)]}'
{
  "commit": "91796ab53c89cdc4697f8700b2e39bd68c5ad323",
  "tree": "10eb4d2df7054f6a7a5adae0a27ebb23361a3675",
  "parents": [
    "6dee21ed627d9c43a2190bec370914a4e98dcce7"
  ],
  "author": {
    "name": "Lorenzo Colitti",
    "email": "lorenzo@google.com",
    "time": "Wed Sep 06 16:07:02 2017 +0900"
  },
  "committer": {
    "name": "android-build-team Robot",
    "email": "android-build-team-robot@google.com",
    "time": "Fri Sep 22 23:06:50 2017 +0000"
  },
  "message": "Don\u0027t allow seamless handover to networks requiring permissions.\n\nCurrently, implicitly-marked sockets continue to work when the\nnetwork changes permission. This makes it so that UDP sockets\nconnected on a foreground network will continue to work even if\nthe network moves into the background (e.g., when the linger\ntimer fires on cell data with mobile data always on).\n\nInstead, make it so that sockets implicitly marked to a network\nbecome unroutable when the network starts requiring permissions.\nExplicitly-marked sockets will continue to be routed on the\nnetwork, as usual.\n\nThis is consistent with what we do for TCP: when a network\nchanges permissions, all implicitly-marked sockets on that\nnetwork are closed using SOCK_DESTROY.\n\nThis change should not affect any other behaviour because:\n\n- Netd only ever implicitly marks sockets to the default network\n  or to a bypassable VPN that applies to the caller.\n- In both cases, at the time of marking, the network does not\n  require permissions because:\n  - VPNs don\u0027t support permissions.\n  - The default network never requires any permissions:\n    - ConnectivityService\u0027s mDefaultRequest specifies\n      NOT_RESTRICTED.\n    - The only case where a NOT_RESTRICTED network can require a\n      permission is if it\u0027s a background network, and the default\n      network is, by definition, never a background network.\n- VPNs can\u0027t change permissions.\n- If the network is still the default network, the lack of this\n  implicit rule doesn\u0027t matter.\n\nTherefore, the only case where this rule can alter routing is if\na socket is implicitly marked on the default network and that\nnetwork, after ceasing to be the default, changes permissions.\n\nBug: 64103722\nTest: builds\nTest: manually observed IP rules while changing network permissions\nChange-Id: I255a9d216c50aa47bb951be9bd6cce59a12c6165\nMerged-In: I255a9d216c50aa47bb951be9bd6cce59a12c6165\n(cherry picked from commit d688dc8e440a6a5a51151bbc400eb6d00814fcf0)\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "aeed3e9e809f92e7e9c597b393360140cfa3609f",
      "old_mode": 33188,
      "old_path": "server/RouteController.cpp",
      "new_id": "87a56982127b148da7d3e43960bfffde1ca97f76",
      "new_mode": 33188,
      "new_path": "server/RouteController.cpp"
    }
  ]
}