wifi: Support blocked list when ClientControlEnabled is false

Control whether framework should disconnect a new/unknown client(MAC)
initially or not based on the ClientControlEnabled flag.

ClientControlEnabled (false) -> New/unknown Clients will be allowed
to connect initially i.e. framework will not blindly disconnect a new client.
Framework will instead only provide a callback notification
about new client connection.

Clients would be disconnected only after user action
i.e. user decides to adds the new client to Blocklist
This avoids unnecessarily client disconnect in the case user
chooses *not* to add client to Blocklist.

ClientControlEnabled (true) -> New/unknown Clients will *not* be allowed
to connect initially until user approval
i.e. framework will disconnect the new client and provide callback
notification about new client connection.
Clients would be allowed (next attempt) only after user/setting
approves the new client to be added to "allow list".

Impact:
No impact for ClientControlEnabled is enable.
No impact for non-supported client control feature device because it
will check overlay config: OFTAP_FEATURE_CLIENT_FORCE_DISCONNECT,
i.e. No impact with Pixel.

Bug: 159582750
Test: atest FrameworksWifiTests
Change-Id: I1c8fdbcdbacfb1bca418584bf7480192dc0a9951

5 files changed, 133 insertions, 26 deletions

diff --git a/service/java/com/android/server/wifi/SoftApManager.java b/service/java/com/android/server/wifi/SoftApManager.java
index f9720477b..ffbb388cc 100644
--- a/service/java/com/android/server/wifi/SoftApManager.java
+++ b/service/java/com/android/server/wifi/SoftApManager.java
@@ -469,12 +469,17 @@ public class SoftApManager implements ActiveModeManager {
             return true;
         }
 
+        if (mBlockedClientList.contains(newClient.getMacAddress())) {
+            Log.d(TAG, "Force disconnect for client: " + newClient + "in blocked list");
+            mWifiNative.forceClientDisconnect(
+                    mApInterfaceName, newClient.getMacAddress(),
+                    WifiManager.SAP_CLIENT_BLOCK_REASON_CODE_BLOCKED_BY_USER);
+            return false;
+        }
         if (config.isClientControlByUserEnabled()
                 && !mAllowedClientList.contains(newClient.getMacAddress())) {
-            if (!mBlockedClientList.contains(newClient.getMacAddress())) {
-                mSoftApCallback.onBlockedClientConnecting(newClient,
-                        WifiManager.SAP_CLIENT_BLOCK_REASON_CODE_BLOCKED_BY_USER);
-            }
+            mSoftApCallback.onBlockedClientConnecting(newClient,
+                    WifiManager.SAP_CLIENT_BLOCK_REASON_CODE_BLOCKED_BY_USER);
             Log.d(TAG, "Force disconnect for unauthorized client: " + newClient);
             mWifiNative.forceClientDisconnect(
                     mApInterfaceName, newClient.getMacAddress(),
@@ -667,25 +672,22 @@ public class SoftApManager implements ActiveModeManager {
                 }
                 int targetDisconnectClientNumber = mConnectedClients.size() - finalMaxClientCount;
                 List<WifiClient> allowedConnectedList = new ArrayList<>();
-                if (mApConfig.getSoftApConfiguration().isClientControlByUserEnabled()) {
-                    // Check allow list first
-                    Iterator<WifiClient> iterator = mConnectedClients.iterator();
-                    while (iterator.hasNext()) {
-                        WifiClient client = iterator.next();
-                        if (mAllowedClientList.contains(client.getMacAddress())) {
-                            allowedConnectedList.add(client);
-                        } else {
-                            Log.d(TAG, "Force disconnect for not allowed client: " + client);
-                            mWifiNative.forceClientDisconnect(
-                                    mApInterfaceName, client.getMacAddress(),
-                                    WifiManager
-                                    .SAP_CLIENT_BLOCK_REASON_CODE_BLOCKED_BY_USER);
-                            targetDisconnectClientNumber--;
-                        }
+                Iterator<WifiClient> iterator = mConnectedClients.iterator();
+                while (iterator.hasNext()) {
+                    WifiClient client = iterator.next();
+                    if (mBlockedClientList.contains(client.getMacAddress())
+                              || (mApConfig.getSoftApConfiguration().isClientControlByUserEnabled()
+                              && !mAllowedClientList.contains(client.getMacAddress()))) {
+                        Log.d(TAG, "Force disconnect for not allowed client: " + client);
+                        mWifiNative.forceClientDisconnect(
+                                mApInterfaceName, client.getMacAddress(),
+                                WifiManager.SAP_CLIENT_BLOCK_REASON_CODE_BLOCKED_BY_USER);
+                        targetDisconnectClientNumber--;
+                    } else {
+                        allowedConnectedList.add(client);
                     }
-                } else {
-                    allowedConnectedList = new ArrayList<>(mConnectedClients);
                 }
+
                 if (targetDisconnectClientNumber > 0) {
                     Iterator<WifiClient> allowedClientIterator = allowedConnectedList.iterator();
                     while (allowedClientIterator.hasNext()) {
diff --git a/service/java/com/android/server/wifi/WifiApConfigStore.java b/service/java/com/android/server/wifi/WifiApConfigStore.java
index eb2b11245..3de99711b 100644
--- a/service/java/com/android/server/wifi/WifiApConfigStore.java
+++ b/service/java/com/android/server/wifi/WifiApConfigStore.java
@@ -33,6 +33,7 @@ import com.android.wifi.resources.R;
 
 import java.nio.charset.StandardCharsets;
 import java.security.SecureRandom;
+import java.util.ArrayList;
 import java.util.Random;
 
 import javax.annotation.Nullable;
@@ -170,8 +171,10 @@ public class WifiApConfigStore {
         if ((!ApConfigUtil.isClientForceDisconnectSupported(mContext)
                 || mContext.getResources().getBoolean(
                 R.bool.config_wifiSoftapResetUserControlConfig))
-                && config.isClientControlByUserEnabled()) {
+                && (config.isClientControlByUserEnabled()
+                || config.getBlockedClientList().size() != 0)) {
             configBuilder.setClientControlByUserEnabled(false);
+            configBuilder.setBlockedClientList(new ArrayList<>());
             Log.i(TAG, "Reset ClientControlByUser to false due to device doesn't support");
         }
 
diff --git a/service/java/com/android/server/wifi/util/ApConfigUtil.java b/service/java/com/android/server/wifi/util/ApConfigUtil.java
index b385369a7..39d0df5f5 100644
--- a/service/java/com/android/server/wifi/util/ApConfigUtil.java
+++ b/service/java/com/android/server/wifi/util/ApConfigUtil.java
@@ -529,7 +529,8 @@ public class ApConfigUtil {
             SoftApCapability capability) {
         if (!capability.areFeaturesSupported(
                 SoftApCapability.SOFTAP_FEATURE_CLIENT_FORCE_DISCONNECT)
-                && (config.getMaxNumberOfClients() != 0 || config.isClientControlByUserEnabled())) {
+                && (config.getMaxNumberOfClients() != 0 || config.isClientControlByUserEnabled()
+                || config.getBlockedClientList().size() != 0)) {
             Log.d(TAG, "Error, Client control requires HAL support");
             return false;
         }
diff --git a/tests/wifitests/src/com/android/server/wifi/SoftApManagerTest.java b/tests/wifitests/src/com/android/server/wifi/SoftApManagerTest.java
index 99cd2db82..ddd8fe515 100644
--- a/tests/wifitests/src/com/android/server/wifi/SoftApManagerTest.java
+++ b/tests/wifitests/src/com/android/server/wifi/SoftApManagerTest.java
@@ -1190,6 +1190,92 @@ public class SoftApManagerTest extends WifiBaseTest {
     }
 
     @Test
+    public void testClientConnectFailureWhenClientInBlcokedListAndClientAuthorizationDisabled()
+            throws Exception {
+        ArrayList<MacAddress> blockedClientList = new ArrayList<>();
+        mTestSoftApCapability.setMaxSupportedClients(10);
+        Builder configBuilder = new SoftApConfiguration.Builder();
+        configBuilder.setBand(SoftApConfiguration.BAND_2GHZ);
+        configBuilder.setSsid(TEST_SSID);
+        configBuilder.setClientControlByUserEnabled(false);
+        // Client in blocked list
+        blockedClientList.add(TEST_MAC_ADDRESS);
+        configBuilder.setBlockedClientList(blockedClientList);
+        SoftApModeConfiguration apConfig =
+                new SoftApModeConfiguration(WifiManager.IFACE_IP_MODE_TETHERED,
+                configBuilder.build(), mTestSoftApCapability);
+        startSoftApAndVerifyEnabled(apConfig);
+
+        verify(mCallback).onConnectedClientsChanged(new ArrayList<>());
+
+        mSoftApListenerCaptor.getValue().onConnectedClientsChanged(
+                TEST_NATIVE_CLIENT, true);
+        mLooper.dispatchAll();
+
+        // Client is not allow verify
+        verify(mWifiNative).forceClientDisconnect(
+                        TEST_INTERFACE_NAME, TEST_MAC_ADDRESS,
+                        WifiManager.SAP_CLIENT_BLOCK_REASON_CODE_BLOCKED_BY_USER);
+        verify(mWifiMetrics, never()).addSoftApNumAssociatedStationsChangedEvent(
+                1, apConfig.getTargetMode());
+        verify(mCallback, never()).onConnectedClientsChanged(
+                Mockito.argThat((List<WifiClient> clients) ->
+                        clients.contains(TEST_CONNECTED_CLIENT))
+        );
+
+    }
+
+    @Test
+    public void testClientDisconnectWhenClientInBlcokedLisUpdatedtAndClientAuthorizationDisabled()
+            throws Exception {
+        ArrayList<MacAddress> blockedClientList = new ArrayList<>();
+        mTestSoftApCapability.setMaxSupportedClients(10);
+        Builder configBuilder = new SoftApConfiguration.Builder();
+        configBuilder.setBand(SoftApConfiguration.BAND_2GHZ);
+        configBuilder.setSsid(TEST_SSID);
+        configBuilder.setClientControlByUserEnabled(false);
+        SoftApModeConfiguration apConfig =
+                new SoftApModeConfiguration(WifiManager.IFACE_IP_MODE_TETHERED,
+                configBuilder.build(), mTestSoftApCapability);
+        startSoftApAndVerifyEnabled(apConfig);
+
+        verify(mCallback).onConnectedClientsChanged(new ArrayList<>());
+
+        mSoftApListenerCaptor.getValue().onConnectedClientsChanged(
+                TEST_NATIVE_CLIENT, true);
+        mLooper.dispatchAll();
+
+        // Client connected check
+        verify(mWifiNative, never()).forceClientDisconnect(
+                        TEST_INTERFACE_NAME, TEST_MAC_ADDRESS,
+                        WifiManager.SAP_CLIENT_BLOCK_REASON_CODE_BLOCKED_BY_USER);
+        verify(mWifiMetrics).addSoftApNumAssociatedStationsChangedEvent(
+                1, apConfig.getTargetMode());
+        verify(mCallback, times(2)).onConnectedClientsChanged(
+                Mockito.argThat((List<WifiClient> clients) ->
+                        clients.contains(TEST_CONNECTED_CLIENT))
+        );
+
+        reset(mCallback);
+        reset(mWifiNative);
+        // Update configuration
+        blockedClientList.add(TEST_MAC_ADDRESS);
+        configBuilder.setBlockedClientList(blockedClientList);
+        mSoftApManager.updateConfiguration(configBuilder.build());
+        mLooper.dispatchAll();
+        // Client difconnected
+        verify(mWifiNative).forceClientDisconnect(
+                        TEST_INTERFACE_NAME, TEST_MAC_ADDRESS,
+                        WifiManager.SAP_CLIENT_BLOCK_REASON_CODE_BLOCKED_BY_USER);
+        // The callback should not trigger in configuration update case.
+        verify(mCallback, never()).onBlockedClientConnecting(TEST_CONNECTED_CLIENT,
+                WifiManager.SAP_CLIENT_BLOCK_REASON_CODE_BLOCKED_BY_USER);
+
+    }
+
+
+
+    @Test
     public void testForceClientDisconnectInvokeBecauseClientAuthorizationEnabled()
             throws Exception {
         mTestSoftApCapability.setMaxSupportedClients(10);
diff --git a/tests/wifitests/src/com/android/server/wifi/WifiApConfigStoreTest.java b/tests/wifitests/src/com/android/server/wifi/WifiApConfigStoreTest.java
index d19a4f002..90e01719f 100644
--- a/tests/wifitests/src/com/android/server/wifi/WifiApConfigStoreTest.java
+++ b/tests/wifitests/src/com/android/server/wifi/WifiApConfigStoreTest.java
@@ -723,14 +723,19 @@ public class WifiApConfigStoreTest extends WifiBaseTest {
         // Test client control setting when force client disconnect doesn't support
         mResources.setBoolean(R.bool.config_wifiSofapClientForceDisconnectSupported, false);
         ArrayList<MacAddress> blockedClientList = new ArrayList<>();
+        ArrayList<MacAddress> allowedClientList = new ArrayList<>();
         blockedClientList.add(MacAddress.fromString("11:22:33:44:55:66"));
+        allowedClientList.add(MacAddress.fromString("aa:bb:cc:dd:ee:ff"));
         configBuilder.setBlockedClientList(blockedClientList);
+        configBuilder.setAllowedClientList(allowedClientList);
 
         configBuilder.setClientControlByUserEnabled(true);
         resetedConfig = store.resetToDefaultForUnsupportedConfig(configBuilder.build());
         assertFalse(resetedConfig.isClientControlByUserEnabled());
-        // The blocked list still keep
-        assertEquals(resetedConfig.getBlockedClientList(), blockedClientList);
+        // The blocked list will be clean
+        assertEquals(resetedConfig.getBlockedClientList().size(), 0);
+        // The allowed list will be keep
+        assertEquals(resetedConfig.getAllowedClientList(), allowedClientList);
 
         // Test max client setting when reset enabled but force client disconnect supported
         mResources.setBoolean(R.bool.config_wifiSofapClientForceDisconnectSupported, true);
@@ -744,7 +749,17 @@ public class WifiApConfigStoreTest extends WifiBaseTest {
                 R.bool.config_wifiSoftapResetUserControlConfig, true);
         resetedConfig = store.resetToDefaultForUnsupportedConfig(configBuilder.build());
         assertFalse(resetedConfig.isClientControlByUserEnabled());
-        assertEquals(resetedConfig.getBlockedClientList(), blockedClientList);
+        assertEquals(resetedConfig.getBlockedClientList().size(), 0);
+        assertEquals(resetedConfig.getAllowedClientList(), allowedClientList);
+
+        // Test blocked list setting will be reset even if client control disabled
+        mResources.setBoolean(
+                R.bool.config_wifiSoftapResetUserControlConfig, true);
+        configBuilder.setClientControlByUserEnabled(false);
+        resetedConfig = store.resetToDefaultForUnsupportedConfig(configBuilder.build());
+        assertFalse(resetedConfig.isClientControlByUserEnabled());
+        assertEquals(resetedConfig.getBlockedClientList().size(), 0);
+        assertEquals(resetedConfig.getAllowedClientList(), allowedClientList);
     }
 
     /**