/net/util/NetworkStackUtilsTest.java

+15 −1
Original line number Diff line number Diff line
@@ -16,6 +16,9 @@ 


package android.net.util;



import static android.net.InetAddresses.parseNumericAddress;

import static android.net.util.NetworkStackUtils.isIPv6ULA;



import static com.android.dx.mockito.inline.extended.ExtendedMockito.doReturn;

import static com.android.dx.mockito.inline.extended.ExtendedMockito.mockitoSession;
@@ -185,4 +188,15 @@ public class NetworkStackUtilsTest { 
        assertFalse(NetworkStackUtils.isFeatureEnabled(mContext, TEST_NAME_SPACE,

                TEST_EXPERIMENT_FLAG));

    }



    @Test

    public void testIsIPv6ULA() {

        assertTrue(isIPv6ULA(parseNumericAddress("fc00::")));

        assertTrue(isIPv6ULA(parseNumericAddress("fc00::1")));

        assertTrue(isIPv6ULA(parseNumericAddress("fc00:1234::5678")));

        assertTrue(isIPv6ULA(parseNumericAddress("fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff")));



        assertFalse(isIPv6ULA(parseNumericAddress("fe00::")));

        assertFalse(isIPv6ULA(parseNumericAddress("2480:1248::123:456")));

    }

}
 
 No newline at end of file